[Samba] Strange GPO rights samba 4.2.1
L.P.H. van Belle
belle at bazuin.nl
Fri Apr 24 04:41:51 MDT 2015
>-----Oorspronkelijk bericht-----
>Van: rowlandpenny at googlemail.com
>[mailto:samba-bounces at lists.samba.org] Namens Rowland Penny
>Verzonden: vrijdag 24 april 2015 12:30
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] Strange GPO rights samba 4.2.1
>
>On 24/04/15 10:22, L.P.H. van Belle wrote:
>>> -----Oorspronkelijk bericht-----
>>> Van: rowlandpenny at googlemail.com
>>> [mailto:samba-bounces at lists.samba.org] Namens Rowland Penny
>>> Verzonden: vrijdag 24 april 2015 11:06
>>> Aan: samba at lists.samba.org
>>> Onderwerp: Re: [Samba] Strange GPO rights samba 4.2.1
>>>
>>> On 24/04/15 09:52, L.P.H. van Belle wrote:
>>>> Hai,
>>>>
>>>> Im having a strange thing with sernet samba 4.2.1 on debian wheezy.
>>>>
>>>> I installed 2 dc.s with my scripts.
>>>>
>>>> i did setup the sysvol replication and now im seeing the
>>> following when i create new policies.
>>>>
>>>> The default GPO's
>>>> drwxrwx---+ 4 root BUILTIN\administrators 4096 Apr
>>> 24 10:17 {31B2F340-016D-11D2-945F-00C04FB984F9}
>>>> drwxrwx---+ 4 root BUILTIN\administrators 4096 Apr
>>> 24 10:17 {6AC1786C-016F-11D2-945F-00C04FB984F9}
>>>>
>>>> The new policy i created.
>>>> drwxrwx---+ 4 domain admins domain admins 4096 Apr
>>> 24 10:17 {B9C07E8F-54C3-4FA0-8C39-E357E068D393}
>>>> check these strange rights..
>>>> Because of the " domain admins domain admins " rights, and
>>> why is user root here created as "domain admins"
>>>>
>>>> when i now run :
>>>> /usr/bin/rsync -XAavz --log-file /var/log/sysvol-sync.log
>>> --delete-after -f"+ */" -f"- *" /home/samba/sysvol
>>> root at dc2:/home/samba && /usr/bin/unison
>>>>
>>>> im getting these errors:
>>>>
>>>> rsync: set_acl:
>>> sys_acl_set_file(sysvol/internal.domain.tld/Policies/{B9C07E8F-
>>> 54C3-4FA0-8C39-E357E068D393}, ACL_TYPE_ACCESS): Invalid
>argument (22)
>>> sysvol/internal.domain.tld/Policies/{B9C07E8F-54C3-4FA0-8C39-E3
>>> 57E068D393}/Machine/
>>>> rsync: set_acl:
>>> sys_acl_set_file(sysvol/internal.domain.tld/Policies/{B9C07E8F-
>>> 54C3-4FA0-8C39-E357E068D393}/Machine, ACL_TYPE_ACCESS):
>>> Invalid argument (22)
>>> sysvol/internal.domain.tld/Policies/{B9C07E8F-54C3-4FA0-8C39-E3
>>> 57E068D393}/User/
>>>> rsync: set_acl:
>>> sys_acl_set_file(sysvol/internal.domain.tld/Policies/{B9C07E8F-
>>> 54C3-4FA0-8C39-E357E068D393}/User, ACL_TYPE_ACCESS): Invalid
>>> argument (22)
>>>> sysvol/internal.domain.tld/scripts/
>>>>
>>>>
>>>> I created the new policy with the user
>>> "Domain\Administrator" from within the windows tools from a
>>> windows 7 pc as normal..
>>>>
>>>> Anyone else seen this behaivor?
>>>>
>>>> this is the conf im using atm.:
>>>>
>>>> [global]
>>>> workgroup = INTERNAL
>>>> realm = INTERNAL.DOMAIN.TLD
>>>> netbios name = DC1
>>>> server role = active directory domain controller
>>>> server services = s3fs, rpc, nbt, wrepl, ldap,
>>> cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
>>>> dcerpc endpoint servers = epmapper, wkssvc,
>>> rpcecho, samr, netlogon, lsarpc, spoolss, drsuapi, dssetup,
>>> unixinfo, browser, eventlog6, backupkey, dnsserver, remote,
>>> winreg, srvsvc
>>>> auth methods = sam, winbind, ntdomain, ntdomain:winbind
>>>>
>>>> ## KEEP THIS OFF !! Only used for modify-ing the
>AD Schema
>>>> ## ONLY DONE ONES ON THE DC WITH THE FSMO Roles
>>>> sdb:schema update allowed = no
>>>>
>>>> ## Dont forget to set the idmap_ldb on ALL DC's if
>>> you use it
>>>> idmap_ldb:use rfc2307 = yes
>>>>
>>>> ## map id's outside to domain to tdb files.
>>>> idmap config * : backend = tdb
>>>> idmap config * : range = 2000-9999
>>>>
>>>> ## map ids from the domain and (*) the range may
>>> not overlap !
>>>> idmap config BAZRTD : backend = ad
>>>> idmap config BAZRTD : schema_mode = rfc2307
>>>> idmap config BAZRTD : range = 10000-3999999
>>>>
>>>> winbind nss info = rfc2307
>>>> winbind trusted domains only = no
>>>> winbind use default domain = yes
>>>> winbind expand groups = 3
>>>>
>>>> ## When using idmap backend RID enable these
>>>> ## ( or for users without UID/GID for example
>>> adminsitrator )
>>>> #template shell = /bin/bash
>>>> #template homedir = /home/users/%ACCOUNTNAME%
>>>>
>>>> interfaces = 127.0.0.1 192.168.249.211
>>>> bind interfaces only = yes
>>>> time server = yes
>>>> wins support = yes
>>>>
>>>> ## Disable printing completely
>>>> load printers = no
>>>> printing = bsd
>>>> printcap name = /dev/null
>>>> disable spoolss = yes
>>>>
>>>> [netlogon]
>>>> path = /home/samba/sysvol/rotterdam.bazuin.nl/scripts
>>>> read only = No
>>>>
>>>> [sysvol]
>>>> path = /home/samba/sysvol
>>>> read only = No
>>>>
>>>> [backups]
>>>> path = /home/samba/backups
>>>> Browsable = No
>>>> read only = No
>>>> acl_xattr:ignore system acl = yes
>>>>
>>>>
>>>>
>>>> Greetz,
>>>>
>>>> Louis
>>>>
>>> Hi Louis, I wonder if this is down to the use of 'winbindd' ,
>>> there have
>>> been a couple of problems reported that seem to be caused by
>>> the use of
>>> it. Do you want to try using the old 'winbind' instead and
>see if this
>>> cures the problem ?
>>>
>>> Rowland
>>>
>>> --
>>> To unsubscribe from this list go to the following URL and read the
>>> instructions: https://lists.samba.org/mailman/options/samba
>>>
>>>
>> ok the following in seen.
>> only changed winbindd to winbind in the smb.conf
>>
>>
>> ## samba 4.2.1 : winbindd
>> id administrator
>> uid=0(root) gid=100(users)
>groups=0(root),100(users),3000004(group policy creator
>owners),3000006(enterprise admins),3000008(domain
>admins),3000007(schema admins),3000005(denied rodc password
>replication
>group),3000009(BUILTIN\users),3000000(BUILTIN\administrators)
>>
>>
>> ## samba 4.2.1 : winbind
>> id administrator
>> uid=0(root) gid=100(users)
>groups=0(root),100(users),3000004(INTERNAL\Group Policy
>Creator Owners),3000006(INTERNAL\Enterprise
>Admins),3000008(INTERNAL\Domain Admins),3000007(INTERNAL\Schema Admins)
>>
>>
>> ls -al in the policies folder now gives.. (## samba 4.2.1
>: winbind)
>>
>> drwxrwx---+ 4 3000008 BAZRTD\Domain Admins 4096 Apr 24 11:18
>{1AA13E10-F89C-44FA-82B1-8FBCF5E4099C}
>> drwxrwx---+ 4 root 3000000 4096 Apr 24 10:17
>{31B2F340-016D-11D2-945F-00C04FB984F9}
>> drwxrwx---+ 4 root 3000000 4096 Apr 24 10:17
>{6AC1786C-016F-11D2-945F-00C04FB984F9}
>> drwxrwx---+ 4 3000008 BAZRTD\Domain Admins 4096 Apr 24 10:17
>{B9C07E8F-54C3-4FA0-8C39-E357E068D393}
>>
>>
>> This does not look right to me.. :-/
>>
>>
>>
>>
>
>Strange, do want to try creating another GPO whilst still
>using 'winbind' ?
>
>Rowland
>--
>To unsubscribe from this list go to the following URL and read the
>instructions: https://lists.samba.org/mailman/options/samba
>
>
this one was created with winbind
drwxrwx---+ 4 3000008 BAZRTD\Domain Admins 4096 Apr 24 10:17 {B9C07E8F-54C3-4FA0-8C39-E357E068D393}
More information about the samba
mailing list