[Samba] Permission Denied

[Ole Traupe]

I see, thank you!


Am 08.12.2015 um 17:02 schrieb mathias dufresne:
> On any Linux system where you want to be able to use AD users as system
> users you need to configure PAM. This because it is PAM which discuss with
> the tool you have chosen to retrieve users information from AD and then
> build system users with these information.
>
> I think you also need to configure PAM for file servers connected to some
> domain (AD or NT4) for the underlaying system knows which user (system
> user, ie uid, gid, groups...) access to some shared file, to grant or
> refuse this access.
>
> The short way to put it would be: to configure your system configure PAM,
> without PAM configured only applications are configured: kinit could work,
> net command too, wbinfo also... but not getent and so all application
> relying to system side won't work (example from your first post: "id"
> command rely on getent/PAM/nss/don't ask precisely and so won't work)
>
> This can't be completely true as frontier between system and application is
> more than fine (PAM is an app after all and a system could do what you want
> it does without PAM configured -> a Samba DC without PAM configured can be
> fully managed, just ACLs would lack beauty I expect).
>
> 2015-12-08 16:20 GMT+01:00 Ole Traupe <ole.traupe at tu-berlin.de>:
>
>> You are right! I haven't configured PAM for winbind on the DCs, probably
>> because I don't need this.
>>
>> Any reasons why I should, if I manage my domain from Windows ADUC and
>> don't log-on to the DCs as Administrator locally?
>>
>> Ole
>>
>>
>>
>> Am 08.12.2015 um 14:39 schrieb mathias dufresne:
>>
>>> Ole,
>>>
>>> Did you configure PAM to use AD as a users source ? You need to have
>>> Winbind or SSSD or nslcd configured to access your AD + configure PAM +
>>> configure nsswitch.conf. Then you will system users from AD (ie "getent
>>> passwd my-ad-account" would work).
>>>
>>> Cheers,
>>>
>>> mathias
>>>
>>> 2015-12-07 20:54 GMT+01:00 Rowland penny <rpenny at samba.org>:
>>>
>>> On 07/12/15 19:42, Ole Traupe wrote:
>>>> If I do this (rely on the user map file containing "!root =
>>>>>> BPN\Administrator BPN\administrator"), should I expect "id
>>>>>>> Administrator"
>>>>>>> to give anything?
>>>>>>>
>>>>>>> Ole
>>>>>>>
>>>>>>>
>>>>>>> Only a Samba AD DC, you will not get anything from 'getent
>>>>>> Administrator' on a Unix domain member, but remember, with the user map
>>>>>> 'Administrator' becomes 'root' :-)
>>>>>>
>>>>>> Yes, and I can manage share permissions via ADUC due to the user
>>>>> mapping.
>>>>>
>>>>> But on the DCs I still get "No such user" (although I don't have any
>>>>> appearent problem).
>>>>>
>>>>> Ole
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> Have you changed anything on the DCs ? Are the winbind nss links in
>>>> place
>>>> ? (not sure if this makes any difference, but I always create them)
>>>>
>>>> if I run 'id Administrator', I get:
>>>>
>>>> uid=0(root) gid=100(users) groups=0(root),100(users),3000004(SAMdom\Group
>>>> Policy Creator Owners),3000006(SAMDOM\Enterprise
>>>> Admins),3000008(SAMDOM\Domain Admins),3000007(SAMDOM\Schema Admins)
>>>>
>>>> 'getent password Administrator' returns:
>>>>
>>>> SAMDOM\Administrator:*:0:100::/home/Administrator:/bin/bash
>>>>
>>>> Rowland
>>>>
>>>>
>>>>
>>>> --
>>>> To unsubscribe from this list go to the following URL and read the
>>>> instructions:  https://lists.samba.org/mailman/options/samba
>>>>
>>>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>>