[Samba] SeDiskOperatorPrivilege and 2012 R2 domain

[Tom Söderlund]

Got it sorted out; it was a SELinux problem. Had to put it into permissive
mode as it caused other problems as well that were too nasty to fix with
it. Now that SeDiskOperatorPrivilege permission was possible to grant. I
still had that root user map in place and the actual command was:

sudo net rpc rights grant "DOMAIN\Domain Admins" SeDiskOperatorPrivilege -U
"DOMAIN\Administrator"

Big thanks to you all of you who tried to help. Your work is really
valuable to the community.

Regards,
-Tom

On Wed, Mar 25, 2015 at 10:03 PM, Rowland Penny <rowlandpenny at googlemail.com
> wrote:

> On 25/03/15 19:40, Tim wrote:
>
>> Don't be scared and take the challenge! :-)
>>
>> Reduce your smb.conf to the minimum as seen in the member server wiki and
>> try it again. It should work then.
>>
>> Am 25. März 2015 14:47:16 MEZ, schrieb "Tom Söderlund" <
>> tom.k.soderlund at gmail.com>:
>>
>>> Tim,
>>>
>>> Thanks for the hint. Usermap for root applied, locally made requests
>>> fail
>>> now systematically with
>>> "Could not connect to server <server address>
>>> Connection failed: NT_STATUS_LOCK_NOT_GRANTED"
>>>
>>> It is kind of improvement :) Random things scare me.
>>>
>>> -Tom
>>>
>>>
>>> On Tue, Mar 24, 2015 at 7:40 PM, Tim <lists at kiuni.de> wrote:
>>>
>>>  Hi Tom,
>>>>
>>>> have a look at this:
>>>> https://wiki.samba.org/index.php/Samba_Member_Server_Troubleshooting
>>>>
>>>> I think this could resolve your problem by using a username mapping
>>>>
>>> on
>>>
>>>> your member server.
>>>>
>>>> Regards
>>>> Tim
>>>>
>>>> Am 24. März 2015 18:34:12 MEZ, schrieb "Tom Söderlund" <
>>>> tom.k.soderlund at gmail.com>:
>>>>
>>>>  Mark,
>>>>>
>>>>> Below xxx.yyy. is my network prefix.
>>>>>
>>>>> [global]
>>>>>      workgroup = DOMAIN
>>>>>      realm = DOMAIN.LOCAL
>>>>>      server string = Server %v
>>>>>      security = ADS
>>>>>      client signing = auto
>>>>>      client use spnego = yes
>>>>>      kerberos method = secrets and keytab
>>>>>      log file = /var/log/samba/log.%m
>>>>>      log level = 3
>>>>>      max log size = 50
>>>>>      load printers = No
>>>>>      printcap name = /dev/null
>>>>>      idmap config * : backend = tdb
>>>>>      hosts allow = 127., xxx.yyy.
>>>>>      cups options = raw
>>>>>      vfs objects = acl_xattr
>>>>>      inherit acls = Yes
>>>>>      map acl inherit = Yes
>>>>>      store dos attributes = Yes
>>>>>      browseable = Yes
>>>>>
>>>>> Some trials below, getent for the group succeeds and mostly
>>>>>
>>>> everything is
>>>
>>>> running fine, I can even log in with domain accounts and set file
>>>>> permissions that include domain groups and accounts, and with valid
>>>>>
>>>> file
>>>
>>>> rights MS terminals
>>>>> can see shares on this server. But giving this
>>>>> privilege fails with a bit random results.
>>>>>
>>>>> [me at server]$ getent group "DOMAIN\Domain Admins"
>>>>> domain admins:*:978600512:me.user,administrator
>>>>>
>>>>> [me at server]$ net rpc rights grant "DOMAIN\Domain Admins"
>>>>> SeDiskOperatorPrivilege -UDOMAIN\\Administrator -S server
>>>>> Enter DOMAIN\Administrator's password:
>>>>> Could not connect to server server
>>>>> Connection failed: NT_STATUS_LOCK_NOT_GRANTED
>>>>>
>>>>> [me at server]$ net rpc rights grant "DOMAIN\Domain Admins"
>>>>> SeDiskOperatorPrivilege -UDOMAIN\\Administrator -S
>>>>>
>>>> server.domain.local
>>>
>>>> Enter DOMAIN\Administrator's password:
>>>>> Failed to grant privileges for DOMAIN\Domain Admins
>>>>> (NT_STATUS_ACCESS_DENIED)
>>>>>
>>>>> [me at server]$ sudo net rpc rights grant "DOMAIN\Domain Admins"
>>>>> SeDiskOperatorPrivilege -UDOMAIN\\Administrator -S
>>>>>
>>>> server.domain.local
>>>
>>>> [sudo] password for me:
>>>>> Enter DOMAIN\Administrator's password:
>>>>> Failed to grant
>>>>> privileges for DOMAIN\Domain Admins
>>>>> (NT_STATUS_ACCESS_DENIED)
>>>>>
>>>>> -Tom
>>>>>
>>>>> On Tue, Mar 24, 2015 at 6:10 PM, Marc Muehlfeld
>>>>>
>>>> <mmuehlfeld at samba.org>
>>>
>>>> wrote:
>>>>>
>>>>>   Hello Tom,
>>>>>
>>>>>>   Am 24.03.2015 um 08:49 schrieb Tom Söderlund:
>>>>>>
>>>>>>   $ net rpc rights grant 'DOMAIN\Domain Admins'
>>>>>>
>>>>> SeDiskOperatorPrivilege
>>>
>>>>   -UDOMAIN\\Administrator
>>>>>>>   Enter DOMAIN\Administrator's password:
>>>>>>>   Failed to grant privileges for DOMAIN\Domain Admins
>>>>>>>   (NT_STATUS_ACCESS_DENIED)
>>>>>>>
>>>>>>>   $ net rpc rights grant 'DOMAIN\Unix-admins'
>>>>>>>
>>>>>> SeDiskOperatorPrivilege
>>>
>>>>   -UDOMAIN\\Administrator
>>>>>>>   Enter DOMAIN\Administrator's password:
>>>>>>>   Could not connect to server 127.0.0.1
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>   * Is the group "DOMAIN\Domain Admins" local available? Check with
>>>>>>     # getent group "DOMAIN\Domain Admins"
>>>>>>
>>>>>>   * Is Samba listening on localhost? Check "interfaces" parameter
>>>>>>     in your smb.conf. Or add "-S servername" to your "net" command.
>>>>>>
>>>>>>   * Can you post the [global] section of your smb.conf, please?
>>>>>>
>>>>>>
>>>>>>
>>>>>>   Regards,
>>>>>>   Marc
>>>>>>
>>>>>
>>>>>
> Possibly not, I think the OP is using sssd, it might help if we could see
> the exact command the OP is running and if he is running it as 'root'
>
> Rowland
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba