[Samba] samba_upgradedns returned an error "Unable to find uid/gid for Domain Admins "

[Denis Cardon]

Hi Rowland and al.

> On 02/02/16 11:26, Markus Dellermann wrote:
>> Am Dienstag, 2. Februar 2016, 09:51:03 CET schrieb Rowland penny:
>>> On 01/02/16 22:24, Markus Dellermann wrote:
>>>> Hi at all,
>>>>
>>>> i´am using samba 4.3.4 as "ad", "migrated by classicupgrade" some
>>>> time ago
>>>> from an nt4-domain.
>>>>
>>>> By trying
>>>> samba_upgradedns --dns-backend=BIND9_DLZ
>>>>
>>>> i get the following error:
>>>>
>>>> Traceback (most recent call last):
>>>>     File "/usr/sbin/samba_upgradedns", line 262, in <module>
>>>>       paths, lp.configfile, lp)
>>>>     File
>>>> "/usr/lib64/python2.7/site-packages/samba/provision/__init__.py",
>>>>     line
>>>>
>>>> 298, in find_provision_key_parameters
>>>>
>>>>       raise ProvisioningError("Unable to find uid/gid for Domain
>>>> Admins rid
>>>>       (%s-
>>>>
>>>> %s" % (str(names.domainsid), security.DOMAIN_RID_ADMINISTRATOR))
>>>> samba.provision.ProvisioningError: ProvisioningError: Unable to find
>>>> uid/gid for Domain Admins rid
>>>> (S-1-5-21-855155194-824588496-1214258294-500
>>>>
>>>> "Domain Admins" seems to be in "ad"
>>> Domain Admins may be in AD but that is not what is being searched for,
>>> it is actually searching for Administrator, have you do anything to
>>> Administrator in AD or idmap.ldb ?
>>>
>>> Rowland
>> Hi Rowland,
>> ah, ok -thank your for your answer.
>>
>> There is a local user named "administrator" in /etc/passwd
>> administrator:x:1039:100::/home/administrator:/bin/bash
>> There was a username-mapping  in /etc/samba/smbusers
>> #!root = MYDOMAIN\Administrator MYDOMAIN\administrator Administrator
>> administrator
>> I have changed this two month ago, because that shoudn`t be needed.(?)
>> Domain-Administrators UID in "aduc" is "10000" -is this korrekt?
>>
>> In my nt4-domain the domain-administrator was mapped to root and the
>> rid "500"
>> was assigned to root
>> Maybe this is missing now?
>> Do i have to assign this again?
>>
>> Thank you
>>
>> Markus
>>
>
> Ok, there are two schools of thought here, you can give Administrator a
> uidNumber attribute, but this, as far as Unix is concerned, turns
> 'Administrator' into just another user, with no more privileges than any
> other Unix user.
>
> What I use on a domain member and recommend, is the use of the user
> mapping in smb.conf, with this 'Administrator' becomes 'root' and as
> such, has all the privileges of 'root'.

To be picky on the terms, I'd say that the Windows equivalent of the 
root user would be "Local System". Administrator account is some kind of 
a super sudoers on modern version of Windows (cf. UAC and al.), and 
still there are many things that you cannot do unless going with "Local 
System".

And concerning domain member user mapping, some security ayatollah might 
even say that you should not use "domain admins" accounts for anything 
else than AD maintenance, and urge you to use less privileged account 
with some extra local privileges to do domain members maintenance.

Cheers,

Denis

> However, you are trying to do something on a DC and you shouldn't use
> the name mapping, as this should be done for you in idmap.ldb. I suggest
> you remove any users that appear in /etc/passwd, such as administrator,
> that are also in AD, I would also remove the uidNumber attribute from
> 'Administrator' in AD.
>
> This should then reset 'Administrator' to '0'
>
> If I run 'getent passwd administrator' on a DC, I get:
>
> SAMDOM\administrator:*:0:10000::/home/administrator:/bin/bash
>
> but if run the same command on a domain member, I get nothing.
>
> Rowland
>
>

-- 
Denis Cardon
Tranquil IT Systems
Les Espaces Jules Verne, bâtiment A
12 avenue Jules Verne
44230 Saint Sébastien sur Loire
tel : +33 (0) 2.40.97.57.55
http://www.tranquil-it-systems.fr