[Samba] Samba 4 permissions error

[Rowland penny]

On 09/05/16 08:12, Jason Voorhees wrote:
> Hey guys, thanks for your time.
>
> Unfortunately, I've been busy so I wasn't able to test it again. Just
> today I started to read, investigate and test all this stuff you
> suggested me. I don't fully understand yet how uidNumbers and
> xidNumbers work, all I know is that Zentyal is using the old winbind
> daemon instead of the new winbindd. There are many concepts that I
> don't know how they relate to each other, but this is what I've
> tested:
>
> 1. On the 2nd. DC, I've remounted the filesystem with acl and xattr options.
> 2. On the 2nd. DC, I've disabled apparmor.
> 3. From the 1st DC, I've modified my rsync script to also include the
> X option  to synchronize extented attributes too.
> 4. I've backed up idmap.ldb from 1st. DC using "tdbbackup -s bak
> idmap.ldb" and copied to 2nd. DC as idmap.ldb. Then I ran "samba-tool
> ntacl sysvolreset" on the 2nd DC and restarted Samba.
> 5. I've copied the original idmap.ldb file from 1st to 2nd DC, ran
> "samba-tool ntacl sysvolreset" on 2nd DC and restarted Samba again.
> 6. I've synchronized the sysvol share from 1st to 2nd DC using rsync
> -aAHSX, ran "samba-tool ntacl sysvolreset" on 2nd DC and restarted
> Samba again.
>
>
> I've tried to access one of my shares on the 2nd DC but I always got
> the same error "NT_STATUS_ACCESS_DENIED listing \*". So in the middle
> of the night (02:00 am) and giving up just for today...
>
> The only "strange" thing I notice is this:
>
> If I connect to a certain share in the 1st DC I see a log like this:
>
>    127.0.0.1 (ipv4:127.0.0.1:55282) connect to service Central
> initially as user AGN\cchavarrias (uid=2502, gid=2513) (pid 26854)
>
> But on the 2nd DC the log look like this:
>
>    __1 (ipv6:::1:33880) connect to service Central initially as user
> AGN\cchavarrias (uid=2502, gid=100) (pid 8708)
>
> On the 1st DC, "cchavarria" user is using GID 2513 (domain users group
> from Samba) but on the 2nd DC is using GID 100 (default group from
> OS). If I run the "id" command on both DCs, the information is the
> same:
>
> On DC 1:
> # id cchavarrias
> uid=2502(cchavarrias) gid=2513(domain users) groups=2513(domain
> users),2512(domain admins),3124(usuarios)
>
> On DC 2:
> # id cchavarrias
> uid=2502(cchavarrias) gid=2513(domain users) groups=2513(domain
> users),3124(usuarios),2512(domain admins)
>
> I wonder if the fact that GID 100 is being used on the 2nd DC is
> causing any problems due to ACLs not granted to group with GID 100.
> However, cchavarrias user has full permissions through ACLs in both
> DCs for every share.
>
>
> P.S.: By using ldbsearch over idmap.ldb I noticed that xidNumber
> attribute is the same for cchavarrias user in both, 1st and 2nd DC, so
> I guess xidNumbers match correctly. Am I right?
>
> On Thu, Apr 28, 2016 at 12:12 PM, Sketch <smblist at rednsx.org> wrote:
>> On Thu, 28 Apr 2016, Jason Voorhees wrote:
>>
>>> Now I can barely understand what the problem might be. I'll take a
>>> look at the wiki page to better understand what's wrong and how to fix
>>> it.
>>
>> I believe this is the part you're looking for, which explains the problem
>> and gives the solution:
>>
>> https://wiki.samba.org/index.php/Join_an_additional_Samba_DC_to_an_existing_Active_Directory#GID_mappings_of_built-in_groups
>>

If you only connect windows machines to a Samba AD DC for 
authentication, then you do not need to bother about 'xidNumber', 
'uidNumber' and 'gidNumber' attributes, it is only when you want to 
store any user data on the DC (or domain member) that you need to 
consider these.

Samba uses various different ways of mapping windows users to Unix, but 
the main two are 'rid' and 'ad' (note I am talking about using winbindd 
here). On the DC, the 'rid' backend is different to using it on a domain 
member, a DC uses 'xidNumber' attributes stored in idmap.ldb, these 
'xidNumber' attributes seem to be allocated on a first come basis, hence 
you can get different numbers on different DCs. Using the 'rid' backend 
on a domain member maps RIDs to 'uidNumber' & 'gidNumber' using a 
calculation, this way you will always get the same ID on different 
computers.
Back to the DC, a few users and groups are always mapped to the same ID, 
Administrator and 'Domain Users' for instance, using 'winbind' or 
'winbindd' should make no difference to this, but using 'winbindd' 
brings advantages over using 'winbind'.
If you use the 'ad' backend, you can 'fix' the ID numbers of users & 
groups, but you may have to clear caches and/or remove 'xidNumber' 
attributes from idmap.ldb

As there are differences between the way 'winbind' and 'winbindd' work, 
I wouldn't use one on a DC and the other on a second DC, I would use the 
same one on both DCs and I would probably use 'winbindd' on both.

Samba (partially because of the above) does not recommend using a DC as 
a fileserver, but can if you so wish, it is your DC.

Rowland