Ignore:
Timestamp:
May 29, 2008, 12:22:03 PM (17 years ago)
Author:
Paul Smedley
Message:

Update trunk to 3.2.0rc1

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/samba/docs/htmldocs/Samba3-HOWTO/groupmapping.html

    r133 r136  
    1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Group Mapping: MS Windows and UNIX</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="passdb.html" title="Chapter 11. Account Information Databases"><link rel="next" href="NetCommand.html" title="Chapter 13. Remote and Local Management: The Net Command"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Group Mapping: MS Windows and UNIX</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="passdb.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="NetCommand.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="groupmapping"></a>Chapter 12. Group Mapping: MS Windows and UNIX</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jean François</span> <span class="surname">Micouleau</span></h3></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jerry@samba.org">jerry@samba.org</a>&gt;</code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="groupmapping.html#id2616464">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="groupmapping.html#id2616857">Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2617193">Warning: User Private Group Problems</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2617251">Nested Groups: Adding Windows Domain Groups to Windows Local Groups</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2617827">Important Administrative Information</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2618067">Default Users, Groups, and Relative Identifiers</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2618690">Example Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="groupmapping.html#id2618767">Configuration Scripts</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2618779">Sample <code class="filename">smb.conf</code> Add Group Script</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2618951">Script to Configure Group Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="groupmapping.html#id2619078">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2619091">Adding Groups Fails</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2619164">Adding Domain Users to the Workstation Power Users Group</a></span></dt></dl></dd></dl></div><p>
    2 <a class="indexterm" name="id2616338"></a>
    3 <a class="indexterm" name="id2616348"></a>
    4 <a class="indexterm" name="id2616354"></a>
    5 <a class="indexterm" name="id2616361"></a>
    6 <a class="indexterm" name="id2616368"></a>
    7 <a class="indexterm" name="id2616375"></a>
     1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Group Mapping: MS Windows and UNIX</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="passdb.html" title="Chapter 11. Account Information Databases"><link rel="next" href="NetCommand.html" title="Chapter 13. Remote and Local Management: The Net Command"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Group Mapping: MS Windows and UNIX</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="passdb.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="NetCommand.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="groupmapping"></a>Chapter 12. Group Mapping: MS Windows and UNIX</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jean François</span> <span class="surname">Micouleau</span></h3></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jerry@samba.org">jerry@samba.org</a>&gt;</code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="groupmapping.html#id2617919">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="groupmapping.html#id2618334">Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2618670">Warning: User Private Group Problems</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2618728">Nested Groups: Adding Windows Domain Groups to Windows Local Groups</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2619304">Important Administrative Information</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2619545">Default Users, Groups, and Relative Identifiers</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2620168">Example Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="groupmapping.html#id2620244">Configuration Scripts</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2620256">Sample <code class="filename">smb.conf</code> Add Group Script</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2620428">Script to Configure Group Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="groupmapping.html#id2620555">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2620568">Adding Groups Fails</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2620655">Adding Domain Users to the Workstation Power Users Group</a></span></dt></dl></dd></dl></div><p>
     2<a class="indexterm" name="id2617794"></a>
     3<a class="indexterm" name="id2617803"></a>
     4<a class="indexterm" name="id2617809"></a>
     5<a class="indexterm" name="id2617816"></a>
     6<a class="indexterm" name="id2617823"></a>
     7<a class="indexterm" name="id2617830"></a>
    88        Starting with Samba-3, new group mapping functionality is available to create associations
    99        between Windows group SIDs and UNIX group GIDs. The <code class="literal">groupmap</code> subcommand
    1010        included with the <span class="application">net</span> tool can be used to manage these associations.
    1111        </p><p>
    12 <a class="indexterm" name="id2616400"></a>
    13 <a class="indexterm" name="id2616407"></a>
     12<a class="indexterm" name="id2617855"></a>
     13<a class="indexterm" name="id2617862"></a>
    1414        The new facility for mapping NT groups to UNIX system groups allows the administrator to decide
    1515        which NT domain groups are to be exposed to MS Windows clients. Only those NT groups that map
    … …  
    1717        in group selection lists in tools that access domain users and groups.
    1818        </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
    19         <a class="indexterm" name="id2616428"></a>
    20 <a class="indexterm" name="id2616435"></a>
     19        <a class="indexterm" name="id2617883"></a>
     20<a class="indexterm" name="id2617890"></a>
    2121        The <em class="parameter"><code>domain admin group</code></em> parameter has been removed in Samba-3 and should no longer
    2222        be specified in <code class="filename">smb.conf</code>. In Samba-2.2.x, this parameter was used to give the listed users membership in the
    2323        <code class="constant">Domain Admins</code> Windows group, which gave local admin rights on their workstations
    2424        (in default configurations).
    25         </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616464"></a>Features and Benefits</h2></div></div></div><p>
     25        </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2617919"></a>Features and Benefits</h2></div></div></div><p>
    2626        Samba allows the administrator to create MS Windows NT4/200x group accounts and to
    2727        arbitrarily associate them with UNIX/Linux group accounts.
    2828        </p><p>
    29         <a class="indexterm" name="id2616478"></a>
    30         <a class="indexterm" name="id2616484"></a>
    31         <a class="indexterm" name="id2616491"></a>
    32 <a class="indexterm" name="id2616498"></a>
    33 <a class="indexterm" name="id2616504"></a>
    34 <a class="indexterm" name="id2616511"></a>
    35 <a class="indexterm" name="id2616518"></a>
     29        <a class="indexterm" name="id2617933"></a>
     30        <a class="indexterm" name="id2617940"></a>
     31        <a class="indexterm" name="id2617946"></a>
     32<a class="indexterm" name="id2617953"></a>
     33<a class="indexterm" name="id2617960"></a>
     34<a class="indexterm" name="id2617966"></a>
     35<a class="indexterm" name="id2617973"></a>
    3636        Group accounts can be managed using the MS Windows NT4 or MS Windows 200x/XP Professional MMC tools.
    3737        Appropriate interface scripts should be provided in <code class="filename">smb.conf</code> if it is desired that UNIX/Linux system
    … …  
    3939        so long as <code class="literal">winbindd</code> is running, Samba group accounts that are created using these
    4040        tools will be allocated UNIX UIDs and GIDs from the ID range specified by the
    41         idmap uid/idmap gid
     41        <a class="link" href="smb.conf.5.html#IDMAPUID">idmap uid</a>/<a class="link" href="smb.conf.5.html#IDMAPGID">idmap gid</a>
    4242        parameters in the <code class="filename">smb.conf</code> file.
    4343        </p><div class="figure"><a name="idmap-sid2gid"></a><p class="title"><b>Figure 12.1. IDMAP: Group SID-to-GID Resolution.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/idmap-sid2gid.png" width="270" alt="IDMAP: Group SID-to-GID Resolution."></div></div></div><br class="figure-break"><div class="figure"><a name="idmap-gid2sid"></a><p class="title"><b>Figure 12.2. IDMAP: GID Resolution to Matching SID.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/idmap-gid2sid.png" width="270" alt="IDMAP: GID Resolution to Matching SID."></div></div></div><br class="figure-break"><p>
    44         <a class="indexterm" name="id2616638"></a>
    45 <a class="indexterm" name="id2616645"></a>
    46 <a class="indexterm" name="id2616652"></a>
    47 <a class="indexterm" name="id2616661"></a>
     44        <a class="indexterm" name="id2618115"></a>
     45<a class="indexterm" name="id2618122"></a>
     46<a class="indexterm" name="id2618129"></a>
     47<a class="indexterm" name="id2618138"></a>
    4848        In both cases, when winbindd is not running, only locally resolvable groups can be recognized. Please refer to
    4949        <a class="link" href="groupmapping.html#idmap-sid2gid" title="Figure 12.1. IDMAP: Group SID-to-GID Resolution.">IDMAP: Group SID-to-GID Resolution</a> and <a class="link" href="groupmapping.html#idmap-gid2sid" title="Figure 12.2. IDMAP: GID Resolution to Matching SID.">IDMAP: GID Resolution to Matching SID</a>.  The <code class="literal">net groupmap</code> is
    … …  
    5151        group mappings</a>.
    5252        </p><div class="figure"><a name="idmap-store-gid2sid"></a><p class="title"><b>Figure 12.3. IDMAP Storing Group Mappings.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/idmap-store-gid2sid.png" width="270" alt="IDMAP Storing Group Mappings."></div></div></div><br class="figure-break"><p>
    53         <a class="indexterm" name="id2616747"></a>
    54         <a class="indexterm" name="id2616754"></a>
    55 <a class="indexterm" name="id2616760"></a>
    56 <a class="indexterm" name="id2616767"></a>
     53        <a class="indexterm" name="id2618224"></a>
     54        <a class="indexterm" name="id2618231"></a>
     55<a class="indexterm" name="id2618238"></a>
     56<a class="indexterm" name="id2618244"></a>
    5757        Administrators should be aware that where <code class="filename">smb.conf</code> group interface scripts make
    5858        direct calls to the UNIX/Linux system tools (the shadow utilities, <code class="literal">groupadd</code>,
    … …  
    6363        UNIX/Linux group, an attempt that will of course fail.
    6464        </p><p>
    65         <a class="indexterm" name="id2616814"></a>
    66         <a class="indexterm" name="id2616821"></a>
     65        <a class="indexterm" name="id2618292"></a>
     66        <a class="indexterm" name="id2618298"></a>
    6767        There are several possible workarounds for the operating system tools limitation. One
    6868        method is to use a script that generates a name for the UNIX/Linux system group that
    … …  
    7070        back to the calling Samba interface. This will provide a dynamic workaround solution.
    7171        </p><p>
    72 <a class="indexterm" name="id2616837"></a>
     72<a class="indexterm" name="id2618314"></a>
    7373        Another workaround is to manually create a UNIX/Linux group, then manually create the
    7474        MS Windows NT4/200x group on the Samba server, and then use the <code class="literal">net groupmap</code>
    7575        tool to connect the two to each other.
    76         </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616857"></a>Discussion</h2></div></div></div><p>
    77 <a class="indexterm" name="id2616865"></a>
    78 <a class="indexterm" name="id2616872"></a>
     76        </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2618334"></a>Discussion</h2></div></div></div><p>
     77<a class="indexterm" name="id2618342"></a>
     78<a class="indexterm" name="id2618349"></a>
    7979        When you install <span class="application">MS Windows NT4/200x</span> on a computer, the installation
    8080        program creates default users and groups, notably the <code class="constant">Administrators</code> group,
    … …  
    8383        local machine.
    8484        </p><p>
    85         <a class="indexterm" name="id2616897"></a>
     85        <a class="indexterm" name="id2618374"></a>
    8686        The <code class="constant">Administrator</code> user is a member of the <code class="constant">Administrators</code> group, and thus inherits
    8787        <code class="constant">Administrators</code> group privileges. If a <code class="constant">joe</code> user is created to be a member of the
    … …  
    8989        <code class="constant">Administrator</code>.
    9090        </p><p>
    91 <a class="indexterm" name="id2616935"></a>
    92 <a class="indexterm" name="id2616942"></a>
    93 <a class="indexterm" name="id2616949"></a>
    94 <a class="indexterm" name="id2616956"></a>
     91<a class="indexterm" name="id2618412"></a>
     92<a class="indexterm" name="id2618419"></a>
     93<a class="indexterm" name="id2618426"></a>
     94<a class="indexterm" name="id2618433"></a>
    9595        When an MS Windows NT4/200x/XP machine is made a domain member, the &#8220;<span class="quote">Domain Admins</span>&#8221; group of the
    9696        PDC is added to the local <code class="constant">Administrators</code> group of the workstation. Every member of the
    … …  
    9898        logging on the workstation.
    9999        </p><p>
    100 <a class="indexterm" name="id2616985"></a>
    101 <a class="indexterm" name="id2616992"></a>
     100<a class="indexterm" name="id2618462"></a>
     101<a class="indexterm" name="id2618469"></a>
    102102        The following steps describe how to make Samba PDC users members of the <code class="constant">Domain Admins</code> group.
    103103        </p><div class="orderedlist"><ol type="1"><li><p>
    104104                Create a UNIX group (usually in <code class="filename">/etc/group</code>); let's call it <code class="constant">domadm</code>.
    105105                </p></li><li><p>
    106 <a class="indexterm" name="id2617029"></a>
     106<a class="indexterm" name="id2618506"></a>
    107107                Add to this group the users that must be &#8220;<span class="quote">Administrators</span>&#8221;. For example,
    108108                if you want <code class="constant">joe, john</code>, and <code class="constant">mary</code> to be administrators,
    … …  
    118118</pre><p>
    119119                </p><p>
    120                 <a class="indexterm" name="id2617096"></a>
     120                <a class="indexterm" name="id2618574"></a>
    121121                The quotes around &#8220;<span class="quote">Domain Admins</span>&#8221; are necessary due to the space in the group name.
    122122                Also make sure to leave no white space surrounding the equal character (=).
    … …  
    124124        Now <code class="constant">joe, john</code>, and <code class="constant">mary</code> are domain administrators.
    125125        </p><p>
    126         <a class="indexterm" name="id2617125"></a>
     126        <a class="indexterm" name="id2618603"></a>
    127127        It is possible to map any arbitrary UNIX group to any Windows NT4/200x group as well as
    128128        to make any UNIX group a Windows domain group. For example, if you wanted to include a
    … …  
    136136        the space from being interpreted as a command delimiter.
    137137        </p><p>
    138 <a class="indexterm" name="id2617172"></a>
    139 <a class="indexterm" name="id2617179"></a>
     138<a class="indexterm" name="id2618650"></a>
     139<a class="indexterm" name="id2618656"></a>
    140140        Be aware that the RID parameter is an unsigned 32-bit integer that should
    141141        normally start at 1000. However, this RID must not overlap with any RID assigned
    … …  
    143143        you are using. Future versions of the tools may perform the verification automatically,
    144144        but for now the burden is on you.
    145         </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2617193"></a>Warning: User Private Group Problems</h3></div></div></div><p>
    146 <a class="indexterm" name="id2617202"></a>
    147 <a class="indexterm" name="id2617208"></a>
    148 <a class="indexterm" name="id2617215"></a>
     145        </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618670"></a>Warning: User Private Group Problems</h3></div></div></div><p>
     146<a class="indexterm" name="id2618679"></a>
     147<a class="indexterm" name="id2618686"></a>
     148<a class="indexterm" name="id2618693"></a>
    149149        Windows does not permit user and group accounts to have the same name.
    150150        This has serious implications for all sites that use private group accounts.
    … …  
    153153        of Linux, by default create private groups.
    154154        </p><p>
    155 <a class="indexterm" name="id2617232"></a>
    156 <a class="indexterm" name="id2617239"></a>
     155<a class="indexterm" name="id2618709"></a>
     156<a class="indexterm" name="id2618716"></a>
    157157        When mapping a UNIX/Linux group to a Windows group account, all conflict can
    158158        be avoided by assuring that the Windows domain group name does not overlap
    159159        with any user account name.
    160         </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2617251"></a>Nested Groups: Adding Windows Domain Groups to Windows Local Groups</h3></div></div></div><a class="indexterm" name="id2617257"></a><p>
    161 <a class="indexterm" name="id2617269"></a>
     160        </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618728"></a>Nested Groups: Adding Windows Domain Groups to Windows Local Groups</h3></div></div></div><a class="indexterm" name="id2618735"></a><p>
     161<a class="indexterm" name="id2618746"></a>
    162162        This functionality is known as <code class="constant">nested groups</code> and was first added to
    163163        Samba-3.0.3.
    164164        </p><p>
    165 <a class="indexterm" name="id2617284"></a>
     165<a class="indexterm" name="id2618761"></a>
    166166        All MS Windows products since the release of Windows NT 3.10 support the use of nested groups.
    167167        Many Windows network administrators depend on this capability because it greatly simplifies security
    168168        administration.
    169169        </p><p>
    170 <a class="indexterm" name="id2617298"></a>
    171 <a class="indexterm" name="id2617305"></a>
    172 <a class="indexterm" name="id2617312"></a>
    173 <a class="indexterm" name="id2617319"></a>
    174 <a class="indexterm" name="id2617326"></a>
    175 <a class="indexterm" name="id2617333"></a>
    176 <a class="indexterm" name="id2617340"></a>
     170<a class="indexterm" name="id2618775"></a>
     171<a class="indexterm" name="id2618782"></a>
     172<a class="indexterm" name="id2618789"></a>
     173<a class="indexterm" name="id2618796"></a>
     174<a class="indexterm" name="id2618803"></a>
     175<a class="indexterm" name="id2618810"></a>
     176<a class="indexterm" name="id2618817"></a>
    177177        The nested group architecture was designed with the premise that day-to-day user and group membership
    178178        management should be performed on the domain security database. The application of group security
    … …  
    181181        domain global groups and domain global users.
    182182        </p><p>
    183 <a class="indexterm" name="id2617358"></a>
    184 <a class="indexterm" name="id2617365"></a>
    185 <a class="indexterm" name="id2617372"></a>
     183<a class="indexterm" name="id2618835"></a>
     184<a class="indexterm" name="id2618842"></a>
     185<a class="indexterm" name="id2618849"></a>
    186186        You may ask, What are the benefits of this arrangement? The answer is obvious to those who have plumbed
    187187        the dark depths of Windows networking architecture. Consider for a moment a server on which are stored
    … …  
    191191        Answer: Account Unknown.
    192192        </p><p>
    193 <a class="indexterm" name="id2617391"></a>
    194 <a class="indexterm" name="id2617398"></a>
    195 <a class="indexterm" name="id2617405"></a>
    196 <a class="indexterm" name="id2617412"></a>
     193<a class="indexterm" name="id2618868"></a>
     194<a class="indexterm" name="id2618875"></a>
     195<a class="indexterm" name="id2618882"></a>
     196<a class="indexterm" name="id2618889"></a>
    197197        Unraveling the file ownership mess is an unenviable administrative task that can be avoided simply
    198198        by using local groups to control all file and directory access control. In this case, only the members
    … …  
    202202        entries for domain global groups in the new domain that the server has been made a member of.
    203203        </p><p>
    204 <a class="indexterm" name="id2617435"></a>
    205 <a class="indexterm" name="id2617442"></a>
    206 <a class="indexterm" name="id2617449"></a>
    207 <a class="indexterm" name="id2617456"></a>
    208 <a class="indexterm" name="id2617463"></a>
    209 <a class="indexterm" name="id2617470"></a>
    210 <a class="indexterm" name="id2617477"></a>
    211 <a class="indexterm" name="id2617484"></a>
     204<a class="indexterm" name="id2618912"></a>
     205<a class="indexterm" name="id2618919"></a>
     206<a class="indexterm" name="id2618926"></a>
     207<a class="indexterm" name="id2618934"></a>
     208<a class="indexterm" name="id2618941"></a>
     209<a class="indexterm" name="id2618948"></a>
     210<a class="indexterm" name="id2618954"></a>
     211<a class="indexterm" name="id2618961"></a>
    212212        Another prominent example of the use of nested groups involves implementation of administrative privileges
    213213        on domain member workstations and servers. Administrative privileges are given to all members of the
    … …  
    218218        privileges on each domain member.
    219219        </p><p>
    220 <a class="indexterm" name="id2617512"></a>
    221 <a class="indexterm" name="id2617519"></a>
    222 <a class="indexterm" name="id2617526"></a>
    223 <a class="indexterm" name="id2617533"></a>
     220<a class="indexterm" name="id2618989"></a>
     221<a class="indexterm" name="id2618996"></a>
     222<a class="indexterm" name="id2619003"></a>
     223<a class="indexterm" name="id2619010"></a>
    224224        UNIX/Linux has no concept of support for nested groups, and thus Samba has for a long time not supported
    225225        them either. The problem is that you would have to enter UNIX groups as auxiliary members of a group in
    … …  
    229229        controller that the Samba server is a member of.
    230230        </p><p>
    231 <a class="indexterm" name="id2617563"></a>
    232 <a class="indexterm" name="id2617570"></a>
    233 <a class="indexterm" name="id2617577"></a>
    234 <a class="indexterm" name="id2617584"></a>
    235 <a class="indexterm" name="id2617591"></a>
     231<a class="indexterm" name="id2619040"></a>
     232<a class="indexterm" name="id2619047"></a>
     233<a class="indexterm" name="id2619054"></a>
     234<a class="indexterm" name="id2619061"></a>
     235<a class="indexterm" name="id2619068"></a>
    236236        In effect, Samba supplements the <code class="filename">/etc/group</code> data via the dynamic
    237237        <code class="literal">libnss_winbind</code> mechanism. Beginning with Samba-3.0.3, this facility is used to provide
    … …  
    243243        UNIX/Linux group <code class="constant">demo</code>.
    244244        </p><p>
    245 <a class="indexterm" name="id2617637"></a>
    246 <a class="indexterm" name="id2617644"></a>
    247 <a class="indexterm" name="id2617651"></a>
    248 <a class="indexterm" name="id2617657"></a>
    249 <a class="indexterm" name="id2617664"></a>
    250 <a class="indexterm" name="id2617671"></a>
    251 <a class="indexterm" name="id2617678"></a>
     245<a class="indexterm" name="id2619114"></a>
     246<a class="indexterm" name="id2619121"></a>
     247<a class="indexterm" name="id2619128"></a>
     248<a class="indexterm" name="id2619135"></a>
     249<a class="indexterm" name="id2619141"></a>
     250<a class="indexterm" name="id2619148"></a>
     251<a class="indexterm" name="id2619155"></a>
    252252        To enable the use of nested groups, <code class="literal">winbindd</code> must be used with NSS winbind.
    253253        Creation and administration of the local groups is done best via the Windows Domain User Manager or its
    … …  
    257257        <code class="prompt">root# </code> net rpc group add demo -L -Uroot%not24get
    258258        </pre><p>
    259 <a class="indexterm" name="id2617722"></a>
    260 <a class="indexterm" name="id2617728"></a>
     259<a class="indexterm" name="id2619199"></a>
     260<a class="indexterm" name="id2619206"></a>
    261261        Here the -L switch means that you want to create a local group. It may be necessary to add -S and -U
    262262        switches for accessing the correct host with appropriate user or root privileges. Adding and removing
    … …  
    267267        net rpc group addmem demo "DOM\Domain Users"
    268268        </pre><p>
    269 <a class="indexterm" name="id2617768"></a>
    270 <a class="indexterm" name="id2617775"></a>
    271 <a class="indexterm" name="id2617782"></a>
    272 <a class="indexterm" name="id2617789"></a>
     269<a class="indexterm" name="id2619245"></a>
     270<a class="indexterm" name="id2619252"></a>
     271<a class="indexterm" name="id2619259"></a>
     272<a class="indexterm" name="id2619266"></a>
    273273        Having completed these two steps, the execution of <code class="literal">getent group demo</code> will show demo
    274274        members of the global <code class="constant">Domain Users</code> group as members of  the group
    … …  
    278278        added to the <code class="constant">demo</code> group now have the same local access permissions as local domain
    279279        users have.
    280         </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2617827"></a>Important Administrative Information</h3></div></div></div><p>
     280        </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2619304"></a>Important Administrative Information</h3></div></div></div><p>
    281281        Administrative rights are necessary in two specific forms:
    282282        </p><div class="orderedlist"><ol type="1"><li><p>For Samba-3 domain controllers and domain member servers/clients.</p></li><li><p>To manage domain member Windows workstations.</p></li></ol></div><p>
    283 <a class="indexterm" name="id2617858"></a>
    284 <a class="indexterm" name="id2617865"></a>
    285 <a class="indexterm" name="id2617872"></a>
     283<a class="indexterm" name="id2619335"></a>
     284<a class="indexterm" name="id2619342"></a>
     285<a class="indexterm" name="id2619349"></a>
    286286        Versions of Samba up to and including 3.0.10 do not provide a means for assigning rights and privileges
    287287        that are necessary for system administration tasks from a Windows domain member client machine, so
    … …  
    289289        managing workstation domain membership accounts, can be handled by any account other than root.
    290290        </p><p>
    291 <a class="indexterm" name="id2617889"></a>
    292 <a class="indexterm" name="id2617896"></a>
    293 <a class="indexterm" name="id2617903"></a>
     291<a class="indexterm" name="id2619366"></a>
     292<a class="indexterm" name="id2619374"></a>
     293<a class="indexterm" name="id2619380"></a>
    294294        Samba-3.0.11 introduced a new privilege management interface (see <a class="link" href="rights.html" title="Chapter 15. User Rights and Privileges">User Rights and Privileges</a>)
    295295        that permits these tasks to be delegated to non-root (i.e., accounts other than the equivalent of the
    296296        MS Windows Administrator) accounts.
    297297        </p><p>
    298 <a class="indexterm" name="id2617924"></a>
    299 <a class="indexterm" name="id2617931"></a>
     298<a class="indexterm" name="id2619402"></a>
     299<a class="indexterm" name="id2619408"></a>
    300300        Administrative tasks on a Windows domain member workstation can be done by anyone who is a member of the
    301301        <code class="constant">Domain Admins</code> group. This group can be mapped to any convenient UNIX group.
    302         </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617946"></a>Applicable Only to Versions Earlier than 3.0.11</h4></div></div></div><p>
    303 <a class="indexterm" name="id2617954"></a>
     302        </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2619423"></a>Applicable Only to Versions Earlier than 3.0.11</h4></div></div></div><p>
     303<a class="indexterm" name="id2619431"></a>
    304304        Administrative tasks on UNIX/Linux systems, such as adding users or groups, requires
    305305        <code class="constant">root</code>-level privilege. The addition of a Windows client to a Samba domain involves the
    306306        addition of a user account for the Windows client.
    307307        </p><p>
    308 <a class="indexterm" name="id2617972"></a>
    309 <a class="indexterm" name="id2617978"></a>
     308<a class="indexterm" name="id2619449"></a>
     309<a class="indexterm" name="id2619456"></a>
    310310        Many UNIX administrators continue to request that the Samba Team make it possible to add Windows workstations, or
    311311        the ability to add, delete, or modify user accounts, without requiring <code class="constant">root</code> privileges.
    312312        Such a request violates every understanding of basic UNIX system security.
    313313        </p><p>
    314 <a class="indexterm" name="id2617997"></a>
    315 <a class="indexterm" name="id2618004"></a>
    316 <a class="indexterm" name="id2618010"></a>
    317 <a class="indexterm" name="id2618018"></a>
    318 <a class="indexterm" name="id2618024"></a>
    319 <a class="indexterm" name="id2618032"></a>
     314<a class="indexterm" name="id2619474"></a>
     315<a class="indexterm" name="id2619481"></a>
     316<a class="indexterm" name="id2619488"></a>
     317<a class="indexterm" name="id2619495"></a>
     318<a class="indexterm" name="id2619502"></a>
     319<a class="indexterm" name="id2619509"></a>
    320320        There is no safe way to provide access on a UNIX/Linux system without providing
    321321        <code class="constant">root</code>-level privileges. Provision of <code class="constant">root</code> privileges can be done
    … …  
    325325        accounts as well as domain member server and client accounts. This level of privilege is also needed to manage
    326326        share-level ACLs.
    327         </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618067"></a>Default Users, Groups, and Relative Identifiers</h3></div></div></div><p>
    328         <a class="indexterm" name="id2618076"></a>
    329         <a class="indexterm" name="id2618085"></a>
    330 <a class="indexterm" name="id2618091"></a>
    331 <a class="indexterm" name="id2618098"></a>
    332 <a class="indexterm" name="id2618105"></a>
    333 <a class="indexterm" name="id2618112"></a>
    334 <a class="indexterm" name="id2618119"></a>
    335 <a class="indexterm" name="id2618126"></a>
     327        </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2619545"></a>Default Users, Groups, and Relative Identifiers</h3></div></div></div><p>
     328        <a class="indexterm" name="id2619553"></a>
     329        <a class="indexterm" name="id2619562"></a>
     330<a class="indexterm" name="id2619569"></a>
     331<a class="indexterm" name="id2619576"></a>
     332<a class="indexterm" name="id2619582"></a>
     333<a class="indexterm" name="id2619589"></a>
     334<a class="indexterm" name="id2619596"></a>
     335<a class="indexterm" name="id2619603"></a>
    336336        When first installed, Windows NT4/200x/XP are preconfigured with certain user, group, and
    337337        alias entities. Each has a well-known RID. These must be preserved for continued
    … …  
    341341        (provision) the default NT groups.
    342342        </p><p>
    343 <a class="indexterm" name="id2618148"></a>
    344 <a class="indexterm" name="id2618155"></a>
    345 <a class="indexterm" name="id2618162"></a>
    346 <a class="indexterm" name="id2618168"></a>
     343<a class="indexterm" name="id2619625"></a>
     344<a class="indexterm" name="id2619632"></a>
     345<a class="indexterm" name="id2619639"></a>
     346<a class="indexterm" name="id2619646"></a>
    347347        Each essential domain group must be assigned its respective well-known RID. The default users, groups,
    348348        aliases, and RIDs are shown in <a class="link" href="groupmapping.html#WKURIDS" title="Table 12.1. Well-Known User Default RIDs">Well-Known User Default RIDs</a>.
    349349        </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
    350 <a class="indexterm" name="id2618190"></a>
    351 <a class="indexterm" name="id2618197"></a>
    352 <a class="indexterm" name="id2618203"></a>
    353 <a class="indexterm" name="id2618210"></a>
    354 <a class="indexterm" name="id2618217"></a>
     350<a class="indexterm" name="id2619667"></a>
     351<a class="indexterm" name="id2619674"></a>
     352<a class="indexterm" name="id2619681"></a>
     353<a class="indexterm" name="id2619687"></a>
     354<a class="indexterm" name="id2619694"></a>
    355355        It is the administrator's responsibility to create the essential domain groups and to assign each
    356356        its default RID.
    357357        </p></div><p>
    358 <a class="indexterm" name="id2618229"></a>
    359 <a class="indexterm" name="id2618236"></a>
     358<a class="indexterm" name="id2619706"></a>
     359<a class="indexterm" name="id2619713"></a>
    360360        It is permissible to create any domain group that may be necessary; just make certain that the essential
    361361        domain groups (well known) have been created and assigned their default RIDs. Other groups you create may
    … …  
    366366        </p><p>
    367367        </p><div class="table"><a name="WKURIDS"></a><p class="title"><b>Table 12.1. Well-Known User Default RIDs</b></p><div class="table-contents"><table summary="Well-Known User Default RIDs" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="center"></colgroup><thead><tr><th align="left">Well-Known Entity</th><th align="left">RID</th><th align="left">Type</th><th align="center">Essential</th></tr></thead><tbody><tr><td align="left">Domain Administrator</td><td align="left">500</td><td align="left">User</td><td align="center">No</td></tr><tr><td align="left">Domain Guest</td><td align="left">501</td><td align="left">User</td><td align="center">No</td></tr><tr><td align="left">Domain KRBTGT</td><td align="left">502</td><td align="left">User</td><td align="center">No</td></tr><tr><td align="left">Domain Admins</td><td align="left">512</td><td align="left">Group</td><td align="center">Yes</td></tr><tr><td align="left">Domain Users</td><td align="left">513</td><td align="left">Group</td><td align="center">Yes</td></tr><tr><td align="left">Domain Guests</td><td align="left">514</td><td align="left">Group</td><td align="center">Yes</td></tr><tr><td align="left">Domain Computers</td><td align="left">515</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Domain Controllers</td><td align="left">516</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Domain Certificate Admins</td><td align="left">517</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Domain Schema Admins</td><td align="left">518</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Domain Enterprise Admins</td><td align="left">519</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Domain Policy Admins</td><td align="left">520</td><td align="left">Group</td><td align="center">No</td></tr><tr><td align="left">Builtin Admins</td><td align="left">544</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin users</td><td align="left">545</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Guests</td><td align="left">546</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Power Users</td><td align="left">547</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Account Operators</td><td align="left">548</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin System Operators</td><td align="left">549</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Print Operators</td><td align="left">550</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Backup Operators</td><td align="left">551</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin Replicator</td><td align="left">552</td><td align="left">Alias</td><td align="center">No</td></tr><tr><td align="left">Builtin RAS Servers</td><td align="left">553</td><td align="left">Alias</td><td align="center">No</td></tr></tbody></table></div></div><p><br class="table-break">
    368         </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618690"></a>Example Configuration</h3></div></div></div><p>
    369 <a class="indexterm" name="id2618698"></a>
     368        </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620168"></a>Example Configuration</h3></div></div></div><p>
     369<a class="indexterm" name="id2620176"></a>
    370370                You can list the various groups in the mapping database by executing
    371371                <code class="literal">net groupmap list</code>. Here is an example:
    372372                </p><p>
    373 <a class="indexterm" name="id2618721"></a>
     373<a class="indexterm" name="id2620198"></a>
    374374</p><pre class="screen">
    375375<code class="prompt">root# </code> <strong class="userinput"><code>net groupmap list</code></strong>
    … …  
    380380                </p><p>
    381381                For complete details on <code class="literal">net groupmap</code>, refer to the net(8) man page.
    382                 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2618767"></a>Configuration Scripts</h2></div></div></div><p>
     382                </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2620244"></a>Configuration Scripts</h2></div></div></div><p>
    383383        Everyone needs tools. Some of us like to create our own, others prefer to use canned tools
    384384        (i.e., prepared by someone else for general use).
    385         </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618779"></a>Sample <code class="filename">smb.conf</code> Add Group Script</h3></div></div></div><p>
    386                 <a class="indexterm" name="id2618793"></a>
    387                 <a class="indexterm" name="id2618800"></a>
    388                 <a class="indexterm" name="id2618807"></a>
    389 <a class="indexterm" name="id2618814"></a>
    390 <a class="indexterm" name="id2618820"></a>
     385        </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620256"></a>Sample <code class="filename">smb.conf</code> Add Group Script</h3></div></div></div><p>
     386                <a class="indexterm" name="id2620270"></a>
     387                <a class="indexterm" name="id2620277"></a>
     388                <a class="indexterm" name="id2620284"></a>
     389<a class="indexterm" name="id2620291"></a>
     390<a class="indexterm" name="id2620298"></a>
    391391                A script to create complying group names for use by the Samba group interfaces
    392392                is provided in <a class="link" href="groupmapping.html#smbgrpadd.sh" title="Example 12.1. smbgrpadd.sh">smbgrpadd.sh</a>. This script
    … …  
    416416                <code class="filename">smb.conf</code> for the add group Script</a> demonstrates how it may be used.
    417417
    418 </p><div class="example"><a name="smbgrpadd"></a><p class="title"><b>Example 12.2. Configuration of <code class="filename">smb.conf</code> for the add group Script</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2618935"></a><em class="parameter"><code>add group script = /path_to_tool/smbgrpadd.sh "%g"</code></em></td></tr></table></div></div><p><br class="example-break">
    419                 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618951"></a>Script to Configure Group Mapping</h3></div></div></div><p>
    420 <a class="indexterm" name="id2618959"></a>
     418</p><div class="example"><a name="smbgrpadd"></a><p class="title"><b>Example 12.2. Configuration of <code class="filename">smb.conf</code> for the add group Script</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2620412"></a><em class="parameter"><code>add group script = /path_to_tool/smbgrpadd.sh "%g"</code></em></td></tr></table></div></div><p><br class="example-break">
     419                </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620428"></a>Script to Configure Group Mapping</h3></div></div></div><p>
     420<a class="indexterm" name="id2620436"></a>
    421421        In our example we have created a UNIX/Linux group called <code class="literal">ntadmin</code>.
    422422        Our script will create the additional groups <code class="literal">Orks</code>, <code class="literal">Elves</code>, and <code class="literal">Gnomes</code>.
    … …  
    424424        For the sake of convenience we elect to save this script as a file called <code class="filename">initGroups.sh</code>.
    425425        This script is given in <a class="link" href="groupmapping.html#set-group-map" title="Example 12.3. Script to Set Group Mapping">intGroups.sh</a>.
    426 <a class="indexterm" name="id2619009"></a>
     426<a class="indexterm" name="id2620486"></a>
    427427</p><div class="example"><a name="set-group-map"></a><p class="title"><b>Example 12.3. Script to Set Group Mapping</b></p><div class="example-contents"><pre class="programlisting">
    428428#!/bin/bash
    … …  
    451451        must now be manually and explicitly created and mapped to a valid UNIX GID by the Samba
    452452        administrator.
    453         </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2619078"></a>Common Errors</h2></div></div></div><p>
     453        </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2620555"></a>Common Errors</h2></div></div></div><p>
    454454At this time there are many little surprises for the unwary administrator. In a real sense
    455455it is imperative that every step of automated control scripts be carefully tested
    456456manually before putting it into active service.
    457 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2619091"></a>Adding Groups Fails</h3></div></div></div><p>
    458 <a class="indexterm" name="id2619098"></a>
     457</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620568"></a>Adding Groups Fails</h3></div></div></div><p>
     458<a class="indexterm" name="id2620576"></a>
    459459                This is a common problem when the <code class="literal">groupadd</code> is called directly
    460                 by the Samba interface script for the add group script in
     460                by the Samba interface script for the <a class="link" href="smb.conf.5.html#ADDGROUPSCRIPT">add group script</a> in
    461461                the <code class="filename">smb.conf</code> file.
    462462                </p><p>
    463 <a class="indexterm" name="id2619123"></a>
    464 <a class="indexterm" name="id2619130"></a>
     463<a class="indexterm" name="id2620613"></a>
     464<a class="indexterm" name="id2620620"></a>
    465465                The most common cause of failure is an attempt to add an MS Windows group account
    466466                that has an uppercase character and/or a space character in it.
    467467                </p><p>
    468 <a class="indexterm" name="id2619142"></a>
     468<a class="indexterm" name="id2620633"></a>
    469469                There are three possible workarounds. First, use only group names that comply
    470470                with the limitations of the UNIX/Linux <code class="literal">groupadd</code> system tool.
    … …  
    473473                for the MS Windows group name, then use the procedure listed above to map that group
    474474                to the MS Windows group.
    475                 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2619164"></a>Adding Domain Users to the Workstation Power Users Group</h3></div></div></div><p>&#8220;<span class="quote">
     475                </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620655"></a>Adding Domain Users to the Workstation Power Users Group</h3></div></div></div><p>&#8220;<span class="quote">
    476476                What must I do to add domain users to the Power Users group?
    477477                </span>&#8221;</p><p>
    478 <a class="indexterm" name="id2619178"></a>
     478<a class="indexterm" name="id2620669"></a>
    479479                The Power Users group is a group that is local to each Windows 200x/XP Professional workstation.
    480480                You cannot add the Domain Users group to the Power Users group automatically, it must be done on
Note: See TracChangeset for help on using the changeset viewer.