[Samba] GPO on a DC

[samba-ml-en]

Dear Rowland,Louis and David,

I am coming to you with regards to the answer point from rowland, and more testing of my problem of course, hoping it makes sense, but it seems to me there are 3 bugs with samba GPOs.

I ran my setup again with  --option="tls enabled=no" in my "samba-tool domain provision", well I can say, it is not honored and is not written in smb.conf and therefore you always end up with the default which is Yes (cf man page and testparm -vv | grep tls). So anyway this prompted me to do further testing and I started to look at the samba code. I found in the repo  samba/source3/winbindd/winbindd_gpupdate.c  (https://github.com/samba-team/samba/blob/e742661bd2507d39dfa47e40531dc1dca636cbbe/source3/winbindd/winbindd_gpupdate.c)
I could infer it is calling samba-gpupdate with the parameters -s smb.conf --target=Computer --machine-pass within a call back function WITH some other parameters.

So now I repeated my testing:

1) tls enabled = Yes (which is the default)

Run samba-gpupdate -s /etc/samba/smb.conf --target=Computer --machine-pass -d10
GPO are parsed and applied

Next systemctl restart samba-ad-dc and I get
[2022/06/25 13:24:49.936038,  0] ../../lib/util/util_runcmd.c:355(samba_runcmd_io_handler)
  /usr/sbin/samba-gpupdate: Connecting to 10.10.20.43 at port 389
[2022/06/25 13:24:49.936180,  0] ../../lib/util/util_runcmd.c:355(samba_runcmd_io_handler)
  /usr/sbin/samba-gpupdate: open_socket_out: failed to open socket

repeat many times systemctl restart samba-ad-dc sometimes the connection is successful......

2) Repeat the above with tls enabled = No

Run samba-gpupdate -s /etc/samba/smb.conf --target=Computer --machine-pass -d10
GPO are parsed and applied

Next systemctl restart samba-ad-dc and I get the original error.


What I can conclude so far, few issues:

1) --option="tls enabled=no" not honored during samba-tool domain provision

2) tls enabled = Yes
winbindd does not seem to be able to connect to the socket (on 636 I suppose, because in the logs it can do some cldap on 389 before without error) during samba-ad-dc startup, but it is fine do to the same after it is started. I suspect the process on port 636 is not yet up when it tries. Let's call it a timing issue

3) tls enabled = No
We can get the data we want off ldap regardless of the method (samba restart or manual gp update), however we get
 /usr/sbin/samba-gpupdate: add_local_groups: SID S-1-5-21-3771616199-2733218289-4272702380-1000 -> getpwuid(3000141) failed, is nsswitch configured?
Always the case when the update comes from an automatic update. What is the difference with the manual method? Well the call is wrapped by I suppose winbindd_gpupdate.c which may be the culprit


Now why GPOs are working on a windows client?
  Samba is fully started when updates occur and it is not using winbind

Now why GPOs are not working on a linux client?
  Same reason a for the server part, winbindd code

Eric



> On Fri, 2022-06-24 at 14:45 +0000, samba-ml-en wrote:
>
> > Hello Rowland,
> >
> > I removed the down level options, left the winbind enum ones (I am
> > still testing, not many users/groups), re-enabled netbios, and
> > disabled winbind over RPC.
> >
> > now I can see better ldap conversation, however I am hitting in one
> > case the same problem as before, the other probably another issue.
> > so:
> >
> > 1) tls enabled = Yes
> >
> > I have a valid certificate
>
>
> You may have, but don't use ldaps, use kerberos instead, it is more
> secure.
>
> Rowland
>