NS Samba AD - RSAT Windows 7

[GG_jr (Gabriel GHEORGHIU)]

Some first observations:

RSAT - Active Directory Users and Computers (RSAT-ADUC)

• The users which were created in NS GUI:

  • are shown in both side (NS Management -> Users and groups -> Users & RSAT-ADUC -> Users)
  • can be add to the desired group, from both side (NS Management -> Users and groups -> Groups & RSAT-ADUC -> Users) and are shown in both side.

• The users which were created in RSAT-ADUC -> Users:

  • are shown in both side (NS Management -> Users and groups -> Users & RSAT-ADUC -> Users)
  • can be add to the desired group, from both side (NS Management -> Users and groups -> Groups & RSAT-ADUC -> Users) and are shown only in RSAT-ADUC.

• The Groups:

  • can be created from both side (NS Management -> Users and groups -> Groups & RSAT-ADUC -> Users)
  • are shown in both side (NS Management -> Users and groups -> Groups & RSAT-ADUC -> Users)
  • the Users can be add as described above

I think it’s an issue regarding how the user “Name” “is seen” or “it means” by the both parts:

In RSAT-ADUC -> Users, the users which are created in NS Management -> Users and groups -> Users are shown as “user.name” and the users which are created in RSAT-ADUC -> Users are shown as User NAME (please see the attached files).

RSAT - DHCP

• The NS DC server can be added as Authorized DHCP Server
• Cannot connect to the NS DC server (please see the attached files)

Till now, cannot manage NS Samba only from RSAT.

[Christian (Christian Bonato)]

Regarding users, what would be interesting is to look at LDAP content with LDAP client, not through RSAT.
Microsoft’s implementation, in term of directory, assumes that cn (used as RDN for user’s entries) is unique, which is stupid enough to prevent any smooth move from open organization to another without facing the risk to change CN due to uniqueness constraint within the branch.
Because of this uniqueness assumption, interfaces are often based on CN attribute, by default “given name + space + last name”.

This said, CN can technically contain whatever you want as long as it is unique within the branch (DIT)

I should be able to have a closer look soon as my first Nethserver is now installed.

This aside, I don’t understand how this relates to DHCP?

[GG_jr (Gabriel GHEORGHIU)]

Other observations:

RSAT - Computer Management

According this:
https://wiki.samba.org/index.php/Shares_with_Windows_ACLs
I should be able to change the share permissions of a shared folder, but I can’t (please see the attached files).

I am logged into domain with the Administrator account (administrator@abt.ro).

@davidep, @giacomo : There is a chance to use RSAT to be able to use the full advantages of NethServer Samba AD?

TIA,
Gabriel

EDIT:

I think I put the wrong question.
There is nothing wrong with RSAT.
I think the NS Samba AD version is not fully functional.
Or the admin account has no full rights.
Or …

So,
There is any chance to have NS Samba AD version fully functional, to be able to replace MS AD?

[Ctek (Bogdan C)]

Hi Gabi.
I don’t know if this is the case but from what i know you can’t modify the permissions of the user home drive share.

Try with another share or create some group policy.

Regards

[GG_jr (Gabriel GHEORGHIU)]

@Ctek

Hi Gabi. I don’t know if this is the case but from what i know you can’t modify the permissions of the user home drive share.

Try with another share or create some group policy.

Hi Bogdan,

Thank you for your answer.
It seemed to me that nobody is interested by Samba AD on NS!

EDIT: IMO, shared folders and how to access and how to restrict and/or share the access to the shared folders is the first thing that you need into domain!

Is not “user home drive share”.
Is a shared folder created for everyone from "Management → Users and groups → CREATE NEW.

Anyway, from administrator account, should be able to modify anything.

Otherwise, it’s useless. Back to Windows AD or …

[davidep (Davide Principi)]

@GG_jr

I should be able to change the share permissions of a shared folder, but I can’t (please see the attached files).

Is this bug the same?

ACL aren't applied in samba4 AD shares/subfolders/files

NethServer Version: V7rc1 Module: Samba4 AD Good day, i’m playing around with my fresh installation test of Nethserver NG 7rc1 and Windows 7 professional. I’m trying to define some ACLs to shares, files and subfolders created on Nethserver but the rules that I set disappears when I confirm the new configuration. I have read these documents: https://wiki.samba.org/index.php/Shares_with_Windows_ACLs#Setup_share_permissions_.28optional.29 https://wiki.samba.org/index.php/Shares_with_Windows_…

[GG_jr (Gabriel GHEORGHIU)]

Hi Davide,

I just read your response to that post and I think yes.
I want to reboot in Win 7 to use RSAT and check.
I will report back, A.S.A.P.

Gabriel

[GG_jr (Gabriel GHEORGHIU)]

I followed your steps to install sssd-libwclient on NS.

Unfortunately, I have the same error as above when I want to change ACL for a shared folder.

What I forgot to mention is: First time when I want to connect to the NS DC/AD from RSAT-Computer management, I have an error. After I press OK, I can connect to the NS DC/AD. I don’t know if is an issue or it take time to connect. I just want you to know that.

[davidep (Davide Principi)]

IIUC “Share permissions” are not the same as “Filesystem ACLs”. I don’t know how this type of permissions are configured in Samba

I remember share-level permissions were set during the old times of FAT32 filesystem, before NTFS (and ACL) came out.

[GG_jr (Gabriel GHEORGHIU)]

Will you take a look here?

https://wiki.samba.org/index.php/Shares_with_Windows_ACLs

Maybe is something that must set in samba configuration.

TIA,
Gabriel

EDIT: Sorry! Is almost the same link as in the other post that you referred.

[davidep (Davide Principi)]

A shot in the dark: try by adding the following lines add the end of smb.conf:

[global]
vfs objects = acl_xattr

Then

systemctl restart smb nmb

See if share-level permissions is fixed…

[GG_jr (Gabriel GHEORGHIU)]

At the end of [global] or add another [global] at the end of smb.conf?

[davidep (Davide Principi)]

It does not matter! Both should be accepted. To verify

testparm -s -v | grep ...

[GG_jr (Gabriel GHEORGHIU)]

Hi @davidep,

Sorry for my late feedback. Yesterday, just after you gave me the response, I had to go to one of our customers.
Unfortunately, didn’t work.
And what I got after “testparm -s -v | grep …” has 2 Km …

Another, maybe, stupid thought:
I wonder if it is not an issue between Samba AD and NS File server.
Could be a matter of credentials between the two modules?
As Domain Admin, I can access the shared folder (File server) but I have no rights (Samba AD) to change the ACLs.

[robb (Rob Bosch)]

I’d like to voice my personal opinion on ACL’s in any situation.
I always set share permissions to full control for ‘everyone’ or if you are in a strict domain environment without any BYOD devices, full control for ‘authenticated users’.
All other permissions are done through filesystem ACL’s. This way you always know exactly what permissions are set for any directory or file.
IMO Share permissions are to avoid whenever possible.

[davidep (Davide Principi)]

Windows ACLs are mapped to Unix and POSIX ACLs. There can’t be a 1-1 map!

When a shared folder is created from server manager and account provider is AD, the folder owner is administrator. That means he is the only user that can change ACLs.

If account provider is not AD the owner is nobody and only guest access works.

[anon43345481]

It might be a problem with Samba AD using RSAT with Win7 and not with NS to make changes the shared folders. The last time I try to set it up using Samba I was using Samba 4.4.2 on CentOS 7.1511, and I can’t get it work. And the received the same error message as @GG_jr

Changes cannot be saved. Access is denied.

The last time I was able to change the shared permissions of a shared folder using RSAT on Win7 was Samba 4.1.3 on Lubuntu. But setting it up with 4.1.3 was much easier than it’s now.

I will try using Samba 4.5.1 on CentOS 7.1511 using RSAT and I will post my results.

[GG_jr (Gabriel GHEORGHIU)]

@robb

I’d like to voice my personal opinion on ACL’s in any situation.I always set share permissions to full control for ‘everyone’ or if you are in a strict domain environment without any BYOD devices, full control for ‘authenticated users’.All other permissions are done through filesystem ACL’s. This way you always know exactly what permissions are set for any directory or file.IMO Share permissions are to avoid whenever possible.

@davidep

Windows ACLs are mapped to Unix and POSIX ACLs. There can’t be a 1-1 map!

When a shared folder is created from server manager and nethserver-dc is installed, the folder owner is administrator. That means he is the only user that can change ACLs.

If nethserver-dc is not installed the owner is nobody and only guest access works.

Totally agree with you!

To recap: in an AD environment, the administrator, by default, has the full rights/control over all users and all folders that belong to the domain.

So, as Administrator, in an AD environment, I am the only one who is able to change ACLs.

Am I right or wrong?

[GG_jr (Gabriel GHEORGHIU)]

I will try on Monday to join a Windows 10 ws to the domain to use Win10 RSAT.
I will report back.

[davidep (Davide Principi)]

@GG_jr

Am I right or wrong?

Surely you’re right!

But this is not AD, administrator on our Linux systems is not root… He must obey the Linux rules!

Only the directory owner (and root) can change ACLs!