[Samba] AD Groups Failing to Authorize in Valid Users (does not start with S-)
Wagner, Douglas
dwagner at rgare.com
Thu Aug 19 17:38:27 MDT 2010
For the last 3 weeks I've been working on getting RHEL4 (and 5, but
that's a different story) to play well with Active Directory, OpenLDAP,
Kerberos, PAM and NSS.
It's been a long struggle but I now have a process to authenticate and
authorize a RHEL4 client to a windows Active Directory server to that my
AD Users can log into my Linux boxes (assuming their group permissions
are set right).
Now it's time for Samba. After walking through the Samba by Example
with AD stuff and applying it to my information I've got Samba MOSTLY
working.
Adding an AD Domain User (in the form DOMAIN+user in the Valid Users
list) into a share causes the share to reject all but the list of users.
GREAT!
Unfortunately adding a Domain Group (in the form @DOMAIN+group) to the
valid users list does NOT proper authorize the user, even when he or she
belongs to the proper group.
[test02 at machine01 ~]$ smbclient //machine01/opt_share -k
WARNING: The "printer admin" option is deprecated
OS=[Unix] Server=[Samba 3.0.33-0.19.el4_8.1]
tree connect failed: NT_STATUS_ACCESS_DENIED
BTW both -U and -k work to authenticate a user, so Kerberos does in fact
work.
When I do this (on a debug 10) I get the following snippet:
[2010/08/19 18:07:31, 5] auth/auth_util.c:debug_nt_user_token(448)
NT user token: (NULL)
[2010/08/19 18:07:31, 5] auth/auth_util.c:debug_unix_user_token(474)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2010/08/19 18:07:31, 5] smbd/uid.c:change_to_root_user(288)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/08/19 18:07:31, 4] smbd/reply.c:reply_tcon_and_X(506)
Client requested device type [?????] for share [OPT_SHARE]
[2010/08/19 18:07:31, 5] smbd/service.c:make_connection(1214)
making a connection to 'normal' service opt_share
[2010/08/19 18:07:31, 3] lib/util_sid.c:string_to_sid(223)
string_to_sid: Sid @DOMAIN+tstgrp02 does not start with 'S-'.
[2010/08/19 18:07:31, 5] smbd/password.c:user_in_netgroup(470)
Unable to get default yp domain, let's try without specifying it
[2010/08/19 18:07:31, 5] smbd/password.c:user_in_netgroup(474)
looking for user DOMAIN+test02 of domain (ANY) in netgroup
DOMAIN+tstgrp02
[2010/08/19 18:07:31, 5] smbd/password.c:user_in_netgroup(490)
looking for user domain+test02 of domain (ANY) in netgroup
DOMAIN+tstgrp02
[2010/08/19 18:07:31, 10] passdb/lookup_sid.c:lookup_name(70)
lookup_name: DOMAIN\tstgrp02 => DOMAIN (domain), tstgrp02 (name)
[2010/08/19 18:07:31, 10] passdb/lookup_sid.c:lookup_name(71)
lookup_name: flags = 0x077
[2010/08/19 18:07:31, 10] smbd/share_access.c:user_ok_token(211)
User DOMAIN+test02 not in 'valid users'
[2010/08/19 18:07:31, 2] smbd/service.c:make_connection_snum(616)
user 'DOMAIN+test02' (from session setup) not permitted to access this
share (opt_share
)
[2010/08/19 18:07:31, 3] smbd/error.c:error_packet_set(106)
error packet at smbd/reply.c(514) cmd=117 (SMBtconX)
NT_STATUS_ACCESS_DENIED
However wbinfo will properly return a good SID for the group:
root at machine01 samba]# wbinfo -n DOMAIN+tstgrp02
S-1-5-21-2295727956-4092415901-3019033540-XXXX Domain Group (2)
[last 4 removed for security purposes]
To save the trouble of asking for it, I'll post up my SMB.CONF file
here:
# Samba config file created using SWAT
# Date: 2006/02/15 14:00:00
# Global parameters
[global]
workgroup = DOMAIN
realm = DOMAIN.NET
netbios name = machine01
server string = CIFS Server on machine01
security = ADS
#encrypt passwords = true
#password server = dc.domain.net
#map to guest = Bad Password
username map = /etc/samba/smbusers
#wins server = dc.domain.net
#Printing Options
printcap name = cups
printing = cups
load printers = Yes
cups options = raw
printer admin = @ntadmin, root, administrator
print command =
lpq command = %p
lprm command =
#Winbind Options
winbind separator = +
#LDAP Options
ldap ssl = no
idmap uid = 10000-20000
idmap gid = 10000-20000
#Debug Logging Information parameters
log level = 10
log file = /var/log/samba/%m.log
max log size = 0
[opt_share]
comment = Test Opt Share
path = /opt/share
valid users = @DOMAIN+tstgrp02
force user = test02
force group = tstgrp01
read only = no
browseable = yes
guest ok = no
printable = no
Note: if in the "valid users" list I put DOMAIN+test02 I still get the
issue with the group check, but I am authorized.
Last bit of information that I don't know whether it means anything or
not:
[root at machine01 samba]# wbinfo -g
<snip>
DOMAIN+tstgrp01
DOMAIN+tstgrp02
[root at stltrh4ldap01 samba]# getent group
root:x:0:root
<snip>
request 1 done
tstgrp01:*:10000:test04,test03,test02
tstgrp02:*:10001:test04,test03,test02
request 2 done
Getent is not applying the DOMAIN+ on the front of each group in the
password file. Not sure if it's supposed to or not. Note that
nsswitch.conf reads:
passwd: files ldap [TRYAGAIN=continue] winbind
shadow: files
group: files ldap [TRYAGAIN=continue] winbind
(I added winbind on the end hoping that that might help, obviously it
doesn't).
Architecturally, login to the box is done via Kerberos, pam_krb5, and
nss_ldap. OpenLDAP/nss_ldap is pulling group and user information out
of Active Directory (2003 with the Identity Management for Unix plugin
in place) but is NOT being used for authentication information. Winbind
is not used for anything but SAMBA in this case (and that's as I'd
prefer it).
HELP?!?!?!? This is LITERALLY the last piece of the puzzle (and one of
the most important to save our administrative costs).
I'm sure this is simple, I'm sure I'm doing something wrong. I'm also
fully willing to accept a workaround with mapping users and groups so
long as I do NOT have to manually modify an SMBUSERS file on the local
box. In other words, the smb.conf file and the smbusers file need to be
static regardless of how many users I add to the samba shares through
AD.
ANY help would be GREATLY appreciated.
--Doug
More information about the samba
mailing list