[Samba] Unable to set SeDiskOperatorPrivilege (again)
jgardeniers at integradev.com.au
Wed May 24 21:40:50 UTC 2017
Those low numbers you refer to are in fact the standard numbers assigned
to those groups, so I fail to see the problem. As for mapping
Administrator to root, I believe that's entirely optional, rather than
required. Under normal circumstances we don't use the domain
Administrator account at all. We have a root account we use instead.
In regard to winbind, we have never used it and there's a concern here
that it may clash with our use of sssd, which is working great for all
normal purposes. Using multiple authentication mechanisms against the
same source can't be a good idea and, as you can see from my question,
we have no trouble resolving users or groups normally.
Here's smb.conf from the test machine:
security = ADS
workgroup = MYDOMAIN
realm = MYDOMAIN.COM.AU
log file = /var/log/samba/%m.log
log level = 1
# Default ID mapping configuration for local BUILTIN accounts
# and groups on a domain member. The default (*) domain:
# - must not overlap with any domain ID mapping configuration!
# - must use an read-write-enabled back end, such as tdb.
idmap config * : backend = tdb
idmap config * : range = 10000-19999
vfs objects = acl_xattr
map acl inherit = Yes
store dos attributes = Yes
On 24/05/17 16:47, Rowland Penny via samba wrote:
> On Wed, 24 May 2017 13:34:27 +1000
> John Gardeniers via samba <samba at lists.samba.org> wrote:
>> There was a thread on this topic back in January and as far as I can
>> see it was never resolved.
> It has always worked for me, even when I used sssd.
> But there is no need to use sssd on a Unix domain member
>> # getent group "Domain Admins"
>> Domain Admins:*:512:Administrator,user1,user2,user3
>> # id Administrator
>> uid=10858(Administrator) gid=513(Domain Users) groups=513(Domain
>> Users),512(Domain Admins),10102(Enterprise Admins)
>> # id "Domain Admins"
>> id: Domain Admins: No such user
> You seem to be using very low numbers for 'Domain Users' & 'Domain
> 'Domain Admins' is only a user on a DC (where it also a group)
> 'Administrator' shouldn't have a uidNumber, it should be mapped to
> Can you post your smb.conf and are you willing to try using winbind.
More information about the samba