[Samba] Samba + Winbind help

[Rowland Penny]

On Tue, 18 Nov 2025 08:35:17 +0000
Eric Gurevitz <gurevitz at qti.qualcomm.com> wrote:

> Hi Roland,
> 
> We use vasd in /etc/nsswitch.conf. Vasd did the AD join, and we share
> the keytab. For Mike, he will use NIS. Neither of us need AD users to
> login to Linux using nsswitch. The UID and GID come from vasd for me
> and from NIS for Mike.   

While I can sort of understand why you would want to pay some entity
for something you could get for free, I cannot understand anyone who is
still using NIS, especially if that user is using RHEL. When they do
finally get around to upgrading to RHEL 10, they are in for a big
shock, NIS has gone.

Remember that this is Linux and there are numerous ways of doing
anything, if you only want Linux users to login to Linux, then you
could make them all members of a group and require membership of that
group to logon.


> When someone connects to a samba share,
> samba authenticates the user.  The username map script now strips the
> domain and has the user to get UID and GID. Works well. 

Well yes and no. 
In a single NetBIOS domain setup, 'winbind use default domain = yes'
will do what your username map script is doing.
There is a problem with your UIDs & GIDs, you are using the deprecated
'idmap uid' & 'idmap gid', which leads Samba to create these smb.conf
lines:

idmap config * : backend = tdb
idmap config * : range = 100-2147483647

This means that all your users and groups are ending up in the default
domain.

I cannot recommend your setup to anyone.

Rowland