[Samba] configuring Shares, Users with Samba 4.0.5 as an AD DC

[Ulrich Schneider]

Maybe I should rephrase the question (and use a more suitable topic)

I have Samba 4.0.5. as an active domain controller.
I want to know how to set up shares e.g. this way:

share1 accessible r/w for users in the active directory user group group1

share2 accessible read only for users in the active directory user
group group2

Or rephrased again:
Using Samba 4.0.5. as an active domain controller ... there must be a
way how the Windows User from AD is mapped to a unix user / access
rights for a share. Is there a documentation for that?

Thanks for your supprt.

Ulrich Schneider


Am 18.05.2013 09:03, schrieb Ulrich Schneider:
> Dear samba-mailinglist,
>
> We're using samba 4.0.5 as an active directory domain controller.
> We used to set up some file shares on basis security=user in the old
> samba version. I was able to set up the shares as they used to be .
>
> My Question:
> How can I set up "wich user kan read/write which share?"
>
> Do I have to do this in den Active Directory or in smb.conf?
>
> This maybe a trivial question, but I lokked around the manuals a lot and
> found nothing.
>
> smb.conf
>
> [global]
> workgroup = GYM-FEU
> realm = gym-feu.local
> netbios name = SERVER
> server role = active directory domain controller
>
> [netlogon]
> path = /usr/local/samba/var/locks/sysvol/gym-feu.local/scripts
> read only = No
>
> [sysvol]
> path = /usr/local/samba/var/locks/sysvol
> read only = No
>
> [austausch]
> path = /home/samba/austausch
> create mask = 0700
> directory mask = 0700
> force user = schueler
> force group = schueler
> comment = zum freien Austausch
> public = yes
> writeable = yes
>
>
> Ulrich Schneider
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[steve]

On Sat, 2013-05-18 at 12:51 +0200, Ulrich Schneider wrote:
> Maybe I should rephrase the question (and use a more suitable topic)
>
> I have Samba 4.0.5. as an active domain controller.
> I want to know how to set up shares e.g. this way:
>
> share1 accessible r/w for users in the active directory user group group1

You can choose cryptic stuff in smb.conf or go with a 2 liner smb.conf
and use the equally cryptic acl method. The latter is quicker:

[share1]
path = /path/to/share1

setfacl -d -Rm g:group1:rw /path/to/share2

I think that's what smb.conf does anyway but don't quote me.

I'm sure that it can't be as simple as that but it works perfectly
without having to know anything about smb.conf
hth
Steve

[steve]

On Sat, 2013-05-18 at 16:31 +0200, steve wrote:
> On Sat, 2013-05-18 at 12:51 +0200, Ulrich Schneider wrote:
> > Maybe I should rephrase the question (and use a more suitable topic)
> >
> > I have Samba 4.0.5. as an active domain controller.
> > I want to know how to set up shares e.g. this way:
> >
> > share1 accessible r/w for users in the active directory user group group1
>
> You can choose cryptic stuff in smb.conf or go with a 2 liner smb.conf
> and use the equally cryptic acl method. The latter is quicker:
>
> [share1]
> path = /path/to/share1
>
> setfacl -d -Rm g:group1:rw /path/to/share2
>
> I think that's what smb.conf does anyway but don't quote me.
>
> I'm sure that it can't be as simple as that but it works perfectly
> without having to know anything about smb.conf
> hth
> Steve
>

Oh, forgot to say, you need winbind or sssd running on the DC to map AD
users to uid/gid.
Sorry.

[wong lmark]

Hi Steve,

I used "rpm -qa | grep winbind"
I saw that tools are installed in my environment.

- samba-winbind-clients-3.6.9-151.el6.x86_64
- samba-winbind-3.6.9-151.el6.x86_64

Is it I need to install more?




2013/5/18 steve <st...@steve-ss.com>

[Adam Thorn]

Ulrich Schneider <m...@ulrichschneider.de> wrote:

>Maybe I should rephrase the question (and use a more suitable topic)
>
>I have Samba 4.0.5. as an active domain controller.
>I want to know how to set up shares e.g. this way:
>
>share1 accessible r/w for users in the active directory user group
>group1
>

>share2 accessible read only for users in the active directory user
>group group2

You can achieve this by specifying the "valid users" parameter for each share in the smb.conf, which can be set to either specific users or groups. You will, of course, also need to ensure that the "valid users" have suitable permissions on the underlying filesystem as well. See:

http://www.samba.org/samba/docs/using_samba/ch09.html

Adam

[Ulrich Schneider]

OK, I read a lot lot today ... last time I read samba manuals has been a
while ...

so new to me is ... acls in the file system.

so is this correct, I can adapt windows file security settings directly
in windows ... and somehow mysteriously ... same thing is done in the
unix file system?

AWSESOME !!!!

Ulrich Schneider

[Adam Thorn]

Ulrich Schneider <m...@ulrichschneider.de> wrote:

>OK, I read a lot lot today ... last time I read samba manuals has been
>a
>while ...
>
>so new to me is ... acls in the file system.
>
>so is this correct, I can adapt windows file security settings directly
>
>in windows ... and somehow mysteriously ... same thing is done in the
>unix file system?

You began by asking about restricting access to shares, which is what the "valid users" option is for. That's compeletly independent of filesystem ACLs - it is, for example, entirely possible to permit all users access to a samba share, but set the filesystem permissions to deny read access (in which case a user can connect, but cannot see any files). The "valid users" setting is the same thing as saying in Windows "share this folder with..."

If you want to do more complex things with ACLs (like using the Windows security dialog box), you also need to set "nt acl support=yes" in the samba share config. That will only be useful if the filesystem you are sharing via samba supports ACLs, of course! I suggest looking at documentation on the getfacl and setfacl commands.

[steve]

On Sat, 2013-05-18 at 22:40 +0200, Ulrich Schneider wrote:
> OK, I read a lot lot today ... last time I read samba manuals has been a
> while ...
>
> so new to me is ... acls in the file system.
>
> so is this correct, I can adapt windows file security settings directly
> in windows ... and somehow mysteriously ... same thing is done in the
> unix file system?
>

> AWSESOME !!!!

Hi
I wonder if it is awesome. Do we _have_ to set:
valid users = @group
in smb.conf?
Can't we use setfacl and permissions on the folder instead? It works
fine without writing anything under the share in smb.conf. I must admit
to suffering smb.conf phobia.
Cheers

[steve]

On Sat, 2013-05-18 at 22:24 +0100, Adam Thorn wrote:


> If you want to do more complex things with ACLs (like using the Windows security dialog box), you also need to set "nt acl support=yes" in the samba share config.

Hi
Do we have to set nt acl support= yes? On our 4.0.6 git install it's the
default.

[wong lmark]

If I just need to migrate the Samba 3 to samba 4 without the bind, what
command should I use?
Is it also "/usr/local/samba/bin/samba-tool domain classicupgrade
/etc/samba/smb.conf --dbdir=/var/lib/samba/ --use-xattrs=yes --realm=
TEST.COM"?

2013/5/19 steve <st...@steve-ss.com>

[Ulrich Schneider]

Hm, your alternative (understanding windows acls) seems not much better
to me.

Yesterday it seemed to work ... until I deleted a folder created by an
administrator as a ordinary user.

Do I get this right? valid users = @group ... so @group could be any
group in the Active Directory?

> Hi
> I wonder if it is awesome. Do we _have_ to set:
> valid users = @group
> in smb.conf?
> Can't we use setfacl and permissions on the folder instead? It works
> fine without writing anything under the share in smb.conf. I must admit
> to suffering smb.conf phobia.

[steve]

On Sun, 2013-05-19 at 09:14 +0200, Ulrich Schneider wrote:
> Hm, your alternative (understanding windows acls) seems not much better
> to me.
>
> Yesterday it seemed to work ... until I deleted a folder created by an
> administrator as a ordinary user.
>
> Do I get this right? valid users = @group ... so @group could be any
> group in the Active Directory?

Hi

Oh no, I'm certain it's no better. I favour it because I've wasted so
much time trying to understand what the smb.conf 'something = <value>'
syntax does in Linux terms. It struck me one day that what those options
are doing are altering the acl's on the shares.

As far as I can see, the windows administrator creates files as:
Administrator: Domain\ Users
If there is group rw on the share where he created the file then any
user in Domain\ Users (all users by default) would be able to delete it.

I made the mistake in believing that the domain admin on windows was
like root on Linux. Nope.
Cheers,
Steve

[steve]

On Sun, 2013-05-19 at 16:27 +0800, wong lmark wrote:
> Please let me simplify the question. I chose the in place upgrade
> Samba 3 to Samba 4 in my CentOS 6.4.

Hi
Ok, so this Domain has been produced by:

/usr/local/samba/bin/samba-tool domain
classicupgrade /etc/samba/smb.conf --dbdir=/var/lib/samba/
--use-xattrs=yes --realm=TEST.COM

And this is the log for the first run when you typed samba:

> Firstly, I used "/usr/local/samba/bin/smbclient -L localhost -U%" and
> got a message "Connection to localhost failed (Error
> NT_STATUS_CONNECTION_REFUSED)".
> I read the log.samba and got the error :
>
> [2013/05/19 15:27:41,
> 0] ../source4/smbd/server.c:369(binary_smbd_main)
> samba version 4.0.5 started.
> Copyright Andrew Tridgell and the Samba Team 1992-2012
> [2013/05/19 15:27:41,
> 0] ../source4/smbd/server.c:475(binary_smbd_main)
> samba: using 'standard' process model
> [2013/05/19 15:27:41,
> 0] ../source4/lib/tls/tlscert.c:70(tls_cert_generate)
> Attempting to autogenerate TLS self-signed keys for https for
> hostname 'SAM.test.com'
> [2013/05/19 15:27:41,
> 0] ../source4/lib/tls/tlscert.c:166(tls_cert_generate)
> TLS self-signed keys generated OK
> [2013/05/19 15:27:43,
> 0] ../source4/smbd/service_stream.c:342(stream_setup_socket)
> Failed to listen on 0.0.0.0:389 -
> NT_STATUS_ADDRESS_ALREADY_ASSOCIATED
> [2013/05/19 15:27:43,
> 0] ../source4/ldap_server/ldap_server.c:821(add_socket)
> ldapsrv failed to bind to 0.0.0.0:389 -
> NT_STATUS_ADDRESS_ALREADY_ASSOCIATED
> [2013/05/19 15:27:43,
> 0] ../source4/smbd/service_task.c:35(task_server_terminate)
> task_server_terminate: [Failed to startup ldap server task]
> [2013/05/19 15:27:43,
> 0] ../source4/smbd/server.c:210(samba_terminate)
> samba_terminate: Failed to startup ldap server task
> [2013/05/19 15:39:06,
> 0] ../file_server/file_server.c:47(file_server_smbd_done)
> file_server smbd daemon exited normally
> [2013/05/19 15:39:06,
> 0] ../source4/smbd/service_task.c:35(task_server_terminate)
> task_server_terminate: [smbd child process exited]
>
>
> Second, I used "kinit Administrator" or "kinit root", the message is
> shown "kinit: Cannot resolve servers for KDC in realm "Test.com" while
> getting initial credentials"
>
>
> How can I solve that?

I'd go for DNS.
A good start is /etc/hosts. Is there an entry for sam.test.com?
What does /etc/krb5.conf contain?

[Ulrich Schneider]

Looks to me like "valid users" is not working.
I get a popup windows with username/pwd when accessing the shares.

Or is there an error in smb.conf?

Is this correct? ...
valid users = @samdom+schueler
... meaning
windows group schueler
windows domain samdom
---------------------------------------------------------------
# Global parameters
[global]
workgroup = SAMDOM
realm = SAMDOM.EXAMPLE.COM
netbios name = ULI-SD30V10

server role = active directory domain controller

dns forwarder = 192.168.25.254

[netlogon]
path = /usr/local/samba/var/locks/sysvol/samdom.example.com/scripts

read only = No

[sysvol]
path = /usr/local/samba/var/locks/sysvol
read only = No

[schueler]
path = /data/schueler
comment = Schueler
read only = no
valid users = @samdom+schueler

[lehrer]
path = /data/lehrer
comment = Lehrer
read only = no
valid users = @samdom+lehrer

---------------------------------------------------------------
uli@uli-sd30v10:/data$ wbinfo -u
uli@uli-sd30v10:/data$ wbinfo -g
uli@uli-sd30v10:/data$ ls -la
insgesamt 16
drwxrwxrwx 4 root root 4096 Mai 19 10:10 .
drwxr-xr-x 25 root root 4096 Mai 18 15:20 ..
drwxrwxrwx 2 uli uli 4096 Mai 19 10:10 lehrer
drwxrwxrwx 2 uli uli 4096 Mai 19 10:10 schueler

[steve]

On Sun, 2013-05-19 at 11:30 +0200, Ulrich Schneider wrote:
> Looks to me like "valid users" is not working.

> valid users = @samdom+schueler
>
> [lehrer]
> path = /data/lehrer
> comment = Lehrer
> read only = no
> valid users = @samdom+lehrer

Hi
samdom is a domain
I don't understand. wbinfo lists no users r groups. Do you want everyone
in the domain to have access?

This would make sense:
valid users = @uli+someone-else

What do you have in /etc/nsswitch.conf?

One of the reasons I run away from smb.conf!
Steve

[Ulrich Schneider]

I don't have a clue ... just want to make samba and windows ad work

uli@uli-sd30v10:/data$ net ads join -U Administrator
Host is not configured as a member server.
Invalid configuration. Exiting....
Failed to join domain: This operation is only allowed for the PDC of the
domain.
uli@uli-sd30v10:/data$ cat /etc/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd: compat
group: compat
shadow: compat

hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
networks: files

protocols: db files
services: db files
ethers: db files
rpc: db files

netgroup: nis
uli@uli-sd30v10:/data$

[wong lmark]

I read a article "http://www.smilingsouls.net/blog/linux/ad_integration.html
"
Just for reference.


2013/5/19 Ulrich Schneider <m...@ulrichschneider.de>

> instructions: https://lists.samba.org/**mailman/options/samba<https://lists.samba.org/mailman/options/samba>

[steve]

Hi
Try winbind:

/etc/nsswitch.conf
passwd: files winbind
group: files winbind

ln -s /usr/local/samba/lib/libnss_winbind.so.2 /lib/libnss_winbind.so
ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2

ln -s /usr/local/samba/lib/pam_winbind.so /lib/security

Does getent passwd return any AD users?

[steve]

On Sun, 2013-05-19 at 18:02 +0800, wong lmark wrote:
> I read a article "http://www.smilingsouls.net/blog/linux/ad_integration.html
> "
> Just for reference.

Hi
That's for joining a Linux client to an already configured DC. BTW it's
strange. He configures nss-ldap and then uses winbind!
Steve

[wong lmark]

Haha, I am not sure that.
May I ask a question? Is it the DNS need to take some configuration after
classupgrade?

2013/5/19 steve <st...@steve-ss.com>

[steve]

On Sun, 2013-05-19 at 18:18 +0800, wong lmark wrote:
> Haha, I am not sure that.
> May I ask a question? Is it the DNS need to take some configuration
> after classupgrade?

No, but make sure that none of the old dns, ldap, smb nor nmb are
running before you call samba.

Did you get a chance to check dns as per the wiki (link in the other
post)?

[wong lmark]

Yes, but I never see a dns folder in my samba/private/
I still finding out the problems,

2013/5/19 steve <st...@steve-ss.com>

[steve]

On Sun, 2013-05-19 at 20:10 +0800, wong lmark wrote:
> No. I am not sure that where is the dns reconds store in Samba4.
> But I have not install bind before upgrade.

You can see them:
samba-tool dns query <server> <zone> <name> <A|AAAA|CNAME|MX|NS|SOA|SRV|
TXT|ALL> [options]

[Ulrich Schneider]

I created two folders as different win users in a samba share.

1. Folder is testadmin created as user Domain Administrator
2. Folder is testschueler2 created as user schueler2

ls -la

drwxrwxr-x+ 2 3000000 users 4096 Mai 20 09:57 testadmin
drwxrwxr-x+ 2 3000026 users 4096 Mai 20 09:59 testschueler2

What`s that number starting wird 3... and how do I know that this number
belongs to wich user?

Uli

[Thierry Gonon]

Hello Ulrich,

It's simply the uid (user id) that are given by samba.
You should have a command to find who ius which number, but I don't know it yet (I'm new to samba too !!)

Thierry Gonon
Archéologue - Administrateur Systèmes et Réseaux
Responsable Informatique
Chronoterre Archéologie

----- Mail original -----
De: "Ulrich Schneider" <m...@ulrichschneider.de>
À: sa...@lists.samba.org
Envoyé: Lundi 20 Mai 2013 10:03:25
Objet: Re: [Samba] configuring Shares, Users with Samba 4.0.5 as an AD DC

[Ulrich Schneider]

let me rephrase:

what do I have to do/install to make this ...
valid users = @Domain\Group (windows domain / group)
.. work

[Pekka L.J. Jalkanen]

Hi Thierry,

that command is called "wbinfo". For details, run "wbinfo --help". Some
examples below:

To find the Windows sid of an uid, run:
"wbinfo -U 3000000" (or any other uid).

That sid can in turn be used to find the username:
"wbinfo -s S-1-5-32-544"

So if you want to combine the whole thing into one, just run:

"wbinfo -s `wbinfo -U 3000000`"

Which should output something like:

"BUILTIN\Administrators 4"

The number following the username just tells how many Windows users or
groups are represented by that uid, if I'm understanding it correctly.

For reversed direction (to get the uid from username), try:

"wbinfo -S `wbinfo -n Administrator`"

Although in most cases you should be able to just run "getent passwd
username" to find the uid, whether the account is a windows account or not.

Pekka L.J. Jalkanen

[Thierry Gonon]

Thanks Pekka !!

Thierry Gonon
Archéologue - Administrateur Systèmes et Réseaux
Responsable Informatique
Chronoterre Archéologie

----- Mail original -----
De: "Pekka L.J. Jalkanen" <pekka.j...@vihreat.fi>
À: sa...@lists.samba.org
Envoyé: Lundi 20 Mai 2013 10:50:29

[Ulrich Schneider]

> Hi
> Try winbind:
>
> /etc/nsswitch.conf
> passwd: files winbind
> group: files winbind
>
> ln -s /usr/local/samba/lib/libnss_winbind.so.2 /lib/libnss_winbind.so
> ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2
>
> ln -s /usr/local/samba/lib/pam_winbind.so /lib/security
>
> Does getent passwd return any AD users?

No!

I#ve done the changes like you suggested above ...
Still getting the following output:

uli@uli-sd30v10:/usr/local/samba/etc$ wbinfo -u
uli@uli-sd30v10:/usr/local/samba/etc$ sudo net rpc join -U Administrator
cannot join as standalone machine
uli@uli-sd30v10:/usr/local/samba/etc$ sudo net ads join -U Administrator

Host is not configured as a member server.
Invalid configuration. Exiting....
Failed to join domain: This operation is only allowed for the PDC of the
domain.

uli@uli-sd30v10:/usr/local/samba/etc$

[Ulrich Schneider]

Getting the error message ... raised the following question ... is it
not possible to run samba as an avtive directory domain controller and
use winbind/wbinfo at the same time?

uli@uli-sd30v10:/data$ sudo /usr/local/samba/sbin/samba -i -M single

samba version 4.0.5 started.
Copyright Andrew Tridgell and the Samba Team 1992-2012

At this time the 'samba' binary should only be used for either:
'server role = active directory domain controller' or to access the
ntvfs file server with 'server services = +smb' or the rpc proxy with
'dcerpc endpoint servers = remote'
You should start smbd/nmbd/winbindd instead for domain member and
standalone file server tasks
uli@uli-sd30v10:/data$

[Rowland Penny]

Hi, I think your problem may be that you are are trying to run the
standalone winbind daemon at the same time as the samba deamon, you cannot
do this, the samba daemon has its own built in winbind.

Could you please confirm how you provisioned samba4, post a sanitized
version of your smb.conf and explain just what you are hoping to achieve.

Rowland

[Ulrich Schneider]

> Could you please confirm how you provisioned samba4, post a sanitized
> version of your smb.conf and explain just what you are hoping to achieve.

Ok, I will do that.

I want to use samba4
1. as an active directory domain controller
2. as a file server providing diefferent shares for different windows
users/groups.

To do so I used the samba provision script to set up samba as AD DC.
Works fine.

Then I read about restrctioning shares to win users/groups with:
valid users = @SAMDOM\SCHUELER

This is not working. When a user in the win group SCHUELER is accessing
a share he gets a popup window with username /password saying that the
acces was denied to this share.

smb.conf

# Global parameters
[global]
workgroup = SAMDOM
realm = SAMDOM.EXAMPLE.COM
netbios name = ULI-SD30V10

server role = active directory domain controller

dns forwarder = 192.168.25.254

# security = ads
password server = 192.168.25.133
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
winbind cache time = 10
winbind use default domain = yes

[netlogon]
path = /usr/local/samba/var/locks/sysvol/samdom.example.com/scripts
read only = No

[sysvol]
path = /usr/local/samba/var/locks/sysvol
read only = No

[schueler]
path = /data/schueler
comment = Schueler

read only = no
valid users = @SAMDOM\SCHUELER

[Rowland Penny]

Hi, Remove all of this:

# security = ads
password server = 192.168.25.133
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
winbind cache time = 10
winbind use default domain = yes

Then remove this line:

valid users = @SAMDOM\SCHUELER

restart samba4

Go here:
http://linuxcostablanca.blogspot.co.uk/2013/04/sssd-in-samba-40.html

Install sssd refering to the above link

Then browse google for using ACL.s with samba4, this usually just entails
adding 'acl, xattr' to the relevant line in your /etc/fstab

Then set the access from a windows pc

Forget winbind, it sucks, Samba4 winbind != Samba3 winbind, samba4 winbind
!= complete

Note that this is just my own opinion.

Rowland

> path = /usr/local/samba/var/locks/**sysvol/samdom.example.com/**
> scripts <http://samdom.example.com/scripts>

> read only = No
>
> [sysvol]

> path = /usr/local/samba/var/locks/**sysvol

> read only = No
>
> [schueler]
> path = /data/schueler
> comment = Schueler
> read only = no
> valid users = @SAMDOM\SCHUELER
> --
> To unsubscribe from this list go to the following URL and read the

> instructions: https://lists.samba.org/**mailman/options/samba<https://lists.samba.org/mailman/options/samba>