On 24/05/2023 15:33, Luis Peromarta via samba wrote:> Greetings.
>
> A bit more on sysvolchek / reset.
>
> I have a 3 DCs domain. All working fine. DC2 and DC3 rsync sysvol from DC1
on a hourly basis. No issues with GPOs. Some months ago I ran all L.P.H. van
Belle steps as per?https://wiki.samba.org/index.php/Sysvolreset?and all seems
OK.
>
> Because of a thread currently on the list, I decided to do a quick check on
DC2. No problem breaking things, I can always rsync demo DC1 again.
>
> On DC2 (bookworm) :
>
> Samba is stopped.
>
> ./samba-check-set-sysvol.sh
>
> INFO 2023-05-24 16:24:36,614 pid:107693
/usr/lib/python3/dist-packages/samba/netcmd/testparm.py #96: Loaded smb config
files from /etc/samba/smb.conf
> INFO 2023-05-24 16:24:36,614 pid:107693
/usr/lib/python3/dist-packages/samba/netcmd/testparm.py #97: Loaded services
file OK.
> failed to call wbcSidToUid: WBC_ERR_WINBIND_NOT_AVAILABLE
> Could not convert sid S-1-5-32-549 to uid
>
> Strange why am I getting this, winbind is installed.
>
>
> I tried sysvolcheck on DC2 and get:
>
>
> root at bwing:/var/lib/samba# samba-tool ntacl sysvolcheck
> ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
exception - ProvisioningError: DB ACL on sysvol directory
/var/lib/samba/sysvol/mad.mater.int
O:LAG:BAD:AI(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;S-1-5-21-2152908145-95474353-1514027631-1110)(A;OICIID;0x001200a9;;;AU)(A;OICIID;0x001f01ff;;;DA)(A;OICIID;0x001200a9;;;SO)(A;OICIID;0x001f01ff;;;SY)
does not match expected value
O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)
from provision
> ??File
"/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185,
in _run
> ?? ?return self.run(*args, **kwargs)
> ? ? ? ? ? ?^^^^^^^^^^^^^^^^^^^^^^^^^
> ??File "/usr/lib/python3/dist-packages/samba/netcmd/ntacl.py",
line 443, in run
> ?? ?provision.checksysvolacl(samdb, netlogon, sysvol,
> ??File
"/usr/lib/python3/dist-packages/samba/provision/__init__.py", line
1873, in checksysvolacl
> ?? ?raise ProvisioningError('%s ACL on sysvol directory %s %s does not
match expected value %s from provision' % (acl_type(direct_db_access),
dir_path, fsacl_sddl, SYSVOL_ACL))
>
>
> I have absolutely no idea how to decode this. Then I tried
>
> samba-tool ntacl sysvolreset (after a couple of minutes?)
>
> No errors, no output. Then:
>
> net cache flush && samba-tool ntacl sysvolcheck
>
> ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
exception - ProvisioningError: DB ACL on GPO directory
/var/lib/samba/sysvol/mad.mater.int/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}
O:LAG:DAD:PAR(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)(OA;OICI;;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)
does not match expected value
O:DAG:DAD:PAR(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)(OA;OICI;;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)
from GPO object
> ??File
"/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185,
in _run
> ?? ?return self.run(*args, **kwargs)
> ? ? ? ? ? ?^^^^^^^^^^^^^^^^^^^^^^^^^
> ??File "/usr/lib/python3/dist-packages/samba/netcmd/ntacl.py",
line 443, in run
> ?? ?provision.checksysvolacl(samdb, netlogon, sysvol,
> ??File
"/usr/lib/python3/dist-packages/samba/provision/__init__.py", line
1876, in checksysvolacl
> ?? ?check_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp,
> ??File
"/usr/lib/python3/dist-packages/samba/provision/__init__.py", line
1826, in check_gpos_acl
> ?? ?check_dir_acl(policy_path, dsacl2fsacl(acl, domainsid), lp,
> ??File
"/usr/lib/python3/dist-packages/samba/provision/__init__.py", line
1769, in check_dir_acl
> ?? ?raise ProvisioningError('%s ACL on GPO directory %s %s does not
match expected value %s from GPO object' % (acl_type(direct_db_access),
path, fsacl_sddl, acl))
>
>
> This time I can see it?s complaining about
GPO??{31B2F340-016D-11D2-945F-00C04FB984F9}. This seems to be the default domain
policy.
>
> Everything seems to be working fine, is looking into this worth anything ?
>
> Thanks,
>
> LP
If you look very carefully at the output from the error after you ran
sysvolreset, you will see that the difference is at the start. The ACL
owners 'O:LAG:DA' do not match what is expected 'O:DAG:DA'
If you do not understand the output, let me decipher it:
O = owner
LA = Local Administrator, probably 'root'
G = group
DA = Domain Admins
so to put it another way, you appear to have 'root:Domain Admins' as the
owner of
/var/lib/samba/sysvol/mad.mater.int/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}
and it should be 'Domain Admins:Domain Admins'
Are you by any chance using rfc2307 attributes and if so, have you given
Domain Admins a gidNumber ?
Rowland