[Samba] rid mapping works on member server but not DC

Sun Apr 12 06:50:10 MDT 2015

Thank you Rowland, that clearly explains why it isn't working for me.
Appreciated.

I was trying to achieve my goal of having two domain controllers for
redundancy, without having additional physical machines - it looks
like I'm now in the same boat as the other current thread ("Domain
controller in a chroot"), which is unfortunate! :(

My scenario is that I have one ESXi physical host, running a VM with
one DC in it, and one CentOS 6 physical machine, running the other DC
but also acting as a file server (and with inconsistent UIDs).

In order to get this CentOS 6 host running as both a DC and file
server, with consistent UIDs, it looks like I will need to either
- use the 'ad' backend
- somehow run samba locally as a member server, and for redundancy
also run samba as a DC via something like Docker (which I don't think
will work due to the need to expose the DC ports, IP etc. to the rest
of the domain), or
- perhaps use sssd? (which I haven't yet investigated, to be honest)

I was reluctant to go down the 'ad' backend route simply because from
what I can see, there is then the risk of a Windows admin for any part
of the AD tree being able to 'impersonate' any UNIX user by simply
changing the uidNumber of a user in that part of the tree, isn't
there? (within range limits). Whereas with RID mapping the UID is
algorithmically determined and would need co-operation from the UNIX
host's admin, instead.

Or am I over-thinking this? I understand that with 'ad' mapping, at
least the current max UID is stored somewhere in LDAP and
automatically applied to new users, so the administrative burden for
adding new users is reduced, once each existing user has a
uidNumber/gidNumber allocated.

Thanks!

Jonathan

On 12 April 2015 at 13:09, Rowland Penny <rowlandpenny at googlemail.com> wrote:
> On 12/04/15 11:55, Jonathan Hunter wrote:
>>
>> Hi,
>>
>> I have been struggling with this for a few days and think that now's
>> the time I can ask for help :) It's not an area I have delved into
>> before, so I have been trying to follow the documentation, do my own
>> research, and do as much configuration/testing as I can myself; but I
>> am now confused. (I am running 4.2.0 throughout).
>>
>> I have successfully set up and configured a member server with the
>> following smb.conf (sanitised for the list):
>>
>> [global]
>>          workgroup = MY-DOMAIN
>>          security = ADS
>>          realm = MY-DOMAIN.MYORG.CO.UK
>>          dedicated keytab file = /etc/krb5.keytab
>>          kerberos method = secrets and keytab
>>          idmap config *:backend = tdb
>>          idmap config *:range = 900000-999999
>>          idmap config MY-DOMAIN:backend = rid
>>          idmap config MY-DOMAIN:range = 4000000-4999999
>>          winbind use default domain = yes
>>          winbind enum users = yes
>>          winbind enum groups = yes
>>          winbind refresh tickets = yes
>>          winbind expand groups = 8
>>
>> I can successfully update the RID range to e.g. 2000000-2999999 in
>> smb.conf, and using the following commands this does take effect:
>>
>> # killall winbindd
>> # /usr/local/samba/sbin/winbindd
>> # net cache flush
>>
>> When I run "wbinfo -i username", I can see the updated RID mappings,
>> as shown here:
>>
>> [... edit smb.conf from 2000000 to 4000000... ]
>> # killall winbindd
>> # /usr/local/samba/sbin/winbindd
>> # wbinfo -i user1
>> user1:*:201105:200513:User 1:/home/MY-DOMAIN/user1:/bin/false
>> # net cache flush
>> # wbinfo -i user1
>> user1:*:4001105:4000513:User 1:/home/MY-DOMAIN/user1:/bin/false
>>
>> This all works perfectly, and is exactly what I want to achieve, as my
>> UID mappings are currently inconsistent across various machines.
>>
>> However, I have a second server (which is a domain controller, not a
>> domain member) and the same configuration does not work here - this is
>> where I am now confused.
>>
>> What am I missing? Whatever I do, it does not seem to pay attention to
>> the RID mapping settings (which I have copied over from the working
>> member server I just set up to test, above):
>>
>> [... edit smb.conf to add the RID mapping section, using any numbers I
>> like e.g. 2000000 ... ]
>> # service samba4 restart     <-- essentially, just kills and then
>> restarts the /usr/local/samba/sbin/samba binary
>> # wbinfo -i user2
>> user2:*:3000015:100:User 2:/home/MY-DOMAIN/user2:/bin/false
>> # net cache flush
>> # wbinfo -i user2
>> user2:*:3000015:100:User 2:/home/MY-DOMAIN/user2:/bin/false
>>
>> The 3000015 and 100 UID/GIDs seem to be the default mapping - these do
>> not match the RID range I am trying to configure.
>>
>> Top section of smb.conf from the domain controller; all the idmap and
>> winbind lines were copied directly from the working member server:
>>
>> [global]
>>          workgroup = MY-DOMAIN
>>          realm = MY-DOMAIN.MYORG.CO.UK
>>          netbios name = MY-DC1
>>          server role = active directory domain controller
>>          dns forwarder = 192.168.1.2
>>          idmap config *:backend = tdb
>>          idmap config *:range = 900000-999999
>>          idmap config MY-DOMAIN:backend = rid
>>          idmap config MY-DOMAIN:range = 4000000-4999999
>>          winbind use default domain = yes
>>          winbind enum users = yes
>>          winbind enum groups = yes
>>          winbind refresh tickets = yes
>>          winbind expand groups = 8
>>
>> The only difference I can see is that the member server has the
>> 'security = ads' line and the DC doesn't; however if I add that to the
>> DC config, Samba won't start up, so I don't think that's it:
>>
>> [2015/04/12 11:40:56.019515,  0]
>> ../source4/smbd/server.c:475(binary_smbd_main)
>>    At this time the 'samba' binary should only be used for either:
>>    'server role = active directory domain controller' or to access the
>> ntvfs file server with 'server services = +smb' or the rpc proxy with
>> 'dcerpc endpoint servers = remote'
>>    You should start smbd/nmbd/winbindd instead for domain member and
>> standalone file server tasks
>> [2015/04/12 11:40:56.019982,  0]
>> ../lib/util/become_daemon.c:111(exit_daemon)
>>    STATUS=daemon failed to start: Samba detected misconfigured 'server
>> role' and exited. Check logs for details, error code 22
>>
>> There are some Kerberos lines also present on the member server but
>> these aren't on the DC; are these critical for idmap activity??
>>
>> Is there some other ldb/tdb cache file I need to clear out, perhaps?
>> (I don't want to simply rm /usr/local/samba/private/* as I was doing
>> on the test member server - this is a DC!) Or have I missed something
>> basic, in which case sorry (and I will try to update the wiki to make
>> it clearer in case others miss it, too..! :) )
>>
>> Thanks,
>>
>> Jonathan
>>
>
> OK ,you are trying to get the user & groups ID numbers to match on the DC
> and a member server by using the 'rid' backend. I am sorry to tell you that
> you cannot do this, this is because the way that winbind works is different
> between the two machines. On the DC 'idmap.ldb' is used and the RIDs are
> used to create 'xidNumbers' starting from 3000000, whereas on the member
> server, the 'rid' backend calculates the ID number by 'ID = RID - BASE_RID +
> LOW_RANGE_ID'.
> So, if the users RID is '1105' and the base rid isn't set in smb.conf, this
> will become 'ID= 1105 - 0 + LOW_RANGE_ID'
>
> Or from your smb.conf 'ID= 1105 - 0 + 4000000'
>
> which becomes 'ID = 4001105'
>
> If you must have the same ID number on both the DC and the member server,
> you will have to use the 'ad' backend and add uidNumber & gidNumber
> attributes to your users and groups.
>
> Rowland
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

-- 
"If we knew what it was we were doing, it would not be called
research, would it?"
      - Albert Einstein