[Samba] getent problems with new Samba version

[Mark Foley]

More experimentation ...

I stopped Samaba, ldbedit'ed the /var/lib/samba/private/idmap.ldb and changed the line

xidNumber: 3000026

to 

xidNumber: 10001

killed the cache and restarted Samba. As I hoped, the wbinfo now showed

$ wbinfo -i mark
HPRS\mark:*:10001:10000:Mark Foley:/home/HPRS/mark:/bin/bash

which was NOT the case in my message below after killing the cache.  In that previous test I
had to start winbindd at the command line to get the 10001 UID in there.  I supposed it worked when I
started winbindd at the command line because I used the -n (disable caching) switch, thus
apparently, it did not use the cached 3000026 UID.

A bit disconcerting was that the GID in the recent test was still 10000 instead of reverting to
100 (which is defined in idmap.ldb).  Not sure why that didn't revert with no cache. 

My theory: when slackpkg installed Samba 4.4.8, it did all that directory moving as we've
already discussed, but also probably DID NOT MOVE the /var/lib/samba/winbindd_cache.tdb file (a
guess). With no cache, winbindd authenticated using idmap.ldb, which in the case of user 'mark'
returned UID:GID 200026:100. 

User 'shay' was not in idmap.ldb and with no cache I have to assume winbindd got her
information from sam.ldb, which was correct.

Back when I changed all domain users from the 3000xx range to the 100xx range in sam.ldb, I
probably should have also changed their corresponding settings in idmap.ldb based on objectSid,
including changing the 'domain users' GID from 100 to 10000 -- do you agree?

Some unanswered questions, perhaps you know the answer to ...

How did my domain users get in idmap.ldb in the first place? If ADUC put them there when I
created the account, why did ADUC not put user 'shay' in there?

Given the above, is idmap.ldb necessary? Seems redundant with the information in sam.ldb and
apparently overrides sam.ldb when settings conflict.

In the meantime, I think my problem might be solved given the results of this last experiment
to change user 'mark's xidNumber in imap.ldb.

What think ye?

--Mark

-----Original Message-----
Date: Fri, 27 Jan 2017 01:18:28 -0500
To: samba at lists.samba.org
Subject: Re: [Samba] getent problems with new Samba version
From: Mark Foley via samba <samba at lists.samba.org>

Here's an interesting phenomenon. In order to get debug output from winbindd, I killed the one
started by samba and ran it by hand as follows:

$ /usr/sbin/winbindd -i -n --option='server role check:inhibit=yes' --debuglevel=5

I got the --option parameters from `ps ax`, i.e from the winbindd started by Samba.  When I ran
this way and then did `wbinfo -i mark` guess what?

$ wbinfo -i mark
HPRS\mark:*:10001:10000:Mark Foley:/home/HPRS/mark:/bin/bash

I got the right UID:GID.  I then restarted samba and also got the correct UID:GID with wbinfo.
Likewise with getent.  I then stopped samba, killed off the cache:

$ net cache flush
$ rm /var/lib/samba/winbindd_cache.tdb

and restarted samba, and the UID:GID were back to the bad ones:

$ wbinfo -i mark
HPRS\mark:*:3000026:100:Mark Foley:/home/HPRS/mark:/bin/bash

Once again, killing the samba-started winbindd and running by hand began giving the correct
UID:GID, and continued to do so after restarting Samba (probably because that UID:GID is now in
cache). 

Do you have any explanation for this? 

Any idea where to look to make Samba start [whatever] correctly?

Any idea where it is getting the 3000026:100 info in the first place (if I could change it
there it might never be wrong)?

To this latter question, there is a file, /var/lib/samba/private/idmap.ldb, that has:

objectSid: S-1-5-21-1052267278-1962196458-4119365663-1111
xidNumber: 3000026

and this SID corresponds to the objectSid in /var/lib/samba/private/sam.ldb for the 'mark'
user. What if I changed all the xidNumber's in idmap.ldb to the correct ones for the domain
users? 

I'm thinking as I type ...

The domain user that did continue working correctly after the upgrade was:

$ wbinfo -i shay
HPRS\shay:*:10010:10000:Susan Hay:/home/HPRS/shay:/bin/bash

This user was added within the past year with ADUC. This user exists in sam.ldb, but not in
idmap.ldb. why? Is idmap.ldb not really necessary? Why are the other users in ldmap.ldb? I
added them with ADUC as well.

So, back in October 2015 when you advised me to renumber users from 30000xx to 100xx in
sam.ldb, should I have also changed the xidNumber's in idmap.ldb?

Too many questions for on email?

--Mark

-----Original Message-----
Date: Thu, 26 Jan 2017 18:54:26 -0500
To: samba at lists.samba.org
From: Mark Foley via samba <samba at lists.samba.org>
Subject: Re: [Samba] getent problems with new Samba version

On Thu, 26 Jan 2017 21:54:49 +0000 Rowland Penny via samba <samba at lists.samba.org> wrote:

> On Thu, 26 Jan 2017 16:26:02 -0500
> Mark Foley via samba <samba at lists.samba.org> wrote:
>
> > On Thu, 26 Jan 2017 19:36:33 +0000 Rowland Penny wrote:
> > > > > Have you tried checking in AD with ldbsearch or ldbedit for the
> > > > > actual records ?
> > > > 
> > > > Yes, I've done `ldbedit -H /var/lib/samba/private/sam.ldb` (and
> > > > ldbsearch) and among other settings for user 'mark' I have:
> > > > 
> > > > uidNumber: 10001
> > > > gidNumber: 10000
> > >
> > > Does 'Domain Users' have a gidNumber ?
> > 
> > Yes, here is the entire section on that from ldbsearch. You can see
> > the gidNumber is 10000:
> > 
[deleted]
> > 
> > The question remains, why is winbind not getting this info from
> > sam.ldb? Everything appears to be in the right place.
> > 
> > Can I turn on some debugging for winbind? Where is it started?
> > 
> > --Mark
> > 
>
> add 'log level 3 winbind:10' to smb.conf
>

That doesn't seem to help. in smb.conf I've put

log level = 3 winbind:10

All I see winbind related in the log.samba file is:

  AUTH backend 'winbind' registered
  AUTH backend 'winbind_wbclient' registered
  AUTH backend 'winbind' registered
  AUTH backend 'winbind_wbclient' registered
  AUTH backend 'winbind' registered
  AUTH backend 'winbind_wbclient' registered

When I try `wbinfo -1 mark`, nothing new appears in the log

--Mark


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba