X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=dQGuOVjEmx4vS6c5Ewiu798WfEzrEY/Vk7B8VAbY+OZgSyzjN2Kyi
	clMuF/g9pDylFyBgVA9EUWumT1vUdwfqX2uB5XjkL2gP5Wp/yMcfwCO34tqO8srO
	kWBpty/eVBGXDVUrAanyHinz3iYSoEIiyjczKkTilzJe3Y2ZWphWms=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	 bh=QxXA1eLyN967OX2/WtJIDSBPGLA=; b=v0WIGmnr16QGHeUdamNjSREhmNHI
	aAJMvMywVWMTStZPYy7qoddlyzO5p1pIIgrRU6HY0+SYRAU0/3RxNlzh/gT4l6xh
	5Kh8RisuWLhZkpFVvv/u5sCyXQDJdc1qV74DWPM/RkYd/kG+VDjkBZ2DjUwDAvgI
	thCdGV0ZIaNlR3o=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-5.9 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.3.2
X-HELO: calimero.vinschen.de
Date: Wed, 25 Feb 2015 21:22:41 +0100
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: gid doesn't display correctly on SAMBA share using AD
Message-ID: <20150225202241.GA9628@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <54EDF1DB DOT 20708 AT intersystems DOT com> <20150225161849 DOT GG437 AT calimero DOT vinschen DOT de> <54EDFD84 DOT 2030605 AT intersystems DOT com> <20150225172022 DOT GL437 AT calimero DOT vinschen DOT de> <54EE05B3 DOT 4050304 AT intersystems DOT com> <20150225173432 DOT GP437 AT calimero DOT vinschen DOT de> <54EE0C9B DOT 2020605 AT intersystems DOT com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;	protocol="application/pgp-signature"; boundary="/04w6evG8XlLl3ft"
Content-Disposition: inline
In-Reply-To: <54EE0C9B.2020605@intersystems.com>
User-Agent: Mutt/1.5.23 (2014-03-12)

--/04w6evG8XlLl3ft
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Feb 25 12:55, Len Giambrone wrote:
> On 02/25/2015 12:34 PM, Corinna Vinschen wrote:
> >On Feb 25 12:26, Len Giambrone wrote:
> >>$ ls -la foo
> >>-rw-rw-r-- 1 Unix_User+build Unix_Group+releng 0 Feb 25 10:52 foo
> >>
> >>Is that expected? (The Unix_User+/Unix_Group+ prefix).
> >Yes, that's expected.  After all, they are users different from your
> >Windows account, see the SIDs.
>=20
> That's what I thought.
>=20
> >   If you don't want the prefix, you can
> >still override this by manually dropping the prefixes, along the lines
> >of what you could already do in the former implementation.  Should be a
> >last resort, of course.
>=20
> I actually tried that; I removed the Unix_User/Group+ prefix from the pas=
swd
> entry to see if it worked.
> It did, but then I couldn't ssh in as that user:
>=20
> build AT wx64lg /etc
> $ cat /etc/passwd
> lgiambro:*:4278246287:99999:,S-1-22-1-56207::
>=20
> build AT wx64lg /etc
> $ cat /etc/group
> releng:S-1-22-2-999:4278191079:

Oh, wait.  That's not good.  If you do that you must create *two* entries
in /etc/passwd and /etc/group with the same account names, one of them
being the Windows account, the other being the UNIX account.  The order
is important, too.  The Windows account must preceed the UNIX account,
kind of like this:

  $ mkpasswd -b -c -l my-unix-machine -U corinna
  corinna:*:1049577:1049701:U-VINSCHEN\corinna,S-1-5-21-2913048732-16971887=
82-3448811101-1001:/home/corinna:/bin/tcsh
  Unix_User+corinna:*:4278190580:99999:,S-1-22-1-500::

Then remove the Unix_User prefix.  It's a bit fragile, that's why
other solutions are better, imho.

> >   The other, better way not restricted to Cygwin
> >is to install Samba's winbind.
>=20
> We are running winbind.
>=20
> >   It just doesn't help for existing UNIX
> >accounts, afaics.
>=20
> I don't know how winbind works.  If it doesn't work with existing UNIX
> accounts, then when _would_ it have an effect?

I don't know exactly how winbind works either.  AFAIK it gets a range of
UNIX uid/gids, e.g 100000-200000, and then it translates any incoming
Windows SID into a Unix uid/gid in that range.  These users are handled
by winbind, but not any other, already existing users like "root" or,
fwiw, any uid/gid outside the range it maintains.


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--/04w6evG8XlLl3ft
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBAgAGBQJU7i8RAAoJEPU2Bp2uRE+gfGAQAJqOrCDPFM5xjreFRZvldZPK
eXvGlRpEJSx56OrjJbdD2M0J3Ix8FxRJgY16AuGlWOFHbAMbnsgudgl8/5du2FZc
IZn+iEBVd6IBeIDPjLaTkNFTymcy1ypgi2pEeHd+rXucYTpzgOJXjn4r4LxZgxK7
u6ddsQRCo0uES4oIhV7TA/PPegmTPSyS1E8d8r6AVvDxRrvcahYmdUcJ5r3oEfl/
T1RTu2ERwTSA3huBz6G+hxUFWeLCl65zLZmA7xbWPi0+lCQy3X9R0dndVn3684pR
OBc9NNBd8HACr7Uc6IzwbUYSD211qHhNejkKqHG8XHkoYmJXvqblhEQh/DKGoGIt
VtUC2+tJBPFqV2GTH2lD0oIOdfNzUVOwfK2nY7W0Wk+JtNDOB+LrYiIHIDB+TIXO
HxRnDTay6kjEWWifbnFi2phg/Jcmq1dcWsHAwyFK/Tb1xOjrior/gXXueE566khc
P+Nu2YRI+Q1hLDKBWCIBHarOeR0OgGPORKQzrYKPu+bDPeVPgm8rNSnY/LwIRyJZ
Ua8oQhaz4NC1mvERAVAE1dlbCLEvLl5WUxeNptllQX7i1g59HmSjfscqDEIMNtGq
M/ymY9LpCuTZC/2GvbiSxL1RHu3DVWEvH/Hi/ur5OokhiekrKlZQcIcr5cYY1bru
TcYc3arkA4bzNcvl6hI3
=8cT3
-----END PGP SIGNATURE-----

--/04w6evG8XlLl3ft--