[Samba] Winbindd Strangeness

[Rowland Penny]

On 25/06/15 13:44, David Minard wrote:
>> On 24/06/15 02:55, David Minard wrote:
>>> On 23/06/15 13:32, David Minard wrote:
>>>
>>>>     I've Set up a DC and a Member Server for a file server.  Both are
>>>> running on Centos7 and samba version 4.2.2.  The Member Server is
>>>> running smbd and winbindd.
>>>>
>>>>     I've followed the wiki and for the most part it's working.
>>>> However, after stuffing up the ranges, then fixing them up, when I
>>>> create new accounts, adding all the Unix attributes, the UID_Number
>>>> is not showing the correct value for new accounts. Existing ones are
>>>> okay.
>>>>
>>>>     Member_Server Config:
>>>>
>>>>     [global]
>>>>
>>>>         netbios name = MS1
>>>>         workgroup = AD
>>>>         security = ADS
>>>>         realm = SAMBADOM
>>>>         dedicated keytab file = /etc/krb5.keytab
>>>>         kerberos method = secrets and keytab
>>>>
>>>>         idmap config *:backend = tdb
>>>>         idmap config *:range = 30000000-40000000
>>>>         idmap config SAMBADOM:backend = ad
>>>>         idmap config SAMBADOM:schema_mode = rfc2307
>>>>         idmap config SAMBADOM:range = 600-29999999
>>>>
>>>>         winbind nss info = rfc2307
>>>>         winbind trusted domains only = no
>>>>         winbind use default domain = yes
>>>>         winbind enum users  = yes
>>>>         winbind enum groups = yes
>>>>         winbind refresh tickets = Yes
>>>>
>>>>
>>>>
>>>>     Existing Account:
>>>>     getent passwd fred
>>>>
>>>>     fred:*:4999:30000000:Fred Nerks:/home/fred:/bin/tcsh
>>>>
>>>>     New Account:
>>>>
>>>>     fred1:*:30000002:30000000:Fred Nerks:/home/fred1:/bin/tcsh
>>>>
>>>>     Fred1 was set up with --uid-number='5004'
>>>>
>>>>     I've tried clearing winbindd caches as per some post I read:
>>>>
>>>>     systemctl stop winbindd
>>>>     rm /usr/local/samba/var/locks/group_mapping.tdb*
>>>> /usr/local/samba/var/locks/winbindd_idmap.tdb*
>>>> /usr/local/samba/var/locks/winbindd_cache.tdb*
>>>>     systemctl start winbindd
>>>>
>>>>     But no change.
>>>>
>>>>     I've also noticed that the default group that all users are in
>>>> used to be "domain users", now for some reason they are all in
>>>> "BUILTIN\administrators" !
>>>>            Am I doing something wrong?  If so, what.  If not, how do
>>>> I track down why this is happening?
>>>>
>>>>     Cheers,
>>>>     David Minard.
>>>>     Ph:    0247 360 155
>>>>     Fax:    0247 360 770
>>>>
>>>>     School of Computing, Engineering, and Mathematics
>>>>     Building Y - Penrith Campus (Kingswood)
>>>>     Locked bag 1797
>>>>     Penrith South DC
>>>>     NSW 1797
>>>>
>>>>     [Sometimes waking up just isn't worth the insult of the day to
>>>> come.]
>>>>
>>>>
>>>    Yes, you do appear to doing things wrong workgroup = AD but: idmap
>>>    config SAMBADOM:backend = ad idmap config SAMBADOM:schema_mode =
>>>    rfc2307 idmap config SAMBADOM:range = 600-29999999 'SAMBADOM' should
>>>    be 'AD' You have 'realm = SAMBADOM' , it really should be something
>>>    like 'realm = SAMBADOM.COM' Rowland
>>>
>>> Thanks for the quick reply Roland.  The change didn't make any
>>> difference.  I remember having it the way you suggested in the first
>>> place, but was still getting strangeness.  I have put it back to the
>>> right way as suggested.  I now have a config of:
>>>
>>> [global]
>>>
>>>   netbios name = MS1
>>>   workgroup = AD
>>>   security = ADS
>>>   realm = SAMDOM
>>>   dedicated keytab file = /etc/krb5.keytab
>>>   kerberos method = secrets and keytab
>>>
>>>   idmap config *:backend = tdb
>>>   idmap config *:range = 30000000-40000000
>>>   idmap config AD:backend = ad
>>>   idmap config AD:schema_mode = rfc2307
>>>   idmap config AD:range = 600-29999999
>>>
>>>   winbind nss info = rfc2307
>>>   winbind trusted domains only = no
>>>   winbind use default domain = yes
>>>   winbind enum users  = yes
>>>   winbind enum groups = yes
>>>   winbind refresh tickets = Yes
>>>
>>>
>>> SAMDOM is as you say, a domain name for the AD.
>>>
>>> I noticed that the UIDNumber of new accounts are overlapping with
>>> system accounts.
>>>
>>> fred1:*:30000002:30000000:Fred Nerks:/home/fred1:/bin/tcsh
>>> krbtgt:*:30000002:30000000:krbtgt:/home/AD/krbtgt:/bin/false
>>>
>>> fred:*:30000000:30000000:Fred Nerks:/home/fred:/bin/tcsh
>>> administrator:*:30000000:30000000:Administrator:/home/AD/administrator:/bin/false
>>>
>>>
>>
>> Strange, have you tried running 'net cache flush' on the member server ?
> No I hadn't.  I tried it.  Now 'getent passwd' gives only gives me the unix accounts on the server.  'wbinfo -u' works fine.
>
>> Have you given all the users & groups an ID number in AD ?
> Only users and groups that I have created.  Do I have to do that for the default accounts too?
>
>> Can you post the exact command you are using to create users.
>>
> samba-tool user add fred --userou='OU=Test Users' --profile-path='\\ms1.example.com\profiles\fred' --home-drive='u:' --home-directory='\\ms1.example.com\fred' --login-shell='/bin/tcsh' --gecos='Fred Nerks' --gid-number='600' --uid-number='4999' --uid='fred' --unix-home='/home/fred' --nis-domain='AD' --surname='Nerks' --given-name='Fred' --mail-address='fred at example.com'  --random-password
>
>

OK, I have recreated your user 'fred' on my DC, just a couple of issues 
first, shouldn't  --home-drive='u:' be
--home-drive='U:' and how will your user login, I ask this because you 
(or fred) don't know the password ?

Now, if I run 'getent passwd fred' on the DC, I get this:

EXAMPLE\fred:*:4999:10000:Fred Nerks:/home/EXAMPLE/fred:/bin/bash

But I get nothing on a member server.

until I change the uidNumber for fred to 14999 which is inside the range 
I have in smb.conf:

idmap config EXAMPLE : range = 10000-999999

So, can we confirm that your line in smb.conf is:

idmap config AD : range = 600-29999999

Rowland