[Samba] SID history secondary group set bloat

Wed Jun 9 14:42:36 UTC 2021

Hi slow,

> > root at debian:/var/cache/samba# id EXAMPLE\\secretuser
> > uid=301142(EXAMPLE\secretuser) gid=300513(EXAMPLE\domain users) groups=300513(EXAMPLE\domain users),301142(EXAMPLE\secretuser),472199(EXAMPLE\secret),572198(EXAMPLE\secret),301141(EXAMPLE\secret),301132(EXAMPLE\cae)
> >
> > Any idea why?

> Have you tried net cache flush and restarted winbind so the winbind
> cache gets flushed too?

Yes, I've gone full rm -f on all but secrets.tdb and the IDs totally differ from the previous test case as well. No nscd running either. autorid really seems to be doing the mapping itself because it can't tell that the SIDs really are sIDHistory.

root at debian:/var/cache/samba# systemctl stop smbd
root at debian:/var/cache/samba# systemctl stop winbind
root at debian:/var/cache/samba# find /var/lib/samba /run/samba /var/cache/samba -type f | grep -v secrets.tdb | xargs rm -f
root at debian:/var/cache/samba# find /var/lib/samba /run/samba /var/cache/samba -type f
/var/lib/samba/private/secrets.tdb
root at debian:/var/cache/samba# systemctl start winbind

root at debian:/var/cache/samba# getent group EXAMPLE\\secret
EXAMPLE\secret:x:301141:
root at debian:/var/cache/samba# getent group 472199
EXAMPLE\secret:x:472199:
root at debian:/var/cache/samba# getent group 572198
EXAMPLE\secret:x:572198:
root at debian:/var/cache/samba# getent group 301141
EXAMPLE\secret:x:301141:

autorid apparently also treats SID history as SIDs from separate, existing domains and assigns separate gids accordingly:

root at debian:/var/cache/samba# tdbdump /var/lib/samba/autorid.tdb
[...]
{
key(40) = "S-1-5-21-1623811102-3361044346-30300840\00"
data(4) = "\02\00\00\00"
}
[...]
{
key(40) = "S-1-5-21-2623811102-3361044346-30300840\00"
data(4) = "\03\00\00\00"
}
[...]
{
key(42) = "S-1-5-21-4131831116-1822871472-1861548575\00"
data(4) = "\01\00\00\00"
}
[...]

log.smbd:
[2021/06/09 11:34:27.402131,  5, pid=1944, effective(0, 0), real(0, 0)] ../../libcli/security/security_token.c:56(security_token_debug)
  Security token SIDs (22):
    SID[  0]: S-1-5-21-4131831116-1822871472-1861548575-1142
    SID[  1]: S-1-5-21-4131831116-1822871472-1861548575-513
    SID[  2]: S-1-5-21-4131831116-1822871472-1861548575-1132
    SID[  3]: S-1-5-21-4131831116-1822871472-1861548575-1141
    SID[  4]: S-1-5-21-2623811102-3361044346-30300840-72198
    SID[  5]: S-1-5-21-1623811102-3361044346-30300840-72199
    SID[  6]: S-1-18-1
    SID[  7]: S-1-1-0
    SID[  8]: S-1-5-2
    SID[  9]: S-1-5-11
    SID[ 10]: S-1-5-32-545
    SID[ 11]: S-1-22-1-301142
    SID[ 12]: S-1-22-2-300513
    SID[ 13]: S-1-22-2-301142
    SID[ 14]: S-1-22-2-301132
    SID[ 15]: S-1-22-2-301141
    SID[ 16]: S-1-22-2-572198
    SID[ 17]: S-1-22-2-472199
    SID[ 18]: S-1-22-2-299999
    SID[ 19]: S-1-22-2-299990
    SID[ 20]: S-1-22-2-299982
    SID[ 21]: S-1-22-2-200001
   Privileges (0x               0):
   Rights (0x               0):
[2021/06/09 11:34:27.402174,  5, pid=1944, effective(0, 0), real(0, 0)] ../../source3/auth/token_util.c:873(debug_unix_user_token)
  UNIX token of user 301142
  Primary group is 300513 and contains 10 supplementary groups
  Group[  0]: 301142
  Group[  1]: 300513
  Group[  2]: 301132
  Group[  3]: 301141
  Group[  4]: 572198
  Group[  5]: 472199
  Group[  6]: 299999
  Group[  7]: 299990
  Group[  8]: 299982
  Group[  9]: 200001

Thanks,
Michael
________________________________________
From: Ralph Boehme <slow at samba.org>
Sent: 09 June 2021 16:32:03
To: Weiser, Michael
Cc: Laubender, Guido; samba at lists.samba.org
Subject: Re: [Samba] SID history secondary group set bloat

Am 09.06.21 um 16:05 schrieb Weiser, Michael:
> Yeah, I find that message in log.winbinds-idmap now:
>
> root at debian:~# grep autorid.*config.*default /var/log/samba/log.winbindd*
> /var/log/samba/log.winbindd-idmap:  idmap_autorid_initialize: Error: autorid configured for domain 'example'. But autorid can only be used for the default idmap configuration.
> /var/log/samba/log.winbindd-idmap:  idmap_autorid_initialize: Error: autorid configured for domain 'example'. But autorid can only be used for the default idmap configuration.
> /var/log/samba/log.winbindd-idmap:  idmap_autorid_initialize: Error: autorid configured for domain 'example'. But autorid can only be used for the default idmap configuration.
>
> But even as default backend it shows a similar issue with SID history as idmap_nss (see end of my previous mail for full details):

sorry, much too busy to fully read all that.

> root at debian:/var/cache/samba# id EXAMPLE\\secretuser
> uid=301142(EXAMPLE\secretuser) gid=300513(EXAMPLE\domain users) groups=300513(EXAMPLE\domain users),301142(EXAMPLE\secretuser),472199(EXAMPLE\secret),572198(EXAMPLE\secret),301141(EXAMPLE\secret),301132(EXAMPLE\cae)
>
> Any idea why?

caching?

Have you tried net cache flush and restarted winbind so the winbind
cache gets flushed too?

Cheers!
-slow

--
Ralph Boehme, Samba Team                https://samba.org/
Samba Developer, SerNet GmbH   https://sernet.de/en/samba/
GPG-Fingerprint   FAE2C6088A24252051C559E4AA1E9B7126399E46