From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.17.24]) by sourceware.org (Postfix) with ESMTPS id 5505C3858417 for ; Mon, 17 Jan 2022 12:04:45 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 5505C3858417 Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=cygwin.com Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=cygwin.com Received: from calimero.vinschen.de ([24.134.7.25]) by mrelayeu.kundenserver.de (mreue109 [212.227.15.183]) with ESMTPSA (Nemesis) id 1MOiLp-1mxVpc40tj-00QDwM for ; Mon, 17 Jan 2022 13:04:43 +0100 Received: by calimero.vinschen.de (Postfix, from userid 500) id 6B613A81ECA; Mon, 17 Jan 2022 13:04:43 +0100 (CET) Date: Mon, 17 Jan 2022 13:04:43 +0100 From: Corinna Vinschen To: cygwin@cygwin.com Subject: Re: Help with standalone samba SID-uid mapping Message-ID: Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <064846E1-8D6D-41D2-97D9-4C3793502CEE@house.org> <7BA06F03-FCFA-492E-898F-F423F03E15F6@house.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <7BA06F03-FCFA-492E-898F-F423F03E15F6@house.org> X-Provags-ID: V03:K1:97wKykA5j9wH6/ge+1PV1Im8Pp9k7fcHVR8gkDxUFZhrFeLtiWf PRtnPyrHPplYufcUNoNKNEDk2i1ntksiv6ZcommyKD5kOuJ0wZ5g0p5loxMY5mB5hkzpYwf YpitjKi5Ao3a8rMqTxW0nHC4a94wTq4CaUWg7Z0PzUkL7pcTMonfJEVG1k0Es6QUzGIaDAl Ert8NyWDegVUUkdGXUPfA== X-UI-Out-Filterresults: notjunk:1;V03:K0:z+CLzukjlrQ=:ays8ozphFEGOAZMWae9ydP kNIGZtxmAUJEYBHbhscZDiqEiXLvzrTHOqyHYnr8FF4fYIyofJzyVUh1jwPXTxVzhW2fvChyZ A33W1yAi2vT4kxbs9dMy8VoG2NBujx1X/VfSPWcSgDx04iZkajhPc2Mqvtz8jyurq++6OYxdc R9a36ZoEba/eNHUxREZ5qyXEkDs49/O4cz4lPH90fYekOR2laNx5YT+JFIrOwd6TKr9WEzNNU z/U0MqVPwi9DfgVCHu8VPICUZR2B63u6dozKTcr9jxoyB+6dGTxDWfFH1sXwx0QVNfE3pf8s+ 9aoIf8uzMKu2oiRk1BuZcTJZQI+iF2mlqw32z4CI5uMOnd8bNoDQwibiIFhrD00TAMQdxRqzT m+tMSNeUfpA0UKxt9ysoFRLzG6SOYSxcNZ3IVsPXTHCBRflEPPuNM5yY32Vi5e8/egsAqPd0W nuVupRqLQ9Mo7rPPaW3wizhZ3oxpNHRXwvCt0Kh7ZHMmxvt/JlNnEw2AkFTPHilGaAqQ9RY72 wUd8pbSrcPx+1d1YZW8qWWJ7XQWI+FQgCgC7quCyqOz6uUI86DD+k6GvXU+Nmc8TFGtDqK1/A HpFRVdDaP7jN8DfVXTWB5dP/8yjsTIbPp7+mvScjNdRyRDCHi2dYMgAXtz8mDl2//MmOzYdje CqxmfUEEDDE8f7rXZ2ffyetE4rORwounznEKTk1hr7H407GHCQYQYMWMeKnurxLE7qQEC6z07 8XPyWSny3cuvkk+Z X-Spam-Status: No, score=-95.8 required=5.0 tests=BAYES_00, GOOD_FROM_CORINNA_CYGWIN, KAM_DMARC_NONE, KAM_DMARC_STATUS, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_FAIL, SPF_HELO_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: cygwin@cygwin.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: General Cygwin discussions and problem reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Jan 2022 12:04:46 -0000 On Jan 14 11:57, Chris Roehrig wrote: > On Fri Jan 14 2022, at 2:04 AM, Corinna Vinschen wrote: > > These look like your standard Windows SIDs, so they are your SIDs for > > users cristina and croehrig on Windows. They should show up as such in > > ls -l output, unless the SID is actuall wrong, e. g., they map to your > > accounts on another machine or something like that. > > No those are the SIDs supplied by the Samba server (see below for my local Windows SIDs). Here they are directly on the Linux machine: > housesrv[11]% smbcacls --numeric //housesrv/Users croehrig > Enter WORKGROUP\croehrig's password: > REVISION:1 > CONTROL:0x9004 > OWNER:S-1-5-21-751087815-2087572193-42305691-1000 > GROUP:S-1-22-2-601 > ACL:S-1-5-21-751087815-2087572193-42305691-1000:0/0x0/0x001f01ff > ACL:S-1-22-2-601:0/0x0/0x001200a9 > ACL:S-1-1-0:0/0x0/0x001200a9 > > (I think that Samba now uses a more complex IDMAP algorithm than when > the Cygwin document above was written and now provides a full domain > component to its SIDs.) That may be so, but in my installation, Samba reports the Unix User ID as owner, i. e. $ icacls \\\\server\\corinna\\foo \\server\corinna\foo S-1-22-1-500:(R,W,D,WDAC,WO) S-1-22-2-11125:(R) Everyone:(R) and that's with Samba 4.15.3. I'm doing the mapping via the AD uidNumber and gidNumber fields. I'm using this setup for so long that I don't remember if I ever saw a "normal", Windows-like SID for the user returned by Samba. I never ran winbindd, up until Samba 4.15.3, which was the first one forcing me to do so when using AD support. > I just added those SIDs to /etc/passwd and /etc/groups (double > entries now) and it now works for the user, but (oddly) not the group: > > tyto[6]% ls -l //housesrv/Users/ ## NB: this is a UNC path to the samba share > total 0 > drwxr-xr-x 1 cristina Unix_Group+603 0 Jan 12 16:06 cristina > drwxr-xr-x 1 croehrig Unix_Group+601 0 Jan 14 09:18 croehrig > [...] > tyto[10]% cat /etc/group > croehrig:S-1-22-2-601:601: > cristina:S-1-22-2-603:603: > croehrig:S-1-5-21-1290748074-662758565-4273641972-1006:601: > cristina:S-1-5-21-1290748074-662758565-4273641972-1008:603: Hmm, that's weird. I just tried this myself. First I created a stock /etc/group file with all local and AD accounts. Next I changed /etc/nsswitch.conf: - group: db + group: files Exit/restart Cygwin. `ls -l' now prints -rw-r--r-- 1 corinna Unknown+Group 13342 Jan 17 10:46 //calimero/corinna/foo Now I add this line to /etc/group: mygroup:S-1-22-2-11125:11125: Exit/restart Cygwin. Now `ls -l' prints -rw-r--r-- 1 corinna mygroup 13342 Jan 17 10:46 //calimero/corinna/foo So it works, apparently. Did you set `group: db' in /etc/nsswitch.conf, by any chance? Corinna