[Samba] samba file server - sediskoperatorprivilege not being honored
Kacper Wirski
kacper.wirski at gmail.com
Mon Jun 3 11:29:58 UTC 2019
Hello,
Since nobody picked this up I will try to answer myself (hopefully
correctly).
I think I just misread documentation on wiki, but I would really
appreciate a clarification. In the wiki it states:
"To enable other accounts than the domain administrator to set
permissions on Windows, grant |Full control| (|rwx|) to the user or
group you granted the |SeDiskOperatorPrivilege| privilege."
Does the "domain administrator" mean EXACTLY the default "Administrator"
user, or should I understand it as "any member of Domain Admins group"?
If it's the former, than there is no issue (I can change share ACL from
windows client using Administrator without changing any of the
permissions i.e. owner:group can stay as root:root), if it's the latter,
than I have anissue, since none other user from Domain Admins can change
any ACL, unless i change owner/group or add initial ACL to domain
admins (or any other user/group i gave sediskoperatorprivilege)
I suspect it's the former, but if not, than I'm doing something wrong.
Regards,
Kacper
W dniu 29.05.2019 o 10:12, Kacper Wirski via samba pisze:
> Hello,
>
> I've been setting up new file server using samba 4.8.3 (centos 7 RPM),
> as samba 4 AD member server using my earlier smb.conf when I realised
> that I was previously somewhat circumventing the
> SeDiskOperatorPrivilege by using "admin users map" to SAMDOM\Domain
> admins" parameter in smb.conf.
>
> I decided to change my smb.conf and setup shares following samba wiki.
>
> All shares are going to be used strictly by windows clients (AD domain
> members), so I've followed closely samba wiki.
>
> I granted both SAMDOM\domain admins and SAMDOM\myuser the
> SeDiskOperatorPrivilege, but still I'm unable to change ACL from
> windows client, even when I'm logged in as SAMDOM\myuser (which
> belongs to SAMDOM\domain admins group) to windows client.
>
> My smb.conf:
>
> [global]
> Â Â Â Â Â Â netbios name = VS-FILES1
> Â Â Â Â Â Â security = ADS
> Â Â Â Â Â Â workgroup = SAMDOM
> Â Â Â Â Â Â realm = MY.REALM.COM
>
> Â Â Â Â Â Â log level = 1
> Â Â Â Â Â Â log file = /var/log/samba/%m.log
> Â Â Â Â Â Â Â max log size = 2000
> Â Â Â Â Â Â Â logging = syslog at 2 file
> Â Â Â Â Â Â idmap config *:backend = tdb
> Â Â Â Â Â Â idmap config *:range = 2000-7000
>
> Â Â Â Â Â Â idmap config SAMDOM:backend = rid
> Â Â Â Â Â Â idmap config SAMDOM:range = 100000-110000
>
> Â Â Â Â Â Â Â winbind enum users = no
> Â Â Â Â Â Â Â winbind enum groups = no
> Â Â Â Â Â Â Â winbind nested groups = yes
> Â Â Â Â Â Â Â winbind expand groups = 3
> Â Â Â Â Â Â Â winbind refresh tickets = yes
> Â Â Â Â Â Â Â winbind use default domain = no
> Â Â Â Â Â Â Â winbind offline logon = yes
>
> Â Â Â Â Â Â Â template shell = /bin/bash
> Â Â Â Â Â Â Â template homedir = /home/%U@%D
>
> Â Â Â Â Â Â Â kerberos method = secrets and keytab
>
> Â Â Â Â Â Â Â load printers = no
> Â Â Â Â Â Â Â printing = bsd
> Â Â Â Â Â Â Â printcap name = /dev/null
> Â Â Â Â Â Â Â disable spoolss = yes
>
> Â Â Â Â Â Â Â vfs objects = acl_xattr full_audit recycle
>
> Â Â Â Â Â Â Â full_audit:prefix = %u|%I|%M|%S
> Â Â Â Â Â Â Â full_audit:failure = connect
> Â Â Â Â Â Â Â full_audit:success =Â mkdir rmdir write rename pwrite unlink
> Â Â Â Â Â Â Â full_audit:priority = NOTICE
>
> Â Â Â Â Â Â Â recycle:repository = .recycle
> Â Â Â Â Â Â Â recycle:keeptree = yes
> Â Â Â Â Â Â Â recycle:versions = yes
> Â Â Â Â Â Â Â recycle:touch_mtime = yes
> Â Â Â Â Â Â Â recycle:exclude = *.tmp, *.bak, *.ods#, *.odt#, *.xls#, *.TMP,
> *.cache
> Â Â Â Â Â Â Â recycle:exclude_dir = .recycle
> Â Â Â Â Â Â Â recycle:maxsize = 1073741824
>
>
> Â Â Â Â Â Â store dos attributes = yes
> Â Â Â Â Â Â Â map acl inherit = yes
>
> #Â Â Â Â Â Â Â admin users = "@BABKA\Domain Admins","@BABKA\Enterprise Admins"
>
> [MYSHARE]
> Â Â Â Â Â Â Â path = /srv/samba/myshare/
> Â Â Â Â Â Â Â read only = no
>
>
> output of
>
> net rpc rights list privileges SeDiskOperatorPrivilege -U
> "SAMDOM\administrator" -S VS-FILES1
>
> SeDiskOperatorPrivilege:
> Â SAMDOM\myuser
> Â SAMDOM\Domain Admins
> Â BUILTIN\Administrators
>
> getfacl myshare
> # file: myshare
> # owner: root
> # group: root
> user::rwx
> group::r-x
> other::r-x
>
>
> THe only way to set ACL through windows is either:
> - set owner (user/group) and grant rwx permissions
> ( e.g. chown "SAMDOM\myuser" myshare
> chmod 0770 myshare)
> OR
> - uncomment "admin users" line
>
>
> Otherwise I'm getting denied error from windows client ("unable to
> list folder contents"). Is this expected? According to wiki setting
> "SeDiskOperatorPrivilege" should be enough, but isn't. Winbind is
> working correctly, I can get reasonable output from all wbinfo
> commands, all ACL set (with either of the methods) stick and are
> respected.
>
> I'd like to know if I have some error in my configuration and if so,
> to fix it.
>
> For quite some time I've been simply using samba file server with
> "admin users=....", that's why I didn't run into this issue before,
> but I found some scenarios where this setting has some drawbacks and
> I'd like to move away from it.
>
>
> Regards,
> Kacper
>
>
>
> ---
> Ta wiadomoÅÄ zostaÅa sprawdzona na obecnoÅÄ wirusów przez
> oprogramowanie antywirusowe Avast.
> https://www.avast.com/antivirus
---
Ta wiadomoÅÄ zostaÅa sprawdzona na obecnoÅÄ wirusów przez oprogramowanie antywirusowe Avast.
https://www.avast.com/antivirus
More information about the samba
mailing list