X-Recipient:	archive-cygwin AT delorie DOT com
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.1 sourceware.org 6F5FE385801F
Authentication-Results:	sourceware.org;
	dmarc=none (p=none dis=none) header.from=house.org
Authentication-Results:	sourceware.org; spf=pass smtp.mailfrom=house.org
X-Virus-Scanned:	Debian amavisd-new at emo01-pco.easydns.vpn
Mime-Version:	1.0 (Mac OS X Mail 6.2 \(1499\))
Subject:	Re: Help with standalone samba SID-uid mapping
From:	Chris Roehrig <croehrig AT house DOT org>
In-Reply-To:	<YeVbW7iqmn6LfDb9@calimero.vinschen.de>
Date:	Mon, 17 Jan 2022 11:53:21 -0800
Message-Id:	<402C8A93-4EE5-445A-B12A-5BF85D1EEB72@house.org>
References:	<064846E1-8D6D-41D2-97D9-4C3793502CEE AT house DOT org>
	<YeFKleBRwCZcikxb AT calimero DOT vinschen DOT de>
	<7BA06F03-FCFA-492E-898F-F423F03E15F6 AT house DOT org>
	<YeVbW7iqmn6LfDb9 AT calimero DOT vinschen DOT de>
To:	cygwin AT cygwin DOT com
X-Mailer:	Apple Mail (2.1499)
X-Spam-Status:	No, score=-2.0 required=5.0 tests=BAYES_00, KAM_DMARC_STATUS,
	SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4
X-Spam-Checker-Version:	SpamAssassin 3.4.4 (2020-01-24) on
	server2.sourceware.org
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.29
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe:	<https://cygwin.com/mailman/options/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
Errors-To:	cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender:	"Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

On Mon Jan 17 2022, at 4:04 AM, Corinna Vinschen <corinna-cygwin AT cygwin DOT com> wrote:

> On Jan 14 11:57, Chris Roehrig wrote:
>> On Fri Jan 14 2022, at 2:04 AM, Corinna Vinschen <corinna-cygwin AT cygwin DOT com> wrote:
>>> These look like your standard Windows SIDs, so they are your SIDs for
>>> users cristina and croehrig on Windows.  They should show up as such in
>>> ls -l output, unless the SID is actuall wrong, e. g., they map to your
>>> accounts on another machine or something like that.
>> 
>> No those are the SIDs supplied by the Samba server (see below for my local Windows SIDs).   Here they are directly on the Linux machine:
>> housesrv[11]% smbcacls --numeric //housesrv/Users croehrig
>> Enter WORKGROUP\croehrig's password: 
>> REVISION:1
>> CONTROL:0x9004
>> OWNER:S-1-5-21-751087815-2087572193-42305691-1000
>> GROUP:S-1-22-2-601
>> ACL:S-1-5-21-751087815-2087572193-42305691-1000:0/0x0/0x001f01ff
>> ACL:S-1-22-2-601:0/0x0/0x001200a9
>> ACL:S-1-1-0:0/0x0/0x001200a9
>> 
>> (I think that Samba now uses a more complex IDMAP algorithm than when
>> the Cygwin document above was written and now provides a full domain
>> component to its SIDs.)
> 
> That may be so, but in my installation, Samba reports the Unix User ID
> as owner, i. e.
> 
>  $ icacls \\\\server\\corinna\\foo
>  \\server\corinna\foo S-1-22-1-500:(R,W,D,WDAC,WO)
>                       S-1-22-2-11125:(R)
>                       Everyone:(R)
> 
> and that's with Samba 4.15.3.  I'm doing the mapping via the AD
> uidNumber and gidNumber fields.  I'm using this setup for so long that I
> don't remember if I ever saw a "normal", Windows-like SID for the user
> returned by Samba.  I never ran winbindd, up until Samba 4.15.3, which
> was the first one forcing me to do so when using AD support.

I'm no Samba expert, but maybe your /var/lib/samba/private/secrets.tdb file predates that IDMAP change...?
What does 'net getdomainsid' say on your samba host?
housesrv[2]% sudo net getdomainsid
SID for local machine HOUSESRV is: S-1-5-21-751087815-2087572193-42305691
SID for domain WORKGROUP is: S-1-5-21-..........


> 
>> I just added those SIDs to  /etc/passwd and /etc/groups (double
>> entries now) and it now works for the user, but (oddly) not the group:
>> 
>> tyto[6]% ls -l //housesrv/Users/				## NB: this is a UNC path to the samba share
>> total 0
>> drwxr-xr-x 1 cristina Unix_Group+603 0 Jan 12 16:06 cristina
>> drwxr-xr-x 1 croehrig Unix_Group+601 0 Jan 14 09:18 croehrig
>> [...]
>> tyto[10]% cat /etc/group
>> croehrig:S-1-22-2-601:601:
>> cristina:S-1-22-2-603:603:
>> croehrig:S-1-5-21-1290748074-662758565-4273641972-1006:601:
>> cristina:S-1-5-21-1290748074-662758565-4273641972-1008:603:
> 
> Hmm, that's weird.  I just tried this myself.  First I created a stock
> /etc/group file with all local and AD accounts.  Next I changed
> /etc/nsswitch.conf:
> 
>  - group: db
>  + group: files
> 
> Exit/restart Cygwin. `ls -l' now prints
> 
>  -rw-r--r-- 1 corinna Unknown+Group 13342 Jan 17 10:46 //calimero/corinna/foo
> 
> Now I add this line to /etc/group:
> 
>  mygroup:S-1-22-2-11125:11125:
> 
> Exit/restart Cygwin.  Now `ls -l' prints
> 
>  -rw-r--r-- 1 corinna mygroup 13342 Jan 17 10:46 //calimero/corinna/foo
> 
> So it works, apparently.  Did you set `group: db' in /etc/nsswitch.conf,
> by any chance?

That did the trick.   My nsswitch.conf was the default (no lines; only comments), but everything works great now once I change it to
group: files
Seems odd that changing it back to 'group: files db' causes the groups to revert to the Unix_Group+601 form (as if the files weren't resolving it satisfactorily).

Thanks for your help looking into this!

[Update:   cygsshd service no longer permits logins (closes connection immediately) when using 'group: files' (but it does work when running as /var/sbin/sshd -Dd).    I'll have to get syslog-ng set up to try do debug this further...]



> 
> 
> Corinna
> 
> -- 
> Problem reports:      https://cygwin.com/problems.html
> FAQ:                  https://cygwin.com/faq/
> Documentation:        https://cygwin.com/docs.html
> Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

- Raw text -