Samba4, symlink and Domain Admins

le dahut le.dahut at laposte.net
Thu Oct 1 07:05:34 UTC 2015



Le 29/09/2015 19:32, Scott Lovenberg a écrit :
> On Tue, Sep 29, 2015 at 10:15 AM, le dahut <le.dahut at laposte.net> wrote:
>> Hi.
>>
>> I've a strange behaviour on my samba4 PDC.
>>
>> With :
>>          unix extensions = no
>>          wide links = yes
>>          follow symlinks = yes
>>
>
> Hi,
>
> Can you show us the output of "testparm -v" so we can see the runtime
> values of your smb.conf?  Also, is your file system mounted with
> extended attributes and ACLs (mount options : user_xattr, acl)?


# mount | grep home
/dev/mapper/server--vg-home on /home type ext4 
(rw,acl,grpquota,user_xattr,usrquota)

# dpkg -l |grep samba
ii  libcrypt-smbhash-perl                0.12-4 
      all          generate LM/NT hash of a password for samba
ii  python-samba                         2:4.1.6+dfsg-1ubuntu2.14.04.9 
      amd64        Python bindings for Samba
ii  samba                                2:4.1.6+dfsg-1ubuntu2.14.04.9 
      amd64        SMB/CIFS file, print, and login server for Unix
ii  samba-common                         2:4.1.6+dfsg-1ubuntu2.14.04.9 
      all          common files used by both the Samba server and client
ii  samba-common-bin                     2:4.1.6+dfsg-1ubuntu2.14.04.9 
      amd64        Samba common files used by both the server and the client
ii  samba-dsdb-modules                   2:4.1.6+dfsg-1ubuntu2.14.04.9 
      amd64        Samba Directory Services Database
ii  samba-libs:amd64                     2:4.1.6+dfsg-1ubuntu2.14.04.9 
      amd64        Samba core libraries
ii  samba-vfs-modules                    2:4.1.6+dfsg-1ubuntu2.14.04.9 
      amd64        Samba Virtual FileSystem plugins

# testparm -v
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[printers]"
Processing section "[print$]"
Processing section "[homes]"
Processing section "[perso]"
Processing section "[netlogon]"
Loaded services file OK.
Server role: ROLE_DOMAIN_PDC
Press enter to see a dump of your service definitions
[global]
         dos charset = CP850
         unix charset = UTF-8
         workgroup = DOMSCRK25
         realm =
         netbios name = SCRIBEK25
         netbios aliases =
         netbios scope =
         server string = Etabk
         interfaces = eth0
         bind interfaces only = No
         server role = auto
         security = USER
         auth methods =
         encrypt passwords = Yes
         client schannel = Auto
         server schannel = Auto
         allow trusted domains = Yes
         map to guest = Bad User
         null passwords = No
         obey pam restrictions = No
         password server = *
         smb passwd file = /etc/samba/smbpasswd
         private dir = /var/lib/samba/private
         passdb backend = ldapsam:ldap://127.0.0.1:389
         algorithmic rid base = 1000
         root directory =
         guest account = nobody
         enable privileges = Yes
         pam password change = No
         passwd program =
         passwd chat = *new*password* %n\n *new*password* %n\n *changed*
         passwd chat debug = No
         passwd chat timeout = 2
         check password script = /usr/share/eole/fichier/checkpassword
         username map =
         username level = 0
         unix password sync = No
         restrict anonymous = 0
         lanman auth = Yes
         ntlm auth = Yes
         client NTLMv2 auth = Yes
         client lanman auth = No
         client plaintext auth = No
         client use spnego principal = No
         preload modules =
         dedicated keytab file =
         kerberos method = default
         map untrusted to domain = No
         log level = 2
         syslog = 0
         syslog only = Yes
         log file =
         max log size = 0
         debug timestamp = Yes
         debug prefix timestamp = No
         debug hires timestamp = Yes
         debug pid = No
         debug uid = No
         debug class = No
         enable core files = Yes
         smb ports = 445, 139
         large readwrite = Yes
         server max protocol = SMB3
         server min protocol = LANMAN1
         client max protocol = NT1
         client min protocol = CORE
         unicode = Yes
         min receivefile size = 0
         read raw = Yes
         write raw = Yes
         disable netbios = No
         reset on zero vc = No
         log writeable files on exit = No
         defer sharing violations = Yes
         nt pipe support = Yes
         nt status support = Yes
         max mux = 50
         max xmit = 16644
         name resolve order = wins, hosts, bcast, lmhosts
         max ttl = 259200
         max wins ttl = 518400
         min wins ttl = 21600
         time server = Yes
         unix extensions = No
         use spnego = Yes
         client signing = default
         server signing = default
         client use spnego = Yes
         client ldap sasl wrapping = plain
         enable asu support = No
         svcctl list =
         cldap port = 0
         dgram port = 0
         nbt port = 0
         krb5 port = 0
         kpasswd port = 0
         web port = 0
         rpc big endian = No
         deadtime = 15
         getwd cache = Yes
         keepalive = 300
         lpq cache time = 30
         max smbd processes = 0
         max disk size = 0
         max open files = 16384
         socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
         use mmap = Yes
         use ntdb = No
         hostname lookups = No
         name cache timeout = 660
         ctdbd socket =
         cluster addresses =
         clustering = No
         ctdb timeout = 0
         ctdb locktime warn threshold = 0
         smb2 max read = 1048576
         smb2 max write = 1048576
         smb2 max trans = 1048576
         smb2 max credits = 8192
         load printers = Yes
         printcap cache time = 750
         printcap name = cups
         cups server = /var/run/cups/cups.sock:631
         cups encrypt = No
         cups connection timeout = 30
         iprint server =
         disable spoolss = No
         addport command =
         enumports command =
         addprinter command =
         deleteprinter command =
         show add printer wizard = Yes
         os2 driver map =
         mangling method = hash2
         mangle prefix = 1
         max stat cache size = 256
         stat cache = Yes
         machine password timeout = 604800
         add user script = /usr/sbin/smbldap-useradd -a -m "%u"
         rename user script = /usr/sbin/smbldap-usermod -J -r "%unew" 
"%uold"
         delete user script =
         add group script = /usr/sbin/smbldap-groupadd -p -a -t 2 "%g"
         delete group script =
         add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
         delete user from group script = /usr/sbin/smbldap-groupmod -x 
"%u" "%g"
         set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
         add machine script = /usr/sbin/smbldap-useradd -w -a -d 
/dev/null -s /bin/false %u
         shutdown script =
         abort shutdown script =
         username map script =
         username map cache time = 0
         logon script = %U%a.bat
         logon path =
         logon drive =
         logon home = \\%N\%U
         domain logons = Yes
         init logon delayed hosts =
         init logon delay = 100
         os level = 99
         lm announce = Auto
         lm interval = 60
         preferred master = Yes
         local master = Yes
         domain master = Yes
         browse list = Yes
         enhanced browsing = Yes
         dns proxy = No
         wins proxy = No
         wins server =
         wins support = Yes
         wins hook =
         lock spin time = 200
         oplock break wait time = 0
         ldap admin dn = cn=admin,o=gouv,c=fr
         ldap delete dn = No
         ldap group suffix =
         ldap idmap suffix =
         ldap machine suffix =
         ldap passwd sync = yes
         ldap replication sleep = 1000
         ldap suffix = o=gouv,c=fr
         ldap ssl = no
         ldap ssl ads = No
         ldap deref = auto
         ldap follow referral = Auto
         ldap timeout = 15
         ldap connection timeout = 2
         ldap page size = 1024
         ldap user suffix =
         ldap debug level = 0
         ldap debug threshold = 10
         eventlog list =
         add share command =
         change share command =
         delete share command =
         preload =
         lock directory = /var/run/samba
         state directory = /var/lib/samba
         cache directory = /var/cache/samba
         pid directory = /var/run/samba
         ntp signd socket directory =
         utmp directory =
         wtmp directory =
         utmp = No
         default service =
         message command =
         get quota command =
         set quota command =
         remote announce =
         remote browse sync =
         nbt client socket address = 0.0.0.0
         nmbd bind explicit broadcast = Yes
         homedir map = auto.home
         afs username map =
         afs token lifetime = 604800
         log nt token command =
         NIS homedir = No
         registry shares = No
         usershare allow guests = No
         usershare max shares = 100
         usershare owner only = Yes
         usershare path = /var/lib/samba/usershares
         usershare prefix allow list =
         usershare prefix deny list =
         usershare template share =
         async smb echo handler = No
         panic action =
         perfcount module =
         host msdfs = Yes
         passdb expand explicit = No
         idmap backend = tdb
         idmap cache time = 604800
         idmap negative cache time = 120
         idmap uid =
         idmap gid =
         template homedir = /home/%D/%U
         template shell = /bin/false
         winbind separator = \
         winbind cache time = 300
         winbind reconnect delay = 30
         winbind max clients = 200
         winbind enum users = No
         winbind enum groups = No
         winbind use default domain = No
         winbind trusted domains only = No
         winbind nested groups = Yes
         winbind expand groups = 1
         winbind nss info = template
         winbind refresh tickets = No
         winbind offline logon = No
         winbind normalize names = No
         winbind rpc only = No
         create krb5 conf = Yes
         ncalrpc dir = /var/run/samba/ncalrpc
         winbind max domain connections = 1
         winbindd socket directory =
         winbindd privileged socket directory =
         winbind sealed pipes = No
         allow dns updates = disabled
         dns forwarder =
         dns update command =
         nsupdate command =
         rndc command =
         multicast dns register = Yes
         samba kcc command =
         server services =
         dcerpc endpoint servers =
         spn update command =
         share backend =
         tls enabled = No
         tls keyfile =
         tls certfile =
         tls cafile =
         tls crlfile =
         tls dh params file =
         scannedonly:allow_nonscanned_files = True
         full_audit:priority = NOTICE
         full_audit:failure = none
         full_audit:success = connect disconnect
         full_audit:prefix = %u|%I|%m|%S
         idmap config * : backend = tdb
         comment =
         path =
         username =
         invalid users =
         valid users =
         admin users = @DomainAdmins
         read list =
         write list =
         force user =
         force group =
         read only = Yes
         acl check permissions = Yes
         acl group control = No
         acl map full control = Yes
         acl allow execute always = No
         create mask = 0744
         force create mode = 00
         directory mask = 0755
         force directory mode = 00
         force unknown acl user = No
         inherit permissions = No
         inherit acls = No
         inherit owner = No
         guest only = No
         administrative share = No
         guest ok = Yes
         only user = No
         hosts allow =
         hosts deny =
         allocation roundup size = 1048576
         aio read size = 0
         aio write size = 0
         aio write behind =
         ea support = No
         nt acl support = Yes
         profile acls = No
         map acl inherit = No
         afs share = No
         smb encrypt = default
         durable handles = Yes
         block size = 1024
         change notify = Yes
         directory name cache size = 100
         kernel change notify = Yes
         max connections = 0
         min print space = 0
         strict allocate = No
         strict sync = No
         sync always = No
         use sendfile = No
         write cache size = 0
         max reported print jobs = 0
         max print jobs = 1000
         printable = No
         print notify backchannel = Yes
         print ok = No
         printing = cups
         cups options =
         print command =
         lpq command = %p
         lprm command =
         lppause command =
         lpresume command =
         queuepause command =
         queueresume command =
         printer name =
         use client driver = No
         default devmode = Yes
         force printername = No
         printjob username = %U
         default case = lower
         case sensitive = Auto
         preserve case = Yes
         short preserve case = Yes
         mangling char = ~
         hide dot files = Yes
         hide special files = No
         hide unreadable = No
         hide unwriteable files = No
         delete veto files = No
         veto files =
         hide files = /desktop.ini/
         veto oplock files =
         map archive = Yes
         map hidden = No
         map system = No
         map readonly = yes
         mangled names = Yes
         store dos attributes = No
         dmapi support = No
         browseable = Yes
         access based share enum = No
         blocking locks = Yes
         csc policy = manual
         fake oplocks = No
         kernel oplocks = No
         kernel share modes = Yes
         locking = Yes
         oplocks = No
         level2 oplocks = No
         oplock contention limit = 2
         posix locking = Yes
         strict locking = Auto
         dfree cache time = 0
         dfree command =
         copy =
         preexec =
         preexec close = No
         postexec =
         root preexec =
         root preexec close = No
         root postexec =
         available = Yes
         volume =
         fstype = NTFS
         wide links = Yes
         follow symlinks = Yes
         dont descend =
         magic script =
         magic output =
         delete readonly = No
         dos filemode = No
         dos filetimes = Yes
         dos filetime resolution = No
         fake directory create times = No
         vfs objects = scannedonly
         msdfs root = No
         msdfs proxy =
         ntvfs handler =

[printers]
         comment = All Printers
         path = /var/spool/samba
         guest ok = No
         printable = Yes
         print ok = Yes
         browseable = No

[print$]
         path = /var/lib/samba/printers
         valid users = @PrintOperators, @DomainUsers
         write list = @PrintOperators
         force group = PrintOperators
         create mask = 0664
         directory mask = 0775
         guest ok = No
         vfs objects =

[homes]
         comment = Home Directories
         invalid users = nobody, guest
         valid users = %U
         write list = %U
         read only = No
         create mask = 0664
         directory mask = 0775
         inherit permissions = Yes
         inherit acls = Yes
         guest ok = No
         profile acls = Yes
         hide files = /desktop.ini/config_eole/
         browseable = No
         csc policy = disable

[perso]
         comment = disque personnel pour 98 et 95
         path = %H/perso
         invalid users = nobody, guest
         valid users = %U
         write list = %U
         read only = No
         create mask = 0664
         directory mask = 0775
         inherit permissions = Yes
         inherit acls = Yes
         guest ok = No
         hide files = /desktop.ini/config_eole/
         browseable = No

[netlogon]
         comment = Network Logon Service
         path = /home/netlogon
         valid users = %U
         write list = %U
         create mask = 0644
         profile acls = Yes
         browseable = No
         root preexec = python /usr/share/eole/fichier/dyn-logon.py 
--user="%U" --os="%a" --machine="%m" --ip="%I" --pid="%d"





More information about the samba-technical mailing list