Samba4 Linux user has two uid's [SOLVED}
Rowland Penny
repenny at f2s.com
Tue Apr 2 12:11:55 MDT 2013
On 27/03/13 13:52, Rowland Penny wrote:
> On 26/03/13 17:29, Thomas Simmons wrote:
>> I'm sorry, the smb.conf I provided is missing this:
>>
>> idmap config * : backend = tdb
>> idmap config * : range = 900000-910000
>>
>> Kill your winbindd process, add that to smb.conf and run 'net cache
>> flush'. Start winbindd back up and you should be good to go.
>
> Hi Thomas, I did have something very similar to the above in my
> smb.conf and after doing all I can think of, I am still getting the
> same problem, with the line: 'idmap config EXAMPLE:backend = ad' in my
> smb.conf, I get no domain users. If I swap 'ad' for 'rid', I do get
> domain users.
>
> This is the smb.conf I have been using:
>
> [global]
> workgroup = EXAMPLE
> realm = example.com
> preferred master = no
> server string = ubuntu client
> security = ads
> encrypt passwords = yes
> log level = 3
>
> dedicated keytab file = /etc/krb5.keytab
> kerberos method = secrets and keytab
>
> idmap config *:backend = tdb
> idmap config *:range = 10000-20000
>
> idmap config EXAMPLE:default = yes
> idmap config EXAMPLE:backend = ad
> idmap config EXAMPLE:schema mode = rfc2307
> idmap config EXAMPLE:range = 3000000-31000000
>
> winbind enum users = yes
> winbind enum groups = yes
> winbind nested groups = yes
> winbind use default domain = yes
> winbind nss info = rfc2307
> winbind refresh tickets = Yes
>
> template homedir = /home/%D/%U
> template shell = /bin/bash
>
> This is an ldif file of a user on the Samba4 AD server
>
> dn: CN=testuser,CN=Users,DC=example,DC=com
> cn: testuser
> instanceType: 4
> whenCreated: 20130320122306.0Z
> uSNCreated: 3778
> name: testuser
> objectGUID:: siE+gJgV2kKaQO0qslOkVg==
> badPwdCount: 0
> codePage: 0
> countryCode: 0
> badPasswordTime: 0
> lastLogoff: 0
> lastLogon: 0
> primaryGroupID: 513
> objectSid:: AQUAAAAAAAUVAAAAtvprU8QVtn/NH/GlUQQAAA==
> accountExpires: 9223372036854775807
> logonCount: 0
> sAMAccountName: testuser
> sAMAccountType: 805306368
> userPrincipalName: testuser at example.com
> objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=example,DC=com
> pwdLastSet: 130082557870000000
> userAccountControl: 512
> uidNumber: 3000016
> gidNumber: 100
> unixHomeDirectory: /example/EXAMPLE/testuser
> loginShell: /bin/bash
> profilePath: \\adserver\profiles\testuser
> exampleDrive: Z:
> exampleDirectory: \\adserver\home\testuser
> objectClass: top
> objectClass: posixAccount
> objectClass: person
> objectClass: organizationalPerson
> objectClass: user
> whenChanged: 20130326132819.0Z
> uSNChanged: 3855
> distinguishedName: CN=testuser,CN=Users,DC=example,DC=com
>
> And this is what I find in '/var/log/samba/log.winbindd-idmap' after I
> run 'getent passwd'
>
> [2013/03/27 13:22:08.697614, 0]
> winbindd/idmap_tdb.c:149(idmap_tdb_upgrade)
> Upgrading winbindd_idmap.tdb from an old version
> [2013/03/27 13:22:08.747114, 3] winbindd/idmap.c:230(idmap_init_domain)
> idmap backend ad not found
> [2013/03/27 13:22:08.748825, 2] lib/module.c:64(do_smb_load_module)
> Module '/usr/lib/samba/idmap/ad.so' loaded
> [2013/03/27 13:22:08.749165, 3] libsmb/namequery.c:2533(get_dc_list)
> get_dc_list: preferred server list: "adserver.example.com, *"
> [2013/03/27 13:22:08.762494, 3] libads/ldap.c:640(ads_connect)
> Successfully contacted LDAP server 192.168.0.10
> [2013/03/27 13:22:08.762828, 3] libsmb/namequery.c:2533(get_dc_list)
> get_dc_list: preferred server list: "adserver.example.com, *"
> [2013/03/27 13:22:08.763190, 3] libsmb/namequery.c:2533(get_dc_list)
> get_dc_list: preferred server list: "adserver.example.com, *"
> [2013/03/27 13:22:08.777696, 3] libads/ldap.c:640(ads_connect)
> Successfully contacted LDAP server 192.168.0.10
> [2013/03/27 13:22:08.780683, 3] libads/ldap.c:694(ads_connect)
> Connected to LDAP server adserver.example.com
> [2013/03/27 13:22:08.807827, 3] libads/sasl.c:869(ads_sasl_spnego_bind)
> ads_sasl_spnego_bind: got OID=1.2.840.48018.1.2.2
> [2013/03/27 13:22:08.808305, 3] libads/sasl.c:869(ads_sasl_spnego_bind)
> ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2
> [2013/03/27 13:22:08.808456, 3] libads/sasl.c:869(ads_sasl_spnego_bind)
> ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.10
> [2013/03/27 13:22:08.808604, 3] libads/sasl.c:878(ads_sasl_spnego_bind)
> ads_sasl_spnego_bind: got server principal name =
> not_defined_in_RFC4178 at please_ignore
> [2013/03/27 13:22:08.809768, 3] libsmb/clikrb5.c:787(ads_krb5_mk_req)
> ads_krb5_mk_req: krb5_cc_get_principal failed (No credentials cache
> found)
> [2013/03/27 13:22:08.966573, 3]
> libsmb/clikrb5.c:632(ads_cleanup_expired_creds)
> ads_cleanup_expired_creds: Ticket in ccache[MEMORY:winbind_ccache]
> expiration Wed, 27 Mar 2013 23:22:08 GMT
> [2013/03/27 13:22:08.966866, 3] libsmb/clikrb5.c:840(ads_krb5_mk_req)
> ads_krb5_mk_req: server marked as OK to delegate to, building
> forwardable TGT
> [2013/03/27 13:22:09.543036, 1]
> winbindd/idmap_ad.c:657(idmap_ad_sids_to_unixids)
> Could not get unix ID
> [2013/03/27 13:22:09.549311, 1]
> winbindd/idmap_ad.c:657(idmap_ad_sids_to_unixids)
> Could not get unix ID
> [2013/03/27 13:22:09.554357, 1]
> winbindd/idmap_ad.c:657(idmap_ad_sids_to_unixids)
> Could not get unix ID
> [2013/03/27 13:22:09.614386, 1]
> winbindd/idmap_ad.c:657(idmap_ad_sids_to_unixids)
> Could not get unix ID
> [2013/03/27 13:22:09.625233, 1]
> winbindd/idmap_ad.c:657(idmap_ad_sids_to_unixids)
> Could not get unix ID
> [2013/03/27 13:22:09.630888, 1]
> winbindd/idmap_ad.c:657(idmap_ad_sids_to_unixids)
> Could not get unix ID
>
> Does anybody have any suggestions how I can get this to work, I am
> being driven to distraction by this and it is probably something I am
> doing or not doing.
>
> Rowland
>
>
OK, I can now get the same uid & gid numbers on the server and clients,
to do this was in fact very easy, DON'T USE WINBIND, use sssd instead.
Example:
On the Samba4 server:
getent passwd rowland
rowland:*:1201401105:1201400513:rowland:/home/DOMAIN/rowland:/bin/bash
On the client:
getent passwd rowland
rowland:*:1201401105:1201400513:rowland:/home/DOMAIN/rowland:/bin/bash
Rowland
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
More information about the samba-technical
mailing list