Re: [Samba] samba group rights problem (Domain Admins not working)
Hello Jeroen,
I just had the same problem you described. The cause of it was, that
the LDAP configuration on my new os (Ubuntu 8.04) included an option
to ignore the root user from LDAP:
nss_initgroups_ignoreusers
backup,bin,daemon,dhcp,games,gnats,irc,klog,libuuid,list,lp,mail,man,mysql,news,openldap,proxy,sshd,statd,sync,sys,syslog,uucp,www-data
in /etc/ldap.conf. I can't remember if it was the stock config file or
if I added it following some howto. However the root user on the
server side was not a member of the 'Domain Admins' group because the
data came from /etc/passwd. I removed root from the ignore list and it
worked.
Just check on your PDC, if the root user is really a member of the
'Domain Admins' group with 'id root' - if not - there's your problem.
Kind regards,
-sd
2008/7/18 Jeroen Vriesman [EMAIL PROTECTED]:
Hi list,
after upgrading our ldap server, the Domain Admins group doesn't work
anymore.
Members of the domain admins group don't have any special rights on the
workstations (for example, they cannot even change the date of a machine in
the
domain anymore).
When I lookup the group members I get:
[EMAIL
PROTECTED]javascript:open_compose_win('to=root%40hermesthismailbox=INBOX.Sent');:/etc/samba#
net rpc group members 'Domain Admins'
Password:
HIVOS.NL\root
HIVOS.NL\foctaaf
HIVOS.NL\lhilarides
HIVOS.NL\administrator
HIVOS.NL\executor
HIVOS.NL\fbodijn
HIVOS.NL\psomer
HIVOS.NL\jvriesman
And the rights of the group:
[EMAIL
PROTECTED]javascript:open_compose_win('to=root%40hermesthismailbox=INBOX.Sent');:/etc/samba#
net rpc rights list 'Domain Admins'
Password:
SeMachineAccountPrivilege
SeRemoteShutdownPrivilege
SePrintOperatorPrivilege
SeAddUsersPrivilege
SeDiskOperatorPrivilege
That seems ok, but when I lookup the rights of a member of the Domain Admins
group:
[EMAIL
PROTECTED]javascript:open_compose_win('to=root%40hermesthismailbox=INBOX.Sent');:/etc/samba#
net rpc rights list 'HIVOS.NL\jvriesman'
Password:
SeAddUsersPrivilege
[EMAIL
PROTECTED]javascript:open_compose_win('to=root%40hermesthismailbox=INBOX.Sent');:/etc/samba#
net rpc rights list 'HIVOS.NL\psomer'
Password:
nothing here
Any idea why members of the Domain Admin group do not get the rights of the
group?
cheers,
Jeroen.
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] samba group rights problem (Domain Admins not working)
Thanks Stefan, this fix my problem which was described here http://article.gmane.org/gmane.network.samba.general/99631 and here http://article.gmane.org/gmane.network.samba.general/99649 too. On Thu, Jul 24, 2008 at 1:27 PM, Stefan Dengscherz [EMAIL PROTECTED] wrote: Hello Jeroen, I just had the same problem you described. The cause of it was, that the LDAP configuration on my new os (Ubuntu 8.04) included an option to ignore the root user from LDAP: nss_initgroups_ignoreusers backup,bin,daemon,dhcp,games,gnats,irc,klog,libuuid,list,lp,mail,man,mysql,news,openldap,proxy,sshd,statd,sync,sys,syslog,uucp,www-data in /etc/ldap.conf. I can't remember if it was the stock config file or if I added it following some howto. However the root user on the server side was not a member of the 'Domain Admins' group because the data came from /etc/passwd. I removed root from the ignore list and it worked. Just check on your PDC, if the root user is really a member of the 'Domain Admins' group with 'id root' - if not - there's your problem. Kind regards, -sd -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] samba group rights problem (Domain Admins not working)
Hi, my root is a member of the Domain Admins: [EMAIL PROTECTED]:/etc/ldap# id root uid=0(root) gid=0(root) groups=0(root),513(Domain Users),1013(Apps),1016(Application RelaX),1017(Terminal Server Users),1112(Applications),1120(Application Aura),512(Domain Admins) [EMAIL PROTECTED]:/etc/ldap# net rpc user info root Password: Domain Users Domain Admins Apps Application RelaX Terminal Server Users Applications Application Aura [EMAIL PROTECTED]:/etc/ldap# net rpc rights list root Password: no output but still doesn't get the rights from the domain admins groups: net groupmap list: . Domain Admins (S-1-5-21-2651798370-710026074-3531216960-512) - Domain Admins . I will try ldap debug later today. On Thu, Jul 24, 2008 at 11:14 AM, Thuan Tran [EMAIL PROTECTED] wrote: Thanks Stefan, this fix my problem which was described here http://article.gmane.org/gmane.network.samba.general/99631 and here http://article.gmane.org/gmane.network.samba.general/99649 too. On Thu, Jul 24, 2008 at 1:27 PM, Stefan Dengscherz [EMAIL PROTECTED] wrote: Hello Jeroen, I just had the same problem you described. The cause of it was, that the LDAP configuration on my new os (Ubuntu 8.04) included an option to ignore the root user from LDAP: nss_initgroups_ignoreusers backup,bin,daemon,dhcp,games,gnats,irc,klog,libuuid,list,lp,mail,man,mysql,news,openldap,proxy,sshd,statd,sync,sys,syslog,uucp,www-data in /etc/ldap.conf. I can't remember if it was the stock config file or if I added it following some howto. However the root user on the server side was not a member of the 'Domain Admins' group because the data came from /etc/passwd. I removed root from the ignore list and it worked. Just check on your PDC, if the root user is really a member of the 'Domain Admins' group with 'id root' - if not - there's your problem. Kind regards, -sd -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] samba group rights problem (Domain Admins not working)
Could you please post your config files (/etc/samba/smb.conf, /etc/ldap.conf, /etc/ldap/slapd.conf, /etc/smbldap-tools/smbldap.conf, smbldap_bind.conf)? Try to set loglevel 256 in slapd.conf and log level = 10 in smb.conf, and check messages in syslog while logging in as an administrative user. There should be at least one error message in the log, which will tell you what causes this strange problem. 2008/7/23 Jeroen Vriesman [EMAIL PROTECTED]: Thanks for the reply, I did check that, I should have posted that in the original mail. The group ends with -512, and, has gid 512, my 'administrator' account is called root, but this is about the members of the 'Domain Admins group, the group maps to 'Domain Admins' (I use pam/nssldap config, where 'getent group' shows all the ldap groups as local groups, so the map is ok by default). Before the ldap upgrade it worked, and the ldap data is exactly the same. So I'm a bit lost, I do have the schema with sambaSID SUB and a sub index on sambaSID, the schema's are also the same as in the old situation. cheers, Jeroen. On Tue, Jul 22, 2008 at 8:02 PM, kissg [EMAIL PROTECTED] wrote: Check the GID of your Domain Admins group. It should end with 512 and should be mapped to a UNIX group which have a GID of the same value. If it's anything else, that can be a reason why your admin users actually don't have administrator rights on the client machines. Run the following command to see how your group mappings look like: net groupmap list You should see the number 512 at the end of the Domain Admins SID. After you have verified, that your Domain Admins group has the appropriate SID, check the UID and GID of an administrative user, for example: id administrator You should see gid=512 in the output of the command. Regards Gergely Kiss 2008/7/22 Jeroen Vriesman [EMAIL PROTECTED]: Hi list, after upgrading our ldap server, the Domain Admins group doesn't work anymore. Members of the domain admins group don't have any special rights on the workstations (for example, they cannot even change the date of a machine in the domain anymore). When I lookup the group members I get: [EMAIL PROTECTED]:/etc/samba# net rpc group members 'Domain Admins' Password: HIVOS.NL\root HIVOS.NL\foctaaf HIVOS.NL\lhilarides HIVOS.NL\administrator HIVOS.NL\executor HIVOS.NL\fbodijn HIVOS.NL\psomer HIVOS.NL\jvriesman And the rights of the group: [EMAIL PROTECTED]:/etc/samba# net rpc rights list 'Domain Admins' Password: SeMachineAccountPrivilege SeRemoteShutdownPrivilege SePrintOperatorPrivilege SeAddUsersPrivilege SeDiskOperatorPrivilege That seems ok, but when I lookup the rights of a member of the Domain Admins group: [EMAIL PROTECTED]:/etc/samba# net rpc rights list 'HIVOS.NL\jvriesman' Password: SeAddUsersPrivilege [EMAIL PROTECTED]:/etc/samba# net rpc rights list 'HIVOS.NL\psomer' Password: nothing here Any idea why members of the Domain Admin group do not get the rights of the group? cheers, Jeroen. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] samba group rights problem (Domain Admins not working)
By the way, it can be a bug in the new version of OpenLDAP, or a permission problem (Samba is unable to read a required attribute etc.). Check the OpenLDAP list, or post a bugreport, if you haven't already done so. 2008/7/23 Jeroen Vriesman [EMAIL PROTECTED]: Thanks for the reply, I did check that, I should have posted that in the original mail. The group ends with -512, and, has gid 512, my 'administrator' account is called root, but this is about the members of the 'Domain Admins group, the group maps to 'Domain Admins' (I use pam/nssldap config, where 'getent group' shows all the ldap groups as local groups, so the map is ok by default). Before the ldap upgrade it worked, and the ldap data is exactly the same. So I'm a bit lost, I do have the schema with sambaSID SUB and a sub index on sambaSID, the schema's are also the same as in the old situation. cheers, Jeroen. On Tue, Jul 22, 2008 at 8:02 PM, kissg [EMAIL PROTECTED] wrote: Check the GID of your Domain Admins group. It should end with 512 and should be mapped to a UNIX group which have a GID of the same value. If it's anything else, that can be a reason why your admin users actually don't have administrator rights on the client machines. Run the following command to see how your group mappings look like: net groupmap list You should see the number 512 at the end of the Domain Admins SID. After you have verified, that your Domain Admins group has the appropriate SID, check the UID and GID of an administrative user, for example: id administrator You should see gid=512 in the output of the command. Regards Gergely Kiss 2008/7/22 Jeroen Vriesman [EMAIL PROTECTED]: Hi list, after upgrading our ldap server, the Domain Admins group doesn't work anymore. Members of the domain admins group don't have any special rights on the workstations (for example, they cannot even change the date of a machine in the domain anymore). When I lookup the group members I get: [EMAIL PROTECTED]:/etc/samba# net rpc group members 'Domain Admins' Password: HIVOS.NL\root HIVOS.NL\foctaaf HIVOS.NL\lhilarides HIVOS.NL\administrator HIVOS.NL\executor HIVOS.NL\fbodijn HIVOS.NL\psomer HIVOS.NL\jvriesman And the rights of the group: [EMAIL PROTECTED]:/etc/samba# net rpc rights list 'Domain Admins' Password: SeMachineAccountPrivilege SeRemoteShutdownPrivilege SePrintOperatorPrivilege SeAddUsersPrivilege SeDiskOperatorPrivilege That seems ok, but when I lookup the rights of a member of the Domain Admins group: [EMAIL PROTECTED]:/etc/samba# net rpc rights list 'HIVOS.NL\jvriesman' Password: SeAddUsersPrivilege [EMAIL PROTECTED]:/etc/samba# net rpc rights list 'HIVOS.NL\psomer' Password: nothing here Any idea why members of the Domain Admin group do not get the rights of the group? cheers, Jeroen. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] samba group rights problem (Domain Admins not working)
Check the GID of your Domain Admins group. It should end with 512 and should be mapped to a UNIX group which have a GID of the same value. If it's anything else, that can be a reason why your admin users actually don't have administrator rights on the client machines. Run the following command to see how your group mappings look like: net groupmap list You should see the number 512 at the end of the Domain Admins SID. After you have verified, that your Domain Admins group has the appropriate SID, check the UID and GID of an administrative user, for example: id administrator You should see gid=512 in the output of the command. Regards Gergely Kiss 2008/7/22 Jeroen Vriesman [EMAIL PROTECTED]: Hi list, after upgrading our ldap server, the Domain Admins group doesn't work anymore. Members of the domain admins group don't have any special rights on the workstations (for example, they cannot even change the date of a machine in the domain anymore). When I lookup the group members I get: [EMAIL PROTECTED]:/etc/samba# net rpc group members 'Domain Admins' Password: HIVOS.NL\root HIVOS.NL\foctaaf HIVOS.NL\lhilarides HIVOS.NL\administrator HIVOS.NL\executor HIVOS.NL\fbodijn HIVOS.NL\psomer HIVOS.NL\jvriesman And the rights of the group: [EMAIL PROTECTED]:/etc/samba# net rpc rights list 'Domain Admins' Password: SeMachineAccountPrivilege SeRemoteShutdownPrivilege SePrintOperatorPrivilege SeAddUsersPrivilege SeDiskOperatorPrivilege That seems ok, but when I lookup the rights of a member of the Domain Admins group: [EMAIL PROTECTED]:/etc/samba# net rpc rights list 'HIVOS.NL\jvriesman' Password: SeAddUsersPrivilege [EMAIL PROTECTED]:/etc/samba# net rpc rights list 'HIVOS.NL\psomer' Password: nothing here Any idea why members of the Domain Admin group do not get the rights of the group? cheers, Jeroen. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
