[Samba] Problems with administrator account

[Aurélien Blachet]

Oh thank you

Just to be sure to understand :
-getent passwd | grep administrator and id administrator didn't work on Fileserver because administrator account didn't have uidNumber

-it also why administrator account can't manage filserver with windows permissions

Just one more thing please :

Why my administrators group is mapped on unix users ?  
[root#fileserver ~]#  net groupmap list
Administrators (S-1-5-32-544) -> users
Users (S-1-5-32-545) -> BUILTIN\users

[root at massy01 ~]#  net groupmap list verbose
Administrators
        SID       : S-1-5-32-544
        Unix gid  : 100
        Unix group: users
        Group type: Local Group
        Comment   :
Users
        SID       : S-1-5-32-545
        Unix gid  : 101
        Unix group: BUILTIN\users
        Group type: Local Group
        Comment   :


________________________________________
De : samba <samba-bounces at lists.samba.org> de la part de Rowland Penny <rowlandpenny241155 at gmail.com>
Envoyé : jeudi 6 août 2015 17:51
À : samba at lists.samba.org
Objet : Re: [Samba] Problems with administrator account

On 06/08/15 15:32, Aurélien Blachet wrote:
> I still have the same problem with :
> [root at fileserver ~]# more /usr/local/samba/etc/samba_usermapping
> !root = DOMAIN\Administrator DOMAIN\\Administrator DOMAIN\administrator Administrator adm
> inistrator
>
> ________________________________________
> De : samba <samba-bounces at lists.samba.org> de la part de Rowland Penny <rowlandpenny241155 at gmail.com>
> Envoyé : jeudi 6 août 2015 16:06
> À : samba at lists.samba.org
> Objet : Re: [Samba] Problems with administrator account
>
> On 06/08/15 12:57, Aurélien Blachet wrote:
>> Hello,
>>
>>
>>
>> I just went to migrate my fileserver from samba3 to samba4 but i have problem with the administrator account.
>>
>>
>>
>> The group "domain admins" have the permission to manage all my shares
>>
>>
>>
>> Administrator is member of the group "domain admins" but he can't manage the security tab of all my shares when i remove "full control" to share permissions tab.
>>
>>
>>
>> While all the member of "Domain admins",except administrator, didn't have this problem.
>>
>>
>>
>> I think the problem appear when we map "administrator" to "root" in the smb.conf.
>>
>>
>>
>> Moreover the "administrator" account didn't appear with a getent passwd
>>
>>
>>
>> [root at fileserver ~]# getent passwd |grep dministrator
>>
>>
>>
>> [root at fileserver ~]# wbinfo -u |grep dministrator
>> administrator
>>
>>
>> my smb.conf :
>> [global]
>>
>>     netbios name = XXX
>>     workgroup = XXX
>>     security = ADS
>>     realm = XXX.XXX
>>     dedicated keytab file = /etc/krb5.keytab
>>     kerberos method = secrets and keytab
>>     username map = /usr/local/samba/etc/samba_usermapping
>>
>>     idmap config *:backend = tdb
>>     idmap config *:range = 300000-400000
>>     idmap config XXX:backend = ad
>>     idmap config XXX:schema_mode = rfc2307
>>     idmap config XXX:range = 500-200000
>>
>>     winbind nss info = rfc2307
>>     winbind trusted domains only = no
>>     winbind use default domain = yes
>>     winbind enum users  = yes
>>     winbind enum groups = yes
>>     winbind refresh tickets = Yes
>>     vfs objects = acl_xattr
>>     map acl inherit = Yes
>>     store dos attributes = Yes
>>     template homedir = /home/%U
>> ...
>>
>> [shareA]
>>       path =/xxx/shareA
>>       comment =
>>       hosts allow = X.X.X.
>>       writable = Yes
>>       read only = No
>>
>> Local permissions
>> [root at fileserver]# getfacl /xxx/shareA
>> # file: alp-exp
>> # owner: root
>> # group: root
>> user::rwx
>> user:root:rwx
>> group::rwx
>> group:root:rwx
>> group:domain\040admins:rwx
>> group:domain\040users:rwx
>> mask::rwx
>> other::rwx
>> default:user::rwx
>> default:user:root:rwx
>> default:group::r-x
>> default:group:root:r-x
>> default:group:domain\040users:rwx
>> default:mask::rwx
>> default:other::r-x
>> And the mapping between root and administrator
>> [root@=fileserver ~]# more /usr/local/samba/etc/samba_usermapping
>> !root = LAN\Administrator LAN\\Administrator LAN\administrator
> Try adding 'Administrator administrator'  to the line in 'samba_usermapping'
>
> Rowland
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

Ah, I think you are mixing up Unix permissions and windows permissions.
You will only get 'Administrator' to show up with getent if you give the
Administrator user a uidNumber and use the 'ad' backend. As you are
mapping 'Administrator' to root it will get the UID of '0' which is also
the UID of 'root'. From windows you will set the permissions of
'Administrator' , but on the unix side using getfacl it will show as 'root'

Rowland

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba