| 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Group Mapping: MS Windows and UNIX</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="The Official Samba 3.5.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="passdb.html" title="Chapter 11. Account Information Databases"><link rel="next" href="NetCommand.html" title="Chapter 13. Remote and Local Management: The Net Command"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Group Mapping: MS Windows and UNIX</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="passdb.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="NetCommand.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 12. Group Mapping: MS Windows and UNIX"><div class="titlepage"><div><div><h2 class="title"><a name="groupmapping"></a>Chapter 12. Group Mapping: MS Windows and UNIX</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jean François</span> <span class="surname">Micouleau</span></h3></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jerry@samba.org">jerry@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="groupmapping.html#id363131">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="groupmapping.html#id363526">Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id363840">Warning: User Private Group Problems</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id363892">Nested Groups: Adding Windows Domain Groups to Windows Local Groups</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id364421">Important Administrative Information</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id364641">Default Users, Groups, and Relative Identifiers</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id365250">Example Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="groupmapping.html#id365321">Configuration Scripts</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id365331">Sample <code class="filename">smb.conf</code> Add Group Script</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id365490">Script to Configure Group Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="groupmapping.html#id365604">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id365615">Adding Groups Fails</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id365695">Adding Domain Users to the Workstation Power Users Group</a></span></dt></dl></dd></dl></div><p>
|
|---|
| 2 | <a class="indexterm" name="id363013"></a>
|
|---|
| 3 | <a class="indexterm" name="id363023"></a>
|
|---|
| 4 | <a class="indexterm" name="id363029"></a>
|
|---|
| 5 | <a class="indexterm" name="id363036"></a>
|
|---|
| 6 | <a class="indexterm" name="id363043"></a>
|
|---|
| 7 | <a class="indexterm" name="id363050"></a>
|
|---|
| 8 | Starting with Samba-3, new group mapping functionality is available to create associations
|
|---|
| 9 | between Windows group SIDs and UNIX group GIDs. The <code class="literal">groupmap</code> subcommand
|
|---|
| 10 | included with the <span class="application">net</span> tool can be used to manage these associations.
|
|---|
| 11 | </p><p>
|
|---|
| 12 | <a class="indexterm" name="id363073"></a>
|
|---|
| 13 | <a class="indexterm" name="id363080"></a>
|
|---|
| 14 | The new facility for mapping NT groups to UNIX system groups allows the administrator to decide
|
|---|
| 15 | which NT domain groups are to be exposed to MS Windows clients. Only those NT groups that map
|
|---|
| 16 | to a UNIX group that has a value other than the default (<code class="constant">-1</code>) will be exposed
|
|---|
| 17 | in group selection lists in tools that access domain users and groups.
|
|---|
| 18 | </p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
|
|---|
| 19 | <a class="indexterm" name="id363098"></a>
|
|---|
| 20 | <a class="indexterm" name="id363105"></a>
|
|---|
| 21 | The <em class="parameter"><code>domain admin group</code></em> parameter has been removed in Samba-3 and should no longer
|
|---|
| 22 | be specified in <code class="filename">smb.conf</code>. In Samba-2.2.x, this parameter was used to give the listed users membership in the
|
|---|
| 23 | <code class="constant">Domain Admins</code> Windows group, which gave local admin rights on their workstations
|
|---|
| 24 | (in default configurations).
|
|---|
| 25 | </p></div><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id363131"></a>Features and Benefits</h2></div></div></div><p>
|
|---|
| 26 | Samba allows the administrator to create MS Windows NT4/200x group accounts and to
|
|---|
| 27 | arbitrarily associate them with UNIX/Linux group accounts.
|
|---|
| 28 | </p><p>
|
|---|
| 29 | <a class="indexterm" name="id363143"></a>
|
|---|
| 30 | <a class="indexterm" name="id363150"></a>
|
|---|
| 31 | <a class="indexterm" name="id363156"></a>
|
|---|
| 32 | <a class="indexterm" name="id363163"></a>
|
|---|
| 33 | <a class="indexterm" name="id363170"></a>
|
|---|
| 34 | <a class="indexterm" name="id363177"></a>
|
|---|
| 35 | <a class="indexterm" name="id363183"></a>
|
|---|
| 36 | Group accounts can be managed using the MS Windows NT4 or MS Windows 200x/XP Professional MMC tools.
|
|---|
| 37 | Appropriate interface scripts should be provided in <code class="filename">smb.conf</code> if it is desired that UNIX/Linux system
|
|---|
| 38 | accounts should be automatically created when these tools are used. In the absence of these scripts, and
|
|---|
| 39 | so long as <code class="literal">winbindd</code> is running, Samba group accounts that are created using these
|
|---|
| 40 | tools will be allocated UNIX UIDs and GIDs from the ID range specified by the
|
|---|
| 41 | <a class="link" href="smb.conf.5.html#IDMAPUID" target="_top">idmap uid</a>/<a class="link" href="smb.conf.5.html#IDMAPGID" target="_top">idmap gid</a>
|
|---|
| 42 | parameters in the <code class="filename">smb.conf</code> file.
|
|---|
| 43 | </p><div class="figure"><a name="idmap-sid2gid"></a><p class="title"><b>Figure 12.1. IDMAP: Group SID-to-GID Resolution.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/idmap-sid2gid.png" width="270" alt="IDMAP: Group SID-to-GID Resolution."></div></div></div><br class="figure-break"><div class="figure"><a name="idmap-gid2sid"></a><p class="title"><b>Figure 12.2. IDMAP: GID Resolution to Matching SID.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/idmap-gid2sid.png" width="270" alt="IDMAP: GID Resolution to Matching SID."></div></div></div><br class="figure-break"><p>
|
|---|
| 44 | <a class="indexterm" name="id363320"></a>
|
|---|
| 45 | <a class="indexterm" name="id363327"></a>
|
|---|
| 46 | <a class="indexterm" name="id363334"></a>
|
|---|
| 47 | <a class="indexterm" name="id363343"></a>
|
|---|
| 48 | In both cases, when winbindd is not running, only locally resolvable groups can be recognized. Please refer to
|
|---|
| 49 | <a class="link" href="groupmapping.html#idmap-sid2gid" title="Figure 12.1. IDMAP: Group SID-to-GID Resolution.">IDMAP: Group SID-to-GID Resolution</a> and <a class="link" href="groupmapping.html#idmap-gid2sid" title="Figure 12.2. IDMAP: GID Resolution to Matching SID.">IDMAP: GID Resolution to Matching SID</a>. The <code class="literal">net groupmap</code> is
|
|---|
| 50 | used to establish UNIX group to NT SID mappings as shown in <a class="link" href="groupmapping.html#idmap-store-gid2sid" title="Figure 12.3. IDMAP Storing Group Mappings.">IDMAP: storing
|
|---|
| 51 | group mappings</a>.
|
|---|
| 52 | </p><div class="figure"><a name="idmap-store-gid2sid"></a><p class="title"><b>Figure 12.3. IDMAP Storing Group Mappings.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/idmap-store-gid2sid.png" width="270" alt="IDMAP Storing Group Mappings."></div></div></div><br class="figure-break"><p>
|
|---|
| 53 | <a class="indexterm" name="id363424"></a>
|
|---|
| 54 | <a class="indexterm" name="id363431"></a>
|
|---|
| 55 | <a class="indexterm" name="id363438"></a>
|
|---|
| 56 | <a class="indexterm" name="id363444"></a>
|
|---|
| 57 | Administrators should be aware that where <code class="filename">smb.conf</code> group interface scripts make
|
|---|
| 58 | direct calls to the UNIX/Linux system tools (the shadow utilities, <code class="literal">groupadd</code>,
|
|---|
| 59 | <code class="literal">groupdel</code>, and <code class="literal">groupmod</code>), the resulting UNIX/Linux group names will be subject
|
|---|
| 60 | to any limits imposed by these tools. If the tool does not allow uppercase characters
|
|---|
| 61 | or space characters, then the creation of an MS Windows NT4/200x-style group of
|
|---|
| 62 | <code class="literal">Engineering Managers</code> will attempt to create an identically named
|
|---|
| 63 | UNIX/Linux group, an attempt that will of course fail.
|
|---|
| 64 | </p><p>
|
|---|
| 65 | <a class="indexterm" name="id363488"></a>
|
|---|
| 66 | <a class="indexterm" name="id363494"></a>
|
|---|
| 67 | There are several possible workarounds for the operating system tools limitation. One
|
|---|
| 68 | method is to use a script that generates a name for the UNIX/Linux system group that
|
|---|
| 69 | fits the operating system limits and that then just passes the UNIX/Linux group ID (GID)
|
|---|
| 70 | back to the calling Samba interface. This will provide a dynamic workaround solution.
|
|---|
| 71 | </p><p>
|
|---|
| 72 | <a class="indexterm" name="id363507"></a>
|
|---|
| 73 | Another workaround is to manually create a UNIX/Linux group, then manually create the
|
|---|
| 74 | MS Windows NT4/200x group on the Samba server, and then use the <code class="literal">net groupmap</code>
|
|---|
| 75 | tool to connect the two to each other.
|
|---|
| 76 | </p></div><div class="sect1" title="Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id363526"></a>Discussion</h2></div></div></div><p>
|
|---|
| 77 | <a class="indexterm" name="id363534"></a>
|
|---|
| 78 | <a class="indexterm" name="id363540"></a>
|
|---|
| 79 | When you install <span class="application">MS Windows NT4/200x</span> on a computer, the installation
|
|---|
| 80 | program creates default users and groups, notably the <code class="constant">Administrators</code> group,
|
|---|
| 81 | and gives that group privileges necessary to perform essential system tasks,
|
|---|
| 82 | such as the ability to change the date and time or to kill (or close) any process running on the
|
|---|
| 83 | local machine.
|
|---|
| 84 | </p><p>
|
|---|
| 85 | <a class="indexterm" name="id363563"></a>
|
|---|
| 86 | The <code class="constant">Administrator</code> user is a member of the <code class="constant">Administrators</code> group, and thus inherits
|
|---|
| 87 | <code class="constant">Administrators</code> group privileges. If a <code class="constant">joe</code> user is created to be a member of the
|
|---|
| 88 | <code class="constant">Administrators</code> group, <code class="constant">joe</code> has exactly the same rights as the user
|
|---|
| 89 | <code class="constant">Administrator</code>.
|
|---|
| 90 | </p><p>
|
|---|
| 91 | <a class="indexterm" name="id363600"></a>
|
|---|
| 92 | <a class="indexterm" name="id363606"></a>
|
|---|
| 93 | <a class="indexterm" name="id363613"></a>
|
|---|
| 94 | <a class="indexterm" name="id363620"></a>
|
|---|
| 95 | When an MS Windows NT4/200x/XP machine is made a domain member, the <span class="quote">“<span class="quote">Domain Admins</span>”</span> group of the
|
|---|
| 96 | PDC is added to the local <code class="constant">Administrators</code> group of the workstation. Every member of the
|
|---|
| 97 | <code class="constant">Domain Admins</code> group inherits the rights of the local <code class="constant">Administrators</code> group when
|
|---|
| 98 | logging on the workstation.
|
|---|
| 99 | </p><p>
|
|---|
| 100 | <a class="indexterm" name="id363646"></a>
|
|---|
| 101 | <a class="indexterm" name="id363653"></a>
|
|---|
| 102 | The following steps describe how to make Samba PDC users members of the <code class="constant">Domain Admins</code> group.
|
|---|
| 103 | </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>
|
|---|
| 104 | Create a UNIX group (usually in <code class="filename">/etc/group</code>); let's call it <code class="constant">domadm</code>.
|
|---|
| 105 | </p></li><li class="listitem"><p>
|
|---|
| 106 | <a class="indexterm" name="id363689"></a>
|
|---|
| 107 | Add to this group the users that must be <span class="quote">“<span class="quote">Administrators</span>”</span>. For example,
|
|---|
| 108 | if you want <code class="constant">joe, john</code>, and <code class="constant">mary</code> to be administrators,
|
|---|
| 109 | your entry in <code class="filename">/etc/group</code> will look like this:
|
|---|
| 110 | </p><pre class="programlisting">
|
|---|
| 111 | domadm:x:502:joe,john,mary
|
|---|
| 112 | </pre><p>
|
|---|
| 113 | </p></li><li class="listitem"><p>
|
|---|
| 114 | Map this domadm group to the <span class="quote">“<span class="quote">Domain Admins</span>”</span> group by executing the command:
|
|---|
| 115 | </p><p>
|
|---|
| 116 | </p><pre class="screen">
|
|---|
| 117 | <code class="prompt">root# </code><strong class="userinput"><code>net groupmap add ntgroup="Domain Admins" unixgroup=domadm rid=512 type=d</code></strong>
|
|---|
| 118 | </pre><p>
|
|---|
| 119 | </p><p>
|
|---|
| 120 | <a class="indexterm" name="id363753"></a>
|
|---|
| 121 | The quotes around <span class="quote">“<span class="quote">Domain Admins</span>”</span> are necessary due to the space in the group name.
|
|---|
| 122 | Also make sure to leave no white space surrounding the equal character (=).
|
|---|
| 123 | </p></li></ol></div><p>
|
|---|
| 124 | Now <code class="constant">joe, john</code>, and <code class="constant">mary</code> are domain administrators.
|
|---|
| 125 | </p><p>
|
|---|
| 126 | <a class="indexterm" name="id363780"></a>
|
|---|
| 127 | It is possible to map any arbitrary UNIX group to any Windows NT4/200x group as well as
|
|---|
| 128 | to make any UNIX group a Windows domain group. For example, if you wanted to include a
|
|---|
| 129 | UNIX group (e.g., acct) in an ACL on a local file or printer on a Domain Member machine,
|
|---|
| 130 | you would flag that group as a domain group by running the following on the Samba PDC:
|
|---|
| 131 | </p><p>
|
|---|
| 132 | </p><pre class="screen">
|
|---|
| 133 | <code class="prompt">root# </code><strong class="userinput"><code>net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct type=d</code></strong>
|
|---|
| 134 | </pre><p>
|
|---|
| 135 | The <code class="literal">ntgroup</code> value must be in quotes if it contains space characters to prevent
|
|---|
| 136 | the space from being interpreted as a command delimiter.
|
|---|
| 137 | </p><p>
|
|---|
| 138 | <a class="indexterm" name="id363822"></a>
|
|---|
| 139 | <a class="indexterm" name="id363829"></a>
|
|---|
| 140 | Be aware that the RID parameter is an unsigned 32-bit integer that should
|
|---|
| 141 | normally start at 1000. However, this RID must not overlap with any RID assigned
|
|---|
| 142 | to a user. Verification for this is done differently depending on the passdb backend
|
|---|
| 143 | you are using. Future versions of the tools may perform the verification automatically,
|
|---|
| 144 | but for now the burden is on you.
|
|---|
| 145 | </p><div class="sect2" title="Warning: User Private Group Problems"><div class="titlepage"><div><div><h3 class="title"><a name="id363840"></a>Warning: User Private Group Problems</h3></div></div></div><p>
|
|---|
| 146 | <a class="indexterm" name="id363848"></a>
|
|---|
| 147 | <a class="indexterm" name="id363855"></a>
|
|---|
| 148 | <a class="indexterm" name="id363861"></a>
|
|---|
| 149 | Windows does not permit user and group accounts to have the same name.
|
|---|
| 150 | This has serious implications for all sites that use private group accounts.
|
|---|
| 151 | A private group account is an administrative practice whereby users are each
|
|---|
| 152 | given their own group account. Red Hat Linux, as well as several free distributions
|
|---|
| 153 | of Linux, by default create private groups.
|
|---|
| 154 | </p><p>
|
|---|
| 155 | <a class="indexterm" name="id363875"></a>
|
|---|
| 156 | <a class="indexterm" name="id363881"></a>
|
|---|
| 157 | When mapping a UNIX/Linux group to a Windows group account, all conflict can
|
|---|
| 158 | be avoided by assuring that the Windows domain group name does not overlap
|
|---|
| 159 | with any user account name.
|
|---|
| 160 | </p></div><div class="sect2" title="Nested Groups: Adding Windows Domain Groups to Windows Local Groups"><div class="titlepage"><div><div><h3 class="title"><a name="id363892"></a>Nested Groups: Adding Windows Domain Groups to Windows Local Groups</h3></div></div></div><a class="indexterm" name="id363898"></a><p>
|
|---|
| 161 | <a class="indexterm" name="id363909"></a>
|
|---|
| 162 | This functionality is known as <code class="constant">nested groups</code> and was first added to
|
|---|
| 163 | Samba-3.0.3.
|
|---|
| 164 | </p><p>
|
|---|
| 165 | <a class="indexterm" name="id363924"></a>
|
|---|
| 166 | All MS Windows products since the release of Windows NT 3.10 support the use of nested groups.
|
|---|
| 167 | Many Windows network administrators depend on this capability because it greatly simplifies security
|
|---|
| 168 | administration.
|
|---|
| 169 | </p><p>
|
|---|
| 170 | <a class="indexterm" name="id363936"></a>
|
|---|
| 171 | <a class="indexterm" name="id363942"></a>
|
|---|
| 172 | <a class="indexterm" name="id363949"></a>
|
|---|
| 173 | <a class="indexterm" name="id363956"></a>
|
|---|
| 174 | <a class="indexterm" name="id363963"></a>
|
|---|
| 175 | <a class="indexterm" name="id363970"></a>
|
|---|
| 176 | <a class="indexterm" name="id363976"></a>
|
|---|
| 177 | The nested group architecture was designed with the premise that day-to-day user and group membership
|
|---|
| 178 | management should be performed on the domain security database. The application of group security
|
|---|
| 179 | should be implemented on domain member servers using only local groups. On the domain member server,
|
|---|
| 180 | all file system security controls are then limited to use of the local groups, which will contain
|
|---|
| 181 | domain global groups and domain global users.
|
|---|
| 182 | </p><p>
|
|---|
| 183 | <a class="indexterm" name="id363990"></a>
|
|---|
| 184 | <a class="indexterm" name="id363997"></a>
|
|---|
| 185 | <a class="indexterm" name="id364004"></a>
|
|---|
| 186 | You may ask, What are the benefits of this arrangement? The answer is obvious to those who have plumbed
|
|---|
| 187 | the dark depths of Windows networking architecture. Consider for a moment a server on which are stored
|
|---|
| 188 | 200,000 files, each with individual domain user and domain group settings. The company that owns the
|
|---|
| 189 | file server is bought by another company, resulting in the server being moved to another location, and then
|
|---|
| 190 | it is made a member of a different domain. Who would you think now owns all the files and directories?
|
|---|
| 191 | Answer: Account Unknown.
|
|---|
| 192 | </p><p>
|
|---|
| 193 | <a class="indexterm" name="id364019"></a>
|
|---|
| 194 | <a class="indexterm" name="id364026"></a>
|
|---|
| 195 | <a class="indexterm" name="id364032"></a>
|
|---|
| 196 | <a class="indexterm" name="id364039"></a>
|
|---|
| 197 | Unraveling the file ownership mess is an unenviable administrative task that can be avoided simply
|
|---|
| 198 | by using local groups to control all file and directory access control. In this case, only the members
|
|---|
| 199 | of the local groups will have been lost. The files and directories in the storage subsystem will still
|
|---|
| 200 | be owned by the local groups. The same goes for all ACLs on them. It is administratively much simpler
|
|---|
| 201 | to delete the <code class="constant">Account Unknown</code> membership entries inside local groups with appropriate
|
|---|
| 202 | entries for domain global groups in the new domain that the server has been made a member of.
|
|---|
| 203 | </p><p>
|
|---|
| 204 | <a class="indexterm" name="id364058"></a>
|
|---|
| 205 | <a class="indexterm" name="id364064"></a>
|
|---|
| 206 | <a class="indexterm" name="id364071"></a>
|
|---|
| 207 | <a class="indexterm" name="id364078"></a>
|
|---|
| 208 | <a class="indexterm" name="id364085"></a>
|
|---|
| 209 | <a class="indexterm" name="id364092"></a>
|
|---|
| 210 | <a class="indexterm" name="id364099"></a>
|
|---|
| 211 | <a class="indexterm" name="id364106"></a>
|
|---|
| 212 | Another prominent example of the use of nested groups involves implementation of administrative privileges
|
|---|
| 213 | on domain member workstations and servers. Administrative privileges are given to all members of the
|
|---|
| 214 | built-in local group <code class="constant">Administrators</code> on each domain member machine. To ensure that all domain
|
|---|
| 215 | administrators have full rights on the member server or workstation, on joining the domain, the
|
|---|
| 216 | <code class="constant">Domain Admins</code> group is added to the local Administrators group. Thus everyone who is
|
|---|
| 217 | logged into the domain as a member of the Domain Admins group is also granted local administrative
|
|---|
| 218 | privileges on each domain member.
|
|---|
| 219 | </p><p>
|
|---|
| 220 | <a class="indexterm" name="id364128"></a>
|
|---|
| 221 | <a class="indexterm" name="id364135"></a>
|
|---|
| 222 | <a class="indexterm" name="id364142"></a>
|
|---|
| 223 | <a class="indexterm" name="id364148"></a>
|
|---|
| 224 | UNIX/Linux has no concept of support for nested groups, and thus Samba has for a long time not supported
|
|---|
| 225 | them either. The problem is that you would have to enter UNIX groups as auxiliary members of a group in
|
|---|
| 226 | <code class="filename">/etc/group</code>. This does not work because it was not a design requirement at the time
|
|---|
| 227 | the UNIX file system security model was implemented. Since Samba-2.2, the winbind daemon can provide
|
|---|
| 228 | <code class="filename">/etc/group</code> entries on demand by obtaining user and group information from the domain
|
|---|
| 229 | controller that the Samba server is a member of.
|
|---|
| 230 | </p><p>
|
|---|
| 231 | <a class="indexterm" name="id364175"></a>
|
|---|
| 232 | <a class="indexterm" name="id364181"></a>
|
|---|
| 233 | <a class="indexterm" name="id364188"></a>
|
|---|
| 234 | <a class="indexterm" name="id364195"></a>
|
|---|
| 235 | <a class="indexterm" name="id364202"></a>
|
|---|
| 236 | In effect, Samba supplements the <code class="filename">/etc/group</code> data via the dynamic
|
|---|
| 237 | <code class="literal">libnss_winbind</code> mechanism. Beginning with Samba-3.0.3, this facility is used to provide
|
|---|
| 238 | local groups in the same manner as Windows. It works by expanding the local groups on the
|
|---|
| 239 | fly as they are accessed. For example, the <code class="constant">Domain Users</code> group of the domain is made
|
|---|
| 240 | a member of the local group <code class="constant">demo</code>. Whenever Samba needs to resolve membership of the
|
|---|
| 241 | <code class="constant">demo</code> local (alias) group, winbind asks the domain controller for demo members of the Domain Users
|
|---|
| 242 | group. By definition, it can only contain user objects, which can then be faked to be member of the
|
|---|
| 243 | UNIX/Linux group <code class="constant">demo</code>.
|
|---|
| 244 | </p><p>
|
|---|
| 245 | <a class="indexterm" name="id364243"></a>
|
|---|
| 246 | <a class="indexterm" name="id364250"></a>
|
|---|
| 247 | <a class="indexterm" name="id364256"></a>
|
|---|
| 248 | <a class="indexterm" name="id364263"></a>
|
|---|
| 249 | <a class="indexterm" name="id364270"></a>
|
|---|
| 250 | <a class="indexterm" name="id364276"></a>
|
|---|
| 251 | <a class="indexterm" name="id364283"></a>
|
|---|
| 252 | To enable the use of nested groups, <code class="literal">winbindd</code> must be used with NSS winbind.
|
|---|
| 253 | Creation and administration of the local groups is done best via the Windows Domain User Manager or its
|
|---|
| 254 | Samba equivalent, the utility <code class="literal">net rpc group</code>. Creating the local group
|
|---|
| 255 | <code class="constant">demo</code> is achieved by executing:
|
|---|
| 256 | </p><pre class="screen">
|
|---|
| 257 | <code class="prompt">root# </code> net rpc group add demo -L -Uroot%not24get
|
|---|
| 258 | </pre><p>
|
|---|
| 259 | <a class="indexterm" name="id364324"></a>
|
|---|
| 260 | <a class="indexterm" name="id364331"></a>
|
|---|
| 261 | Here the -L switch means that you want to create a local group. It may be necessary to add -S and -U
|
|---|
| 262 | switches for accessing the correct host with appropriate user or root privileges. Adding and removing
|
|---|
| 263 | group members can be done via the <code class="constant">addmem</code> and <code class="constant">delmem</code> subcommands of
|
|---|
| 264 | <code class="literal">net rpc group</code> command. For example, addition of <span class="quote">“<span class="quote">DOM\Domain Users</span>”</span> to the
|
|---|
| 265 | local group <code class="constant">demo</code> is done by executing:
|
|---|
| 266 | </p><pre class="screen">
|
|---|
| 267 | net rpc group addmem demo "DOM\Domain Users"
|
|---|
| 268 | </pre><p>
|
|---|
| 269 | <a class="indexterm" name="id364367"></a>
|
|---|
| 270 | <a class="indexterm" name="id364374"></a>
|
|---|
| 271 | <a class="indexterm" name="id364380"></a>
|
|---|
| 272 | <a class="indexterm" name="id364387"></a>
|
|---|
| 273 | Having completed these two steps, the execution of <code class="literal">getent group demo</code> will show demo
|
|---|
| 274 | members of the global <code class="constant">Domain Users</code> group as members of the group
|
|---|
| 275 | <code class="constant">demo</code>. This also works with any local or domain user. In case the domain DOM trusts
|
|---|
| 276 | another domain, it is also possible to add global users and groups of the trusted domain as members of
|
|---|
| 277 | <code class="constant">demo</code>. The users from the foreign domain who are members of the group that has been
|
|---|
| 278 | added to the <code class="constant">demo</code> group now have the same local access permissions as local domain
|
|---|
| 279 | users have.
|
|---|
| 280 | </p></div><div class="sect2" title="Important Administrative Information"><div class="titlepage"><div><div><h3 class="title"><a name="id364421"></a>Important Administrative Information</h3></div></div></div><p>
|
|---|
| 281 | Administrative rights are necessary in two specific forms:
|
|---|
| 282 | </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>For Samba-3 domain controllers and domain member servers/clients.</p></li><li class="listitem"><p>To manage domain member Windows workstations.</p></li></ol></div><p>
|
|---|
| 283 | <a class="indexterm" name="id364450"></a>
|
|---|
| 284 | <a class="indexterm" name="id364457"></a>
|
|---|
| 285 | <a class="indexterm" name="id364463"></a>
|
|---|
| 286 | Versions of Samba up to and including 3.0.10 do not provide a means for assigning rights and privileges
|
|---|
| 287 | that are necessary for system administration tasks from a Windows domain member client machine, so
|
|---|
| 288 | domain administration tasks such as adding, deleting, and changing user and group account information, and
|
|---|
| 289 | managing workstation domain membership accounts, can be handled by any account other than root.
|
|---|
| 290 | </p><p>
|
|---|
| 291 | <a class="indexterm" name="id364477"></a>
|
|---|
| 292 | <a class="indexterm" name="id364484"></a>
|
|---|
| 293 | <a class="indexterm" name="id364491"></a>
|
|---|
| 294 | Samba-3.0.11 introduced a new privilege management interface (see <a class="link" href="rights.html" title="Chapter 15. User Rights and Privileges">User Rights and Privileges</a>)
|
|---|
| 295 | that permits these tasks to be delegated to non-root (i.e., accounts other than the equivalent of the
|
|---|
| 296 | MS Windows Administrator) accounts.
|
|---|
| 297 | </p><p>
|
|---|
| 298 | <a class="indexterm" name="id364510"></a>
|
|---|
| 299 | <a class="indexterm" name="id364516"></a>
|
|---|
| 300 | Administrative tasks on a Windows domain member workstation can be done by anyone who is a member of the
|
|---|
| 301 | <code class="constant">Domain Admins</code> group. This group can be mapped to any convenient UNIX group.
|
|---|
| 302 | </p><div class="sect3" title="Applicable Only to Versions Earlier than 3.0.11"><div class="titlepage"><div><div><h4 class="title"><a name="id364529"></a>Applicable Only to Versions Earlier than 3.0.11</h4></div></div></div><p>
|
|---|
| 303 | <a class="indexterm" name="id364537"></a>
|
|---|
| 304 | Administrative tasks on UNIX/Linux systems, such as adding users or groups, requires
|
|---|
| 305 | <code class="constant">root</code>-level privilege. The addition of a Windows client to a Samba domain involves the
|
|---|
| 306 | addition of a user account for the Windows client.
|
|---|
| 307 | </p><p>
|
|---|
| 308 | <a class="indexterm" name="id364553"></a>
|
|---|
| 309 | <a class="indexterm" name="id364560"></a>
|
|---|
| 310 | Many UNIX administrators continue to request that the Samba Team make it possible to add Windows workstations, or
|
|---|
| 311 | the ability to add, delete, or modify user accounts, without requiring <code class="constant">root</code> privileges.
|
|---|
| 312 | Such a request violates every understanding of basic UNIX system security.
|
|---|
| 313 | </p><p>
|
|---|
| 314 | <a class="indexterm" name="id364576"></a>
|
|---|
| 315 | <a class="indexterm" name="id364583"></a>
|
|---|
| 316 | <a class="indexterm" name="id364589"></a>
|
|---|
| 317 | <a class="indexterm" name="id364596"></a>
|
|---|
| 318 | <a class="indexterm" name="id364603"></a>
|
|---|
| 319 | <a class="indexterm" name="id364610"></a>
|
|---|
| 320 | There is no safe way to provide access on a UNIX/Linux system without providing
|
|---|
| 321 | <code class="constant">root</code>-level privileges. Provision of <code class="constant">root</code> privileges can be done
|
|---|
| 322 | either by logging on to the Domain as the user <code class="constant">root</code> or by permitting particular users to
|
|---|
| 323 | use a UNIX account that has a UID=0 in the <code class="filename">/etc/passwd</code> database. Users of such accounts
|
|---|
| 324 | can use tools like the NT4 Domain User Manager and the NT4 Domain Server Manager to manage user and group
|
|---|
| 325 | accounts as well as domain member server and client accounts. This level of privilege is also needed to manage
|
|---|
| 326 | share-level ACLs.
|
|---|
| 327 | </p></div></div><div class="sect2" title="Default Users, Groups, and Relative Identifiers"><div class="titlepage"><div><div><h3 class="title"><a name="id364641"></a>Default Users, Groups, and Relative Identifiers</h3></div></div></div><p>
|
|---|
| 328 | <a class="indexterm" name="id364649"></a>
|
|---|
| 329 | <a class="indexterm" name="id364658"></a>
|
|---|
| 330 | <a class="indexterm" name="id364665"></a>
|
|---|
| 331 | <a class="indexterm" name="id364671"></a>
|
|---|
| 332 | <a class="indexterm" name="id364678"></a>
|
|---|
| 333 | <a class="indexterm" name="id364685"></a>
|
|---|
| 334 | <a class="indexterm" name="id364692"></a>
|
|---|
| 335 | <a class="indexterm" name="id364699"></a>
|
|---|
| 336 | When first installed, Windows NT4/200x/XP are preconfigured with certain user, group, and
|
|---|
| 337 | alias entities. Each has a well-known RID. These must be preserved for continued
|
|---|
| 338 | integrity of operation. Samba must be provisioned with certain essential domain groups that require
|
|---|
| 339 | the appropriate RID value. When Samba-3 is configured to use <code class="constant">tdbsam</code>, the essential
|
|---|
| 340 | domain groups are automatically created. It is the LDAP administrator's responsibility to create
|
|---|
| 341 | (provision) the default NT groups.
|
|---|
| 342 | </p><p>
|
|---|
| 343 | <a class="indexterm" name="id364716"></a>
|
|---|
| 344 | <a class="indexterm" name="id364723"></a>
|
|---|
| 345 | <a class="indexterm" name="id364730"></a>
|
|---|
| 346 | <a class="indexterm" name="id364737"></a>
|
|---|
| 347 | Each essential domain group must be assigned its respective well-known RID. The default users, groups,
|
|---|
| 348 | aliases, and RIDs are shown in <a class="link" href="groupmapping.html#WKURIDS" title="Table 12.1. Well-Known User Default RIDs">Well-Known User Default RIDs</a>.
|
|---|
| 349 | </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 350 | <a class="indexterm" name="id364757"></a>
|
|---|
| 351 | <a class="indexterm" name="id364764"></a>
|
|---|
| 352 | <a class="indexterm" name="id364770"></a>
|
|---|
| 353 | <a class="indexterm" name="id364777"></a>
|
|---|
| 354 | <a class="indexterm" name="id364784"></a>
|
|---|
| 355 | It is the administrator's responsibility to create the essential domain groups and to assign each
|
|---|
| 356 | its default RID.
|
|---|
| 357 | </p></div><p>
|
|---|
| 358 | <a class="indexterm" name="id364795"></a>
|
|---|
| 359 | <a class="indexterm" name="id364802"></a>
|
|---|
| 360 | It is permissible to create any domain group that may be necessary; just make certain that the essential
|
|---|
| 361 | domain groups (well known) have been created and assigned their default RIDs. Other groups you create may
|
|---|
| 362 | be assigned any arbitrary RID you care to use.
|
|---|
| 363 | </p><p>
|
|---|
| 364 | Be sure to map each domain group to a UNIX system group. That is the only way to ensure that the group
|
|---|
| 365 | will be available for use as an NT domain group.
|
|---|
| 366 | </p><p>
|
|---|
| 367 | </p><div class="table"><a name="WKURIDS"></a><p class="title"><b>Table 12.1. Well-Known User Default RIDs</b></p><div class="table-contents"><table summary="Well-Known User Default RIDs" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="center"></colgroup><thead><tr><th align="left">Well-Known Entity</th><th align="left">RID</th><th align="left">Type</th><th align="center">Essential</th></tr></thead><tbody><tr><td align="left">Domain Administrator</td><td align="left">500</td><td align="left">User</td><td align="center">No</td></tr><tr><td align="left">Domain Guest</td><td align="left">501</td><td align="left">User</td><td align="center">No</td></tr><tr><td align="left">Domain KRBTGT</td><td align="left">502</td><td align="left">User</td><td align="center">No</td></tr><tr><td align="left">Domain Admins</td><td align="left">512</td><td align="left">Group</td><td align="center">Yes</td></tr><tr><td align="left">Domain Users</td><td align="left">513</td><td align="left">Group</td><td align="center">Yes</td></tr><tr><td align="left">Domain Guests</td><td align="left">514</td><td align="left">Group</td><td align="center">Yes</td></tr><tr><td align="left">Domain Computers</td><td align="left">515</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Domain Controllers</td><td align="left">516</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Domain Certificate Admins</td><td align="left">517</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Domain Schema Admins</td><td align="left">518</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Domain Enterprise Admins</td><td align="left">519</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Domain Policy Admins</td><td align="left">520</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Builtin Admins</td><td align="left">544</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin users</td><td align="left">545</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Guests</td><td align="left">546</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Power Users</td><td align="left">547</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Account Operators</td><td align="left">548</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin System Operators</td><td align="left">549</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Print Operators</td><td align="left">550</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Backup Operators</td><td align="left">551</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Replicator</td><td align="left">552</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin RAS Servers</td><td align="left">553</td><td align="left">Alias</td><td align="center">No</td></tr></tbody></table></div></div><p><br class="table-break">
|
|---|
| 368 | </p></div><div class="sect2" title="Example Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id365250"></a>Example Configuration</h3></div></div></div><p>
|
|---|
| 369 | <a class="indexterm" name="id365257"></a>
|
|---|
| 370 | You can list the various groups in the mapping database by executing
|
|---|
| 371 | <code class="literal">net groupmap list</code>. Here is an example:
|
|---|
| 372 | </p><p>
|
|---|
| 373 | <a class="indexterm" name="id365279"></a>
|
|---|
| 374 | </p><pre class="screen">
|
|---|
| 375 | <code class="prompt">root# </code> <strong class="userinput"><code>net groupmap list</code></strong>
|
|---|
| 376 | Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
|
|---|
| 377 | Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
|
|---|
| 378 | Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
|
|---|
| 379 | </pre><p>
|
|---|
| 380 | </p><p>
|
|---|
| 381 | For complete details on <code class="literal">net groupmap</code>, refer to the net(8) man page.
|
|---|
| 382 | </p></div></div><div class="sect1" title="Configuration Scripts"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id365321"></a>Configuration Scripts</h2></div></div></div><p>
|
|---|
| 383 | Everyone needs tools. Some of us like to create our own, others prefer to use canned tools
|
|---|
| 384 | (i.e., prepared by someone else for general use).
|
|---|
| 385 | </p><div class="sect2" title="Sample smb.conf Add Group Script"><div class="titlepage"><div><div><h3 class="title"><a name="id365331"></a>Sample <code class="filename">smb.conf</code> Add Group Script</h3></div></div></div><p>
|
|---|
| 386 | <a class="indexterm" name="id365345"></a>
|
|---|
| 387 | <a class="indexterm" name="id365352"></a>
|
|---|
| 388 | <a class="indexterm" name="id365359"></a>
|
|---|
| 389 | <a class="indexterm" name="id365365"></a>
|
|---|
| 390 | <a class="indexterm" name="id365372"></a>
|
|---|
| 391 | A script to create complying group names for use by the Samba group interfaces
|
|---|
| 392 | is provided in <a class="link" href="groupmapping.html#smbgrpadd.sh" title="Example 12.1. smbgrpadd.sh">smbgrpadd.sh</a>. This script
|
|---|
| 393 | adds a temporary entry in the <code class="filename">/etc/group</code> file and then renames
|
|---|
| 394 | it to the desired name. This is an example of a method to get around operating
|
|---|
| 395 | system maintenance tool limitations such as those present in some version of the
|
|---|
| 396 | <code class="literal">groupadd</code> tool.
|
|---|
| 397 | </p><div class="example"><a name="smbgrpadd.sh"></a><p class="title"><b>Example 12.1. smbgrpadd.sh</b></p><div class="example-contents"><pre class="programlisting">
|
|---|
| 398 | #!/bin/bash
|
|---|
| 399 |
|
|---|
| 400 | # Add the group using normal system groupadd tool.
|
|---|
| 401 | groupadd smbtmpgrp00
|
|---|
| 402 |
|
|---|
| 403 | thegid=`cat /etc/group | grep ^smbtmpgrp00 | cut -d ":" -f3`
|
|---|
| 404 |
|
|---|
| 405 | # Now change the name to what we want for the MS Windows networking end
|
|---|
| 406 | cp /etc/group /etc/group.bak
|
|---|
| 407 | cat /etc/group.bak | sed "s/^smbtmpgrp00/$1/g" > /etc/group
|
|---|
| 408 | rm /etc/group.bak
|
|---|
| 409 |
|
|---|
| 410 | # Now return the GID as would normally happen.
|
|---|
| 411 | echo $thegid
|
|---|
| 412 | exit 0
|
|---|
| 413 | </pre></div></div><p><br class="example-break">
|
|---|
| 414 | </p><p>
|
|---|
| 415 | The <code class="filename">smb.conf</code> entry for the above script shown in <a class="link" href="groupmapping.html#smbgrpadd" title="Example 12.2. Configuration of smb.conf for the add group Script">the configuration of
|
|---|
| 416 | <code class="filename">smb.conf</code> for the add group Script</a> demonstrates how it may be used.
|
|---|
| 417 |
|
|---|
| 418 | </p><div class="example"><a name="smbgrpadd"></a><p class="title"><b>Example 12.2. Configuration of <code class="filename">smb.conf</code> for the add group Script</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id365475"></a><em class="parameter"><code>add group script = /path_to_tool/smbgrpadd.sh "%g"</code></em></td></tr></table></div></div><p><br class="example-break">
|
|---|
| 419 | </p></div><div class="sect2" title="Script to Configure Group Mapping"><div class="titlepage"><div><div><h3 class="title"><a name="id365490"></a>Script to Configure Group Mapping</h3></div></div></div><p>
|
|---|
| 420 | <a class="indexterm" name="id365498"></a>
|
|---|
| 421 | In our example we have created a UNIX/Linux group called <code class="literal">ntadmin</code>.
|
|---|
| 422 | Our script will create the additional groups <code class="literal">Orks</code>, <code class="literal">Elves</code>, and <code class="literal">Gnomes</code>.
|
|---|
| 423 | It is a good idea to save this shell script for later use just in case you ever need to rebuild your mapping database.
|
|---|
| 424 | For the sake of convenience we elect to save this script as a file called <code class="filename">initGroups.sh</code>.
|
|---|
| 425 | This script is given in <a class="link" href="groupmapping.html#set-group-map" title="Example 12.3. Script to Set Group Mapping">intGroups.sh</a>.
|
|---|
| 426 | <a class="indexterm" name="id365545"></a>
|
|---|
| 427 | </p><div class="example"><a name="set-group-map"></a><p class="title"><b>Example 12.3. Script to Set Group Mapping</b></p><div class="example-contents"><pre class="programlisting">
|
|---|
| 428 | #!/bin/bash
|
|---|
| 429 |
|
|---|
| 430 | net groupmap add ntgroup="Domain Admins" unixgroup=ntadmin rid=512 type=d
|
|---|
| 431 | net groupmap add ntgroup="Domain Users" unixgroup=users rid=513 type=d
|
|---|
| 432 | net groupmap add ntgroup="Domain Guests" unixgroup=nobody rid=514 type=d
|
|---|
| 433 |
|
|---|
| 434 | groupadd Orks
|
|---|
| 435 | groupadd Elves
|
|---|
| 436 | groupadd Gnomes
|
|---|
| 437 |
|
|---|
| 438 | net groupmap add ntgroup="Orks" unixgroup=Orks type=d
|
|---|
| 439 | net groupmap add ntgroup="Elves" unixgroup=Elves type=d
|
|---|
| 440 | net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d
|
|---|
| 441 | </pre></div></div><p><br class="example-break">
|
|---|
| 442 | </p><p>
|
|---|
| 443 | Of course it is expected that the administrator will modify this to suit local needs.
|
|---|
| 444 | For information regarding the use of the <code class="literal">net groupmap</code> tool please
|
|---|
| 445 | refer to the man page.
|
|---|
| 446 | </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 447 | Versions of Samba-3 prior to 3.0.23 automatically create default group mapping for the
|
|---|
| 448 | <code class="literal">Domain Admins, Domain Users</code> and <code class="literal">Domain Guests</code> Windows
|
|---|
| 449 | groups, but do not map them to UNIX GIDs. This was a cause of administrative confusion and
|
|---|
| 450 | trouble. Commencing with Samba-3.0.23 this anomaly has been fixed - thus all Windows groups
|
|---|
| 451 | must now be manually and explicitly created and mapped to a valid UNIX GID by the Samba
|
|---|
| 452 | administrator.
|
|---|
| 453 | </p></div></div></div><div class="sect1" title="Common Errors"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id365604"></a>Common Errors</h2></div></div></div><p>
|
|---|
| 454 | At this time there are many little surprises for the unwary administrator. In a real sense
|
|---|
| 455 | it is imperative that every step of automated control scripts be carefully tested
|
|---|
| 456 | manually before putting it into active service.
|
|---|
| 457 | </p><div class="sect2" title="Adding Groups Fails"><div class="titlepage"><div><div><h3 class="title"><a name="id365615"></a>Adding Groups Fails</h3></div></div></div><p>
|
|---|
| 458 | <a class="indexterm" name="id365623"></a>
|
|---|
| 459 | This is a common problem when the <code class="literal">groupadd</code> is called directly
|
|---|
| 460 | by the Samba interface script for the <a class="link" href="smb.conf.5.html#ADDGROUPSCRIPT" target="_top">add group script</a> in
|
|---|
| 461 | the <code class="filename">smb.conf</code> file.
|
|---|
| 462 | </p><p>
|
|---|
| 463 | <a class="indexterm" name="id365658"></a>
|
|---|
| 464 | <a class="indexterm" name="id365665"></a>
|
|---|
| 465 | The most common cause of failure is an attempt to add an MS Windows group account
|
|---|
| 466 | that has an uppercase character and/or a space character in it.
|
|---|
| 467 | </p><p>
|
|---|
| 468 | <a class="indexterm" name="id365676"></a>
|
|---|
| 469 | There are three possible workarounds. First, use only group names that comply
|
|---|
| 470 | with the limitations of the UNIX/Linux <code class="literal">groupadd</code> system tool.
|
|---|
| 471 | Second, it involves the use of the script mentioned earlier in this chapter, and
|
|---|
| 472 | third is the option is to manually create a UNIX/Linux group account that can substitute
|
|---|
| 473 | for the MS Windows group name, then use the procedure listed above to map that group
|
|---|
| 474 | to the MS Windows group.
|
|---|
| 475 | </p></div><div class="sect2" title="Adding Domain Users to the Workstation Power Users Group"><div class="titlepage"><div><div><h3 class="title"><a name="id365695"></a>Adding Domain Users to the Workstation Power Users Group</h3></div></div></div><p><span class="quote">“<span class="quote">
|
|---|
| 476 | What must I do to add domain users to the Power Users group?
|
|---|
| 477 | </span>”</span></p><p>
|
|---|
| 478 | <a class="indexterm" name="id365708"></a>
|
|---|
| 479 | The Power Users group is a group that is local to each Windows 200x/XP Professional workstation.
|
|---|
| 480 | You cannot add the Domain Users group to the Power Users group automatically, it must be done on
|
|---|
| 481 | each workstation by logging in as the local workstation <span class="emphasis"><em>administrator</em></span> and
|
|---|
| 482 | then using the following procedure:
|
|---|
| 483 | </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
|
|---|
| 484 | Click <span class="guimenu">Start -> Control Panel -> Users and Passwords</span>.
|
|---|
| 485 | </p></li><li class="step" title="Step 2"><p>
|
|---|
| 486 | Click the <span class="guimenuitem">Advanced</span> tab.
|
|---|
| 487 | </p></li><li class="step" title="Step 3"><p>
|
|---|
| 488 | Click the <span class="guibutton">Advanced</span> button.
|
|---|
| 489 | </p></li><li class="step" title="Step 4"><p>
|
|---|
| 490 | Click <code class="constant">Groups</code>.
|
|---|
| 491 | </p></li><li class="step" title="Step 5"><p>
|
|---|
| 492 | Double-click <code class="constant">Power Users</code>. This will launch the panel to add users or groups
|
|---|
| 493 | to the local machine <code class="constant">Power Users</code> group.
|
|---|
| 494 | </p></li><li class="step" title="Step 6"><p>
|
|---|
| 495 | Click the <span class="guibutton">Add</span> button.
|
|---|
| 496 | </p></li><li class="step" title="Step 7"><p>
|
|---|
| 497 | Select the domain from which the <code class="constant">Domain Users</code> group is to be added.
|
|---|
| 498 | </p></li><li class="step" title="Step 8"><p>
|
|---|
| 499 | Double-click the <code class="constant">Domain Users</code> group.
|
|---|
| 500 | </p></li><li class="step" title="Step 9"><p>
|
|---|
| 501 | Click the <span class="guibutton">OK</span> button. If a logon box is presented during this process,
|
|---|
| 502 | please remember to enter the connect as <code class="constant">DOMAIN\UserName</code>, that is, for the
|
|---|
| 503 | domain <code class="constant">MIDEARTH</code> and the user <code class="constant">root</code> enter
|
|---|
| 504 | <code class="constant">MIDEARTH\root</code>.
|
|---|
| 505 | </p></li></ol></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="passdb.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="NetCommand.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 11. Account Information Databases </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 13. Remote and Local Management: The Net Command</td></tr></table></div></body></html>
|
|---|
