[Samba] NSS and group enumeration in CUPS...

Wed Jun 13 13:15:43 UTC 2018

Hai Marco, 

Ok thats strange, this works fine since Jessie and up. 
I did some extra checks and i'll show my outputs so you can compaire them. 

My "domain" admin shows : id winadmin
uid=10000(winadmin) gid=10000(domain users) groups=10000(domain users),116(lpadmin),10001(domain admins),2001(BUILTIN\users),2000(BUILTIN\administrators)

My group output: getent group lpadmin
lpadmin:x:116:winadmin,otherwinuser,a-linuxuser

This is my running /etc/nsswitch.conf.
passwd:         compat winbind
group:          compat winbind
( the other part is default ) 

Check if these are installed.
dpkg -l | egrep "libnss-winbind|libpam-krb5|libpam-winbind|samba|winbind"
( my output on stretch ) 
ii  libnss-winbind:amd64                  2:4.8.2+nmu-1                  amd64        Samba nameservice integration plugins
ii  libpam-krb5:amd64                     4.7-4                          amd64        PAM module for MIT Kerberos
ii  libpam-winbind:amd64                  2:4.8.2+nmu-1                  amd64        Windows domain authentication integration plugin
ii  libwbclient0:amd64                    2:4.8.2+nmu-1                  amd64        Samba winbind client library
ii  python-samba                          2:4.8.2+nmu-1                  amd64        Python bindings for Samba
ii  samba                                 2:4.8.2+nmu-1                  amd64        SMB/CIFS file, print, and login server for Unix
ii  samba-common                          2:4.8.2+nmu-1                  all          common files used by both the Samba server and client
ii  samba-common-bin                      2:4.8.2+nmu-1                  amd64        Samba common files used by both the server and the client
ii  samba-dsdb-modules:amd64              2:4.8.2+nmu-1                  amd64        Samba Directory Services Database
ii  samba-libs:amd64                      2:4.8.2+nmu-1                  amd64        Samba core libraries
ii  samba-vfs-modules:amd64               2:4.8.2+nmu-1                  amd64        Samba Virtual FileSystem plugins
ii  winbind                               2:4.8.2+nmu-1                  amd64        service to resolve user and group information from Windows NT servers

And run pam-auth-update

The smb.conf is almost the same as my other member servers. 
Except the below part, thats only for a dedicated printserver.

##### PRINT SERVER PART #######
    # Source : https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Print_Server
    ## Enabling spoolssd
    rpc_server:spoolss = external
    rpc_daemon:spoolssd = fork
    spoolss:architecture = Windows x64
    spoolssd:prefork_min_children = 5           # Minimum number of child processes
    spoolssd:prefork_max_children = 25          # Maximum number of child processes
    spoolssd:prefork_spawn_rate = 5             # Start (fork) x new childs if one connection comes in (up to prefork_max_children)
    spoolssd:prefork_max_allowed_clients = 100  # Number of clients, a child process should be responsible for
    spoolssd:prefork_child_min_life = 60        # Minimum lifetime of a child process (60 seconds
                                                # is the minimum, even a lower value has been configured)
    load printers = yes

    # samba prints and snmp..
    # Look here : https://wiki.samba.org/index.php/Configure_network_printer_ports

# Windows clients look for this share name as a source of downloadable printer drivers
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   writable = yes
   guest ok = no
   write list = root, administrator, @"Domain Admins", @lpadmin, @"Print Operators"

[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = yes
   printable = yes
   printing = CUPS

Last, thing you can check is the /etc/idmapd.conf
Default should be fine but you can try and set these
( just before [Mapping] 

Domain = your.dnsdomain.tld 
Local-Realm = YOUR.REALDOMAIN.TLD

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Marco Gaiarin via samba
> Verzonden: woensdag 13 juni 2018 14:28
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] NSS and group enumeration in CUPS...
> 
> Mandi! L.P.H. van Belle via samba
>   In chel di` si favelave...
> 
> > So the short version of above is...
> > Give a AD user a UID/GID
> > Map BUILTIN\Print Operators with SePrivileges
> 
> Just done.
> 
> 
> > Add the user to lpadmin on the linux server.
> 
> Seems the only way.
> 
> I've also tried to use pam_group (eg, assign local group to a 
> user based
> on other infos), but also pam_group does not ''populate'' NSS group
> data, eg 'getent group lpadmin' return empty, so nothing changed.
> 
> I think this can also be fired up as bugs agains cups... probably cups
> enumerate users in admin group, then check against provided 
> user, while
> have to do the convers (enumerate the groups for the user, and check
> against admin group).
> 
> 
> Right?
> 
> -- 
> dott. Marco Gaiarin				        GNUPG 
> Key ID: 240A3D66
>   Associazione ``La Nostra Famiglia''          
> http://www.lanostrafamiglia.it/
>   Polo FVG   -   Via della Bontà, 7 - 33078   -   San Vito al 
> Tagliamento (PN)
>   marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   
> f +39-0434-842797
> 
> 		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
>       http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
> 	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
> 