[Samba] Re: Proper behavior of Interdomain Trust uid mappings
John H Terpstra
jht at Samba.Org
Wed Jun 15 16:31:43 GMT 2005
On Wednesday 15 June 2005 10:24, Robert Kelly wrote:
> Ian Clancy wrote:
> > I spent quite a while myself trying to figure this out. I'm not sure if
> > what i have done is correct but in nsswitch.conf i have :
> > ----
> > passwd: files ldap winbind
> > shadow: files ldap winbind
> > group: files ldap winbind
> > -----
>
> Nice, that fixed the creation of sambaIdmapEntry objects in ou=IdMap
> That definitely needs to make its way into the howto.
Please provide a suggested documentation update. I am happy to receive it in
text form, but do specifiy the section number it should go into. If you can
get this to me within the next 48 hours it will make it into the second
edition that will go to the printers early next week.
- John T.
>
> > I had this same problem
>
> until i added winbind to the nsswitch.conf file.
>
> > Can you see the users from the trusted domain when you enter 'wbinfo -u
> > ' at the shell ?
>
> 'wbinfo -u' :
> 'Error looking up domain users'
>
> 'wbinfo -g' :
> BUILTIN\print operators
> BUILTIN\backup operators
> BUILTIN\replicator
> BUILTIN\account operators
> BUILTIN\administrators
> BUILTIN\guests
> BUILTIN\server operators
> BUILTIN\users
>
> 'getent passwd DOMB\\username' however works and pulls up the correct
> idmap info.
>
> 'wbinfo -m' :
> BUILTIN
> DOMB
>
> 'wbinfo --sequence' :
> BUILTIN : 1
> DOMB : DISCONNECTED
> DOMA : 1
>
>
>
> The problem still exists where a user has to access a share on the pdc
> before any of the member servers will stop popping up the password dialog.
>
> 'testparm -v' on my pdc:
> # Global parameters
> [global]
> dos charset = CP850
> unix charset = UTF-8
> display charset = LOCALE
> workgroup = DOMA
> realm =
> netbios name = PDC
> netbios aliases =
> netbios scope =
> server string = Samba Server %v
> interfaces =
> bind interfaces only = No
> security = USER
> auth methods =
> encrypt passwords = Yes
> update encrypted = No
> client schannel = Auto
> server schannel = Auto
> allow trusted domains = Yes
> hosts equiv =
> min password length = 5
> map to guest = Never
> null passwords = No
> obey pam restrictions = No
> password server = *
> smb passwd file = /etc/samba/smbpasswd
> private dir = /etc/samba
> passdb backend = ldapsam:ldap://ldap.domain.tld
> algorithmic rid base = 1000
> root directory =
> guest account = nobody
> enable privileges = Yes
> pam password change = No
> passwd program =
> passwd chat = *new*password* %n\n *new*password* %n\n *changed*
> passwd chat debug = No
> passwd chat timeout = 2
> check password script =
> username map =
> password level = 0
> username level = 0
> unix password sync = No
> restrict anonymous = 0
> lanman auth = Yes
> ntlm auth = Yes
> client NTLMv2 auth = Yes
> client lanman auth = No
> client plaintext auth = No
> preload modules =
> use kerberos keytab = No
> log level = 0 passdb:0 auth:2 winbind:5
> syslog = 0
> syslog only = No
> log file = /var/log/samba/log.%m
> max log size = 100000
> debug timestamp = Yes
> debug hires timestamp = No
> debug pid = No
> debug uid = No
> smb ports = 445 139
> large readwrite = Yes
> max protocol = NT1
> min protocol = CORE
> read bmpx = No
> read raw = Yes
> write raw = Yes
> disable netbios = No
> acl compatibility =
> defer sharing violations = Yes
> nt pipe support = Yes
> nt status support = Yes
> announce version = 4.9
> announce as = NT
> max mux = 50
> max xmit = 16644
> name resolve order = lmhosts wins host bcast
> max ttl = 259200
> max wins ttl = 518400
> min wins ttl = 21600
> time server = Yes
> unix extensions = Yes
> use spnego = Yes
> client signing = auto
> server signing = auto
> client use spnego = Yes
> change notify timeout = 60
> deadtime = 10
> getwd cache = Yes
> keepalive = 300
> kernel change notify = Yes
> lpq cache time = 30
> max smbd processes = 0
> paranoid server security = Yes
> max disk size = 0
> max open files = 10000
> socket options = TCP_NODELAY
> use mmap = Yes
> hostname lookups = No
> name cache timeout = 660
> load printers = Yes
> printcap cache time = 0
> printcap name = cups
> cups server =
> disable spoolss = No
> enumports command =
> addprinter command =
> deleteprinter command =
> show add printer wizard = Yes
> os2 driver map =
> mangling method = hash2
> mangle prefix = 1
> stat cache = Yes
> machine password timeout = 604800
> add user script = /usr/local/sbin/smbldap-useradd "%u"
> delete user script = /usr/local/sbin/smbldap-userdel "%u"
> add group script = /usr/local/sbin/smbldap-groupadd -p "%g"
> delete group script = /usr/local/sbin/smbldap-groupdel "%g"
> add user to group script = /usr/local/sbin/smbldap-groupmod -m
> "%u" "%g" delete user from group script =
> /usr/local/sbin/smbldap-groupmod -x "%u" "%g"
> set primary group script = /usr/local/sbin/smbldap-usermod -g
> "%g" "%u"
> add machine script = /usr/local/sbin/smbldap-useradd -w "%u"
> shutdown script =
> abort shutdown script =
> logon script =
> logon path =
> logon drive =
> logon home =
> domain logons = Yes
> os level = 65
> lm announce = Auto
> lm interval = 60
> preferred master = Yes
> local master = Yes
> domain master = Yes
> browse list = Yes
> enhanced browsing = Yes
> dns proxy = Yes
> wins proxy = No
> wins server = 10.40.2.12
> wins support = No
> wins hook =
> wins partners =
> kernel oplocks = Yes
> lock spin count = 3
> lock spin time = 10
> oplock break wait time = 0
> ldap admin dn = cn=Manager,dc=domain,dc=tld
> ldap delete dn = Yes
> ldap filter = (uid=%u)
> ldap group suffix = ou=Groups
> ldap idmap suffix = ou=Idmap
> ldap machine suffix = ou=Computers
> ldap passwd sync = Yes
> ldap replication sleep = 1000
> ldap suffix = dc=domain,dc=tld
> ldap ssl = no
> ldap timeout = 15
> ldap user suffix = ou=Users
> add share command =
> change share command =
> delete share command =
> config file =
> preload =
> lock directory = /var/lib/samba
> pid directory = /var/run/samba
> utmp directory =
> wtmp directory =
> utmp = No
> default service =
> message command =
> dfree command =
> get quota command =
> set quota command =
> remote announce =
> remote browse sync =
> socket address = 0.0.0.0
> homedir map = auto.home
> afs username map =
> afs token lifetime = 604800
> log nt token command =
> time offset = 0
> NIS homedir = No
> panic action =
> host msdfs = No
> enable rid algorithm = Yes
> idmap backend = ldap:ldap://ldap.domain.tld
> idmap uid = 150000-550000
> idmap gid = 150000-550000
> template primary group = nobody
> template homedir = /home/%D/%U
> template shell = /bin/false
> winbind separator = \
> winbind cache time = 300
> winbind enable local accounts = No
> winbind enum users = Yes
> winbind enum groups = Yes
> winbind use default domain = No
> winbind trusted domains only = Yes
> winbind nested groups = No
> comment =
> path =
> username =
> invalid users =
> valid users =
> admin users = "@Domain Admins"
> read list =
> write list =
> printer admin =
> force user =
> force group =
> read only = Yes
> create mask = 0640
> force create mode = 00
> security mask = 0777
> force security mode = 00
> directory mask = 0750
> force directory mode = 00
> directory security mask = 0777
> force directory security mode = 00
> force unknown acl user = No
> inherit permissions = No
> inherit acls = No
> guest only = No
> guest ok = No
> only user = No
> hosts allow =
> hosts deny =
> allocation roundup size = 1048576
> ea support = No
> nt acl support = Yes
> profile acls = No
> map acl inherit = No
> afs share = No
> block size = 1024
> max connections = 0
> min print space = 0
> strict allocate = No
> strict sync = No
> sync always = No
> use sendfile = No
> write cache size = 0
> max reported print jobs = 0
> max print jobs = 1000
> printable = No
> printing = cups
> cups options =
> print command =
> lpq command = %p
> lprm command =
> lppause command =
> lpresume command =
> queuepause command =
> queueresume command =
> printer name =
> use client driver = No
> default devmode = No
> force printername = No
> default case = lower
> case sensitive = No
> preserve case = Yes
> short preserve case = Yes
> mangling char = ~
> hide dot files = Yes
> hide special files = No
> hide unreadable = No
> hide unwriteable files = No
> delete veto files = No
> veto files =
> hide files =
> veto oplock files =
> map system = No
> map hidden = No
> map archive = Yes
> mangled names = Yes
> mangled map =
> store dos attributes = No
> browseable = Yes
> blocking locks = Yes
> csc policy = manual
> fake oplocks = No
> locking = Yes
> oplocks = Yes
> level2 oplocks = Yes
> oplock contention limit = 2
> posix locking = Yes
> strict locking = Yes
> share modes = Yes
> copy =
> include =
> preexec =
> preexec close = No
> postexec =
> root preexec =
> root preexec close = No
> root postexec =
> available = Yes
> volume =
> fstype = NTFS
> set directory = No
> wide links = Yes
> follow symlinks = Yes
> dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
> magic script =
> magic output =
> delete readonly = No
> dos filemode = No
> dos filetimes = Yes
> dos filetime resolution = No
> fake directory create times = No
> vfs objects =
> msdfs root = No
> msdfs proxy =
>
> [netlogon]
> path = /var/lib/samba/netlogon/
> write list = "@Domain Admins"
> browseable = No
> csc policy = disable
>
> [printers]
> comment = Network Printers
> path = /home/spool/
> printer admin = "@Print Operators"
> guest ok = Yes
> printable = Yes
> print command = /usr/bin/lpr -P%p -r %s
> lpq command = /usr/bin/lpq -P%p
> lprm command = /usr/bin/lprm -P%p %j
> browseable = No
>
> [print$]
> path = /home/printers
> valid users = "@Print Operators"
> write list = "@Print Operators"
> create mask = 0664
> directory mask = 0775
>
>
> Stumped and frustrated.
--
John H Terpstra
Samba-Team Member
Phone: +1 (650) 580-8668
Author:
The Official Samba-3 HOWTO & Reference Guide, ISBN: 0131453556
Samba-3 by Example, ISBN: 0131472216
Hardening Linux, ISBN: 0072254971
Other books in production.
More information about the samba
mailing list