[Samba] File Server recognize users and groups AD

[Ricardo Pardim Claus]

Dear,
I'm having trouble Samba recognizes the permissions assigned to groups and users created in AD.
Scenario:

DC1 = Primary DC
DC2 = secondary DC + file server

Both running the 4.4.5 version of Samba (Centos 7).

When I add permissions to a folder using a Windows desktop, I get to set permission for AD users and groups.
What do I need to set up the groups and AD users are recognized on the permissions of the Samba?
In the end, I'm trying to see the permissions using the following commands:

getfacl /mnt/data/share

The result is this:


getfacl: Removing leading '/' from absolute path names
# file: mnt/data/share
# owner: 3000000
# group: users
user::rwx
user:3000016:rwx
group::r-x
group:users:r-x
group:3000000:rwx
group:3000016:rwx
mask::rwx
other::r-x
default:user::rwx
default:user:3000000:rwx
default:user:3000016:rwx
default:group::r-x
default:group:users:r-x
default:group:3000016:rwx
default:mask::rwx
default:other::r-x



Follows the smb.conf my DC2 (secondary DC + file server):

# Global parameters
[global]
bind interfaces only = Yes
interfaces = lo eth0
netbios name = SRV15
realm = DOMAIN.LOCAL
server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
workgroup = DOMAIN
server role = active directory domain controller
comment =
log file = /var/log/samba/%m.log
log level = 1
#
# Default idmap config used for BUILTIN and local accounts/groups
idmap config *:backend = tdb
idmap config *:range = 2000-9999

# idmap config for domain DOMAIN
idmap config DOMAIN:backend = ad
idmap config DOMAIN:schema_mode = rfc2307
idmap config DOMAIN:range = 10000-99999

# Use settings from AD for login shell and home directory
winbind nss info = rfc2307

vfs objects = acl_xattr
map acl inherit = Yes
store dos attributes = Yes

[netlogon]
path = /usr/local/samba/var/locks/sysvol/domain.local/scripts
read only = No

[sysvol]
path = /usr/local/samba/var/locks/sysvol
read only = No

[dados]
comment = Share

path = /mnt/data/share
read only = No

browseable = Yes
inherit acls = Yes
inherit permissions = Yes



When I try to set a permission:

setfacl -R -m default: group: "Domain Admins": rwx /mnt/data/share
setfacl: Option -m: Argument invalid character near 15

[Ricardo Pardim Claus]

Sorry, but the lines you have added to the [global] section of
your smb.conf will do nothing on an AD DC.
Does 'getent group Domain\ Admins' produce any output ?
If not you need to set up libnss-winbind.
Rowland

Dear Rowland;
I appreciate the contact.

The commands:
getent group 'DOMAIN\Domain Admins'
getent group 'Domain Admins'

Return nothing!

When I run only this command: getent group
It returns only Unix / Linux groups

Regarding Smb.conf could show me what needs to be changed?
This smb.conf refers to the secondary DC + file server.

About libnss-winbind, could indicate some site so I can do a study?

[Ricardo Pardim Claus]

Dear Rowland

Report that could solve the problem by using your tips.
I modified my smb.conf by adding these lines:

winbind enum users = yes
winbind enum groups = yes

Then I followed the steps indicated on this page:
https://wiki.samba.org/index.php/Libnss_winbind_links

Now yes, when I run the command "getent group "Domain Admins"" or "getent group", I appear all (Unix and Active Directory).

To end this post, I have another doubt. These settings need to be made up at all Samba servers on my network? Or only on the file server?

Rowland,
Here in the forum, if this post I opened when I go to answer any question from you, I answer the email only to the list of Samba or include your email too?

Thank you!