[Samba] Element not found error

[Brian C. Huffman]

I have a Samba 4.1.4 AD server and am trying to set up a file server as
a member of the domain.

Currently I'm using Samba 3.6.9 from the CentOS repository.

I've followed this wiki:
https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs

but when I try to make changes in the Security tab of Computer
Management->System Tools->Shared Folders-Shares, I'm getting "An error
occurred while applying security information to: \\SAMBA02\files -
Element not found." If I click continue, then I get "Unable to save
permission changes on files (\\SAMBA02). Element not found."

I can't figure out what I'm doing wrong. Any suggestions?

Thanks,
Brian



--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Marc Muehlfeld]

Hello Brian,

Am 22.09.2014 um 19:48 schrieb Brian C. Huffman:
> I have a Samba 4.1.4 AD server and am trying to set up a file server as
> a member of the domain.
>
> Currently I'm using Samba 3.6.9 from the CentOS repository.
>
> I've followed this wiki:
> https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs

I didn't tried that with 3.6, when I wrote the documentation. Do you
have a change to re-try it with the latest 4.0 or better 4.1? Maybe some
else here on the list can say for sure, that it should work with 3.6, too.

> but when I try to make changes in the Security tab of Computer
> Management->System Tools->Shared Folders-Shares, I'm getting "An error
> occurred while applying security information to: \\SAMBA02\files -
> Element not found." If I click continue, then I get "Unable to save
> permission changes on files (\\SAMBA02). Element not found."
>
> I can't figure out what I'm doing wrong. Any suggestions?

My guess, without having seen any logs and configs:
https://wiki.samba.org/index.php/Setup_and_configure_file_shares_with_Windows_ACLs#SeDiskOperatorPrivilege




Regards,
Marc

[Brian C. Huffman]

Mark,

Ok - I just tried using SerNet's 4.1 RPMS (4.1.12-9.el6.x86_64)

I had to change the syntax for adding the SeDiskOperatorPrivilege. Was
this written / tested using Samba 4.0?
[root@samba02 bhuffman]# net rpc rights grant 'ETI\Domain Admins'
SeDiskOperatorPrivilege -Uadministrator
Enter administrator's password:
Failed to grant privileges for ETI\Domain Admins (NT_STATUS_ACCESS_DENIED)
[root@samba02 bhuffman]# net sam rights grant 'ETI\Domain Admins'
SeDiskOperatorPrivilege -Uadministrator
Granted SeDiskOperatorPrivilege to ETI\Domain Admins

At any rate, after using "net sam" instead of "net rpc", it appeared to
work.

But now when I tried to change things in the security tab in computer
management, I get a "Access is denied" error message.

Ideas?

Thanks,
Brian

[Brian C. Huffman]

I was finally able to get this to work, but I had to do the following
(which is not on the main file shares wiki page):

After making the directory on the Samba member server, I did the
following (from the profiles wiki page):
chmod 1770 /share
chgrp "Domain Users" /share

Then I'm able to add "Domain Admins" group with full control in Windows
computer management and from there I'm good.

Should this be added to the wiki? Or maybe this is a side effect of
something else I did wrong?

-b

On 09/22/2014 02:06 PM, Marc Muehlfeld wrote:

[Marc Muehlfeld]

Am 23.09.2014 um 20:02 schrieb Brian C. Huffman:
> I was finally able to get this to work, but I had to do the following
> (which is not on the main file shares wiki page):
>
> After making the directory on the Samba member server, I did the
> following (from the profiles wiki page):
> chmod 1770 /share
> chgrp "Domain Users" /share
>
> Then I'm able to add "Domain Admins" group with full control in Windows
> computer management and from there I'm good.
>
> Should this be added to the wiki? Or maybe this is a side effect of
> something else I did wrong?

Normally this shouldn't be necessary.

- Which account did you used to add the ACL?
- Is this account mapped in the backend (e. g. to root)?
- Can you show me your smb.conf (global and the share config)

[Brian C. Huffman]

On 09/23/2014 02:47 PM, Marc Muehlfeld wrote:
> Am 23.09.2014 um 20:02 schrieb Brian C. Huffman:
>> I was finally able to get this to work, but I had to do the following
>> (which is not on the main file shares wiki page):
>>
>> After making the directory on the Samba member server, I did the
>> following (from the profiles wiki page):
>> chmod 1770 /share
>> chgrp "Domain Users" /share
>>
>> Then I'm able to add "Domain Admins" group with full control in Windows
>> computer management and from there I'm good.
>>
>> Should this be added to the wiki? Or maybe this is a side effect of
>> something else I did wrong?
> Normally this shouldn't be necessary.
>
> - Which account did you used to add the ACL?

An account I created that is a member of Domain Admins

> - Is this account mapped in the backend (e. g. to root)?

umm. Maybe this is the problem? I don't think I have this. I did try
at one point to add an smbusers file with the following line, but it
didn't seem to help:
root = administrator admin

> - Can you show me your smb.conf (global and the share config)

[global]
netbios name = samba02
workgroup = ETI
realm = XMEN.ETI
security = ads
idmap config * : range = 16777216-33554431
template homedir = /home/%U
template shell = /bin/bash
winbind use default domain = true
winbind offline logon = false
winbind enum users = yes
winbind enum groups = yes
encrypt passwords = yes

# Added for ACL Support
vfs objects = acl_xattr
map acl inherit = Yes
store dos attributes = Yes

[etifiles]
path = /samba/etifiles
read only = no

I'll admit I'm not too sure about the idmap config. I'm looking for the
simplist configuration that will work. The wiki for setting up member
server suggests some different idmap config options, but it references
schema mode rfc2307 and I don't think I have that.

Thanks,
Brian

[Rowland Penny]

Hi, with the above, samba has nowhere to map the users to, if you don't
want to use the 'ad' backend, then you need to use the rid backend:

idmap config *:backend = tdb
idmap config *:range = 70001-80000
idmap config ETI:backend = rid
idmap config ETI:range = 500-40000

Changing the numbers to match your requirements.

> # Added for ACL Support
> vfs objects = acl_xattr
> map acl inherit = Yes
> store dos attributes = Yes
>
> [etifiles]
> path = /samba/etifiles
> read only = no
>
> I'll admit I'm not too sure about the idmap config. I'm looking for
> the simplist configuration that will work. The wiki for setting up
> member server suggests some different idmap config options, but it
> references schema mode rfc2307 and I don't think I have that.
>

If you are using samba4 as the AD DC, then you do have rfc2307, but you
will need to give yours users a uidNumber and your groups a gidNumber.
Information about this is available on the samba wiki and elsewhere on
the internet.

Rowland

[Brian C. Huffman]

On 09/25/2014 01:20 PM, Rowland Penny wrote:
> On 25/09/14 17:58, Brian C. Huffman wrote:
>> [global]
>> netbios name = samba02
>> workgroup = ETI
>> realm = XMEN.ETI
>> security = ads
>> idmap config * : range = 16777216-33554431
>> template homedir = /home/%U
>> template shell = /bin/bash
>> winbind use default domain = true
>> winbind offline logon = false
>> winbind enum users = yes
>> winbind enum groups = yes
>> encrypt passwords = yes
>>
>
> Hi, with the above, samba has nowhere to map the users to, if you
> don't want to use the 'ad' backend, then you need to use the rid backend:
>
> idmap config *:backend = tdb
> idmap config *:range = 70001-80000
> idmap config ETI:backend = rid
> idmap config ETI:range = 500-40000
>
> Changing the numbers to match your requirements.

I don't plan to add any local linux accounts to this server. With the
exception of possibly the root user (which Marc implied should be mapped
to something), I don't know that I need a mapping as long as the
permissions can be modified and utilized from a windows desktop.

How should the root user be mapped to something (say Administrator)? I
don't see UID 0 mentioned in that range.

>>
>> I'll admit I'm not too sure about the idmap config. I'm looking for
>> the simplist configuration that will work. The wiki for setting up
>> member server suggests some different idmap config options, but it
>> references schema mode rfc2307 and I don't think I have that.
>>
>
> If you are using samba4 as the AD DC, then you do have rfc2307, but
> you will need to give yours users a uidNumber and your groups a
> gidNumber. Information about this is available on the samba wiki and
> elsewhere on the internet.

Ah. Ok. I guess this would be useful if I start running winbind on
other linux machines where users login. Right now I don't have the
uidNumber configured for my users.

[Marc Muehlfeld]

Am 25.09.2014 um 19:29 schrieb Brian C. Huffman:
>> Hi, with the above, samba has nowhere to map the users to, if you
>> don't want to use the 'ad' backend, then you need to use the rid backend:
>>
>> idmap config *:backend = tdb
>> idmap config *:range = 70001-80000
>> idmap config ETI:backend = rid
>> idmap config ETI:range = 500-40000
>>
>> Changing the numbers to match your requirements.
>
> I don't plan to add any local linux accounts to this server.

Samba Domain Members have, like Windows, some built-in accounts/groups,
which require the mappings. E. g.
BUILTIN\Print Operators
BUILTIN\Account Operators
BUILTIN\Backup Operators
BUILTIN\Server Operators
BUILTIN\Administrators
etc.

> With the exception of possibly the root user (which Marc implied
> should be mapped to something), I don't know that I need a mapping as
> long as the permissions can be modified and utilized from a windows
> desktop.

You don't need to map Administrator to root. If your granted
SeDiskOperatorPrivilege to you Administrator account or a group, it
belongs to, it should be enough to edit the permissions. But some do
that mapping and as more information about your configuration we have,
as easier it would be to find out, what's wrong. :-)

But if you have a 'username map' entry, you have to add and enable the
account with smbpasswd -a/-e.

> I'll admit I'm not too sure about the idmap config. I'm looking for
> the simplist configuration that will work. The wiki for setting up
> member server suggests some different idmap config options, but it
> references schema mode rfc2307 and I don't think I have that.

It's still on my to-do list, to write the documentation for the
different Idmap backends. But in the meantime, have a look at the
manpage of 'idmap_rid'. The usage is like for the rfc2307 backend.


Regards,
Marc

[Rowland Penny]

And just how are you going to get the local system to modify the
permissions if it doesn't know who the users/groups are ???

>
> How should the root user be mapped to something (say Administrator)?
> I don't see UID 0 mentioned in that range.
>

You need to create a file, i.e. /etc/samba/smbusers containing this line:

!root = EXAMPLE\Administrator Administrator administrator

then add this line to the global section of smb.conf:

username map = /etc/samba/smbusers

then restart the samba daemons

Rowland

[Davor Vusir]

What happens if one logs on with 'admini...@example.com'?