Windows file server page

[davidep (Davide Principi)]

There are a few feature requests that could lead us to resume the “Windows network” page in server manager

Workgroupname when OpenLdap as account provider

My NS7 installation with OpenLDAP didn’t appear in the windows network neighborhood. So I changed the template entry in 00workgroup from “Workgroup” to my needs and the NS7 appeared after a reboot. Is there possibility to put a workgroupname in GUI if OpenLDAP is selected? If not, I think it should be.

NS Samba AD - RSAT Windows 7

Some first observations: RSAT - Active Directory Users and Computers (RSAT-ADUC) The users which were created in NS GUI: are shown in both side (NS Management -> Users and groups -> Users & RSAT-ADUC -> Users) can be add to the desired group, from both side (NS Management -> Users and groups -> Groups & RSAT-ADUC -> Users) and are shown in both side. The users which were created in RSAT-ADUC -> Users: are shown in both side (NS Management -> Users and groups -> Users & RSAT-ADUC -> Us…

Administrative access to all shared folders

Hello everybody! I have a question regarding user’s folder and shared folder access when using NS as DC-AD/File Server. There are two kind of folders that can be created using NS as DC-AD/File Server: user’s folder which is created when a new user is added: user.name@domain.tld shared folder which is created for sharing in the network: could be: user_name The user’s folder is visible only for the user when is logged to the domain. The shared folder is visible and accessible, let’s talk ab…

The new page (I’d like “Windows file server” as title) should contain:

• “Workgroup name” field, modifiable only with LDAP providers, read-only if joined to AD.

• A radio button to switch between legacy NTLM-auth access and domain Kerberos-auth. See this bug.

• A checkbox to enable the home$ share, that enables the domain administrator to access users’ home directories.

As requested by some of you, the domain administrator account will be mapped to root.

[flatspin (Ralf Jeckel)]

@davidep

Windows file server

Good choice!!

[davidep (Davide Principi)]

@davidep

A radio button to switch between legacy NTLM-auth access and domain Kerberos-auth. See this bug.

This 2013 discussion on RHEL bug tracker seems an interesting lecture:

https://bugzilla.redhat.com/show_bug.cgi?id=975464

It explains the upstream choices and why sssd prefers Kerberos.

[saitobenkei]

If I understand correctly they said: “Who cares if there are a plenty of applications that use only NTLM autentication out there. Isn’t our business…”

[davidep (Davide Principi)]

@davidep

A checkbox to enable the home$ share, that enables the domain administrator to access users’ home directories.

Also a checkbox to enable “admin$” share, mapped to /var/lib/nethserver/ibay, available to members of “Domain Admins” to perform privileged operations on all shared folders (ibays). As alternative the same checkbox could set admin users option to “Domain Admins” on each shared folder to get the same effect ( still wondering…)

[davidep (Davide Principi)]

@davidep

It explains the upstream choices and why sssd prefers Kerberos.

Update: since CentOS 7.4 the sssd implementation supports also NTLM authentication!

It has been a long journey for sssd 1.15 to be ported to CentOS

• Issue #2012: [RFE] Support NTLM authentication when GSSAPI NTLM mech is available - sssd - Pagure.io
• 963341 – [RFE] NTLMSSP support in MIT GSSAPI

This means we can now switch to sssd module, and have a fully working ACL management from Windows clients!

With such enhancement from upstream, I think this workaround is not necessary any more; anyway thank you again @planet_jeroen for pointing me to the right direction.

To make the things work we need a couple of adjustments:

• Set admin users = "@domain admins" on shared folders, in smb.conf
• Revert the alternatives configuration to the default sssd library

BTW I found the last sssd update left a dangling link. I think this is a bug to fix

[planet_jeroen (Jeroen Visser)]

Thank YOU for taking notice of my struggles and taking a deeper look! <3

[davidep (Davide Principi)]

Development started:

Issue: Windows file server page

[davidep (Davide Principi)]

Version #1

This is an UI mockup:

Represented values are the defaults that retain the current system behavior.

What do you think? Is it clear enough? Is it shit? How can we enhance it?

Please provide feedback! /cc @gg_jr @flatspin @planet_jeroen @robb @Chewi @nrauso @dev_team @quality_team

[planet_jeroen (Jeroen Visser)]

There is a distinct difference between a homefolder and a profilefolder. Both are essential for proper configuration of AD accounts and working roaming profiles.

A home folder, should be accessible but the user doesnt have to have full controll
A profile folder either should be owned by Domain Admins, or by the user and the user should have full controll in it.

I’m not sure what the use of the Grant Special permissions checkboxes are so I can not comment on them. I’m also tired, forgive me if I am missing the obvious

[flatspin (Ralf Jeckel)]

First of all: Thanks for hearing me and others @davidep
The workgroup box is clear, for shure.
The control thing i salso clear, I think.
For the special permissions I’m also not shure in which cases I’d need them.
I’ll install a new VM tomorrow to test this and to read the inside help.
So long friends.

[davidep (Davide Principi)]

@flatspin

to test this

…you’ve to wait! It’s only a screenshot

[flatspin (Ralf Jeckel)]

@davidep

It’s only a screenshot

Hahahaha! U got me. Fake news, all fake news!!!

[davidep (Davide Principi)]

@planet_jeroen

I’m not sure what the use of the Grant Special permissions checkboxes are so I can not comment on them.

Version #2

Reworded “special privileges” section. Adding more checkboxes could be easier in the future…

@flatspin: this is a mockup too

[planet_jeroen (Jeroen Visser)]

What is the difference between option 1 and option 2 for special privileges ? They seem the same ? Is the home$ folder conflated here with profile ?

The profile folder will contain the bare minimum from the profile. (that which can not be redirected to the home folder). Included would be AppData\Roaming and the NTUSER.DAT but not folders like 'My ’

The home folder should be seen as ‘private’ server storage for the user and through folder redirection, the documents and other relevant 'My ’ folders get redirected there.

For the home folder, the user needs full controll IN it, but ownership is irrelevant. For the profile folder, either Domain Admins or the user should be the owner. Notably the last one has been proven difficult for me to setup.

[davidep (Davide Principi)]

@planet_jeroen

What is the difference between option 1 and option 2 for special privileges ? They seem the same ?

There’s no difference in implementation. The comparison purpose is to evaluate the effectiveness of the text labels: are they comprehensible, self-explaining, clear enough? What option do you prefer? Do you want to suggest an alternative?

@planet_jeroen

Is the home$ folder conflated here with profile ?

Sorry, but roaming profiles are not planned in this feature! We should discuss them in another thread.

[planet_jeroen (Jeroen Visser)]

For the special permissions I would use: ‘Grant full control on shared folder to Domain Admins group’

There is no special case on a home share that would make it logical to set Domain Admins with full control there, so imho it shouldnt get a special mention as it will confuse people into thinking they need this permission for a home share.

If this permission IS needed due to implementation reasons, then it would need the first message, but we would also need to know why to understand the implications and possible limitations.

[davidep (Davide Principi)]

@planet_jeroen

There is no special case on a home share that would make it logical to set Domain Admins with full control there, so imho it shouldnt get a special mention as it will confuse people into thinking they need this permission for a home share.

This is the rationale provided by @GG_jr that seems reasonable

Administrative access to all shared folders

Even if you use NS as DC-AD/File server at home, you will want to protect your children by their “youth mistakes” and you will want to see what they do. But, I always talk about NS as a professional product. In a company network, there are no “private data”. If you may have access to personal email, cloud, …, all those have nothing in common with company data. All data in the network are property of the company. The access to those data is hierarchically. As system administrator, a…

samba-audit could also plug its configuration to provide audit logs about home$ (ab)use too…

[planet_jeroen (Jeroen Visser)]

That actually will not pass the GDPR. The sysadmin should be able to GET access at all times. Not HAVE acces at all times. Therefore, ownership is much more interesting then actual userrights assignment.

Yes this scenario you mention can be usefull, but therefore I would not name add the (home$ share) reference to the mentioning of the option.

[davidep (Davide Principi)]

@planet_jeroen

The sysadmin should be able to GET access at all times. Not HAVE acces at all times. Therefore, ownership is much more interesting then actual userrights assignment.

Could you make an example? How should it work?