[Samba] Winbindd Strangeness

[Rowland Penny]

On 23/06/15 13:32, David Minard wrote:
> I've Set up a DC and a Member Server for a file server.  Both are running on Centos7 and samba version 4.2.2.  The Member Server is running smbd and winbindd.
>
> I've followed the wiki and for the most part it's working.  However, after stuffing up the ranges, then fixing them up, when I create new accounts, adding all the Unix attributes, the UID_Number is not showing the correct value for new accounts.  Existing ones are okay.
>
> Member_Server Config:
>
> [global]
>
>    netbios name = MS1
>    workgroup = AD
>    security = ADS
>    realm = SAMBADOM
>    dedicated keytab file = /etc/krb5.keytab
>    kerberos method = secrets and keytab
>
>    idmap config *:backend = tdb
>    idmap config *:range = 30000000-40000000
>    idmap config SAMBADOM:backend = ad
>    idmap config SAMBADOM:schema_mode = rfc2307
>    idmap config SAMBADOM:range = 600-29999999
>
>    winbind nss info = rfc2307
>    winbind trusted domains only = no
>    winbind use default domain = yes
>    winbind enum users  = yes
>    winbind enum groups = yes
>    winbind refresh tickets = Yes
>
>
>
> Existing Account:
> getent passwd fred
>
> fred:*:4999:30000000:Fred Nerks:/home/fred:/bin/tcsh
>
> New Account:
>
> fred1:*:30000002:30000000:Fred Nerks:/home/fred1:/bin/tcsh
>
> Fred1 was set up with --uid-number='5004'
>
> I've tried clearing winbindd caches as per some post I read:
>
> systemctl stop winbindd
> rm /usr/local/samba/var/locks/group_mapping.tdb* /usr/local/samba/var/locks/winbindd_idmap.tdb* /usr/local/samba/var/locks/winbindd_cache.tdb*
> systemctl start winbindd
>
> But no change.
>
> I've also noticed that the default group that all users are in used to be "domain users", now for some reason they are all in "BUILTIN\administrators" !
>   
> Am I doing something wrong?  If so, what.  If not, how do I track down why this is happening?
>   
>
> Cheers,
> David Minard.
> Ph:    0247 360 155
> Fax:    0247 360 770
>
> School of Computing, Engineering, and Mathematics
> Building Y - Penrith Campus (Kingswood)
> Locked bag 1797
> Penrith South DC
> NSW 1797
>
> [Sometimes waking up just isn't worth the insult of the day to come.]
>
>

Yes, you do appear to doing things wrong :-)

workgroup = AD

but:

idmap config SAMBADOM:backend = ad
idmap config SAMBADOM:schema_mode = rfc2307
idmap config SAMBADOM:range = 600-29999999

'SAMBADOM' should be 'AD'

You have 'realm = SAMBADOM' , it really should be something like 'realm 
= SAMBADOM.COM'

Rowland