- Timestamp:
- Sep 24, 2009, 9:15:13 AM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.2.x/docs/htmldocs/Samba3-HOWTO/groupmapping.html
r272 r335 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Group Mapping: MS Windows and UNIX</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="passdb.html" title="Chapter 11. Account Information Databases"><link rel="next" href="NetCommand.html" title="Chapter 13. Remote and Local Management: The Net Command"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Group Mapping: MS Windows and UNIX</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="passdb.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="NetCommand.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="groupmapping"></a>Chapter 12. Group Mapping: MS Windows and UNIX</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jean François</span> <span class="surname">Micouleau</span></h3></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="orgname">Samba Team</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jerry@samba.org">jerry@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="groupmapping.html#id2595891">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="groupmapping.html#id2596307">Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2596644">Warning: User Private Group Problems</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id259670 1">Nested Groups: Adding Windows Domain Groups to Windows Local Groups</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2597277">Important Administrative Information</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2597518">Default Users, Groups, and Relative Identifiers</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2598143">Example Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="groupmapping.html#id2598220">Configuration Scripts</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2598231">Sample smb.conf Add Group Script</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2598403">Script to Configure Group Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="groupmapping.html#id2598530">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2598543">Adding Groups Fails</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2598630">Adding Domain Users to the Workstation Power Users Group</a></span></dt></dl></dd></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Group Mapping: MS Windows and UNIX</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="passdb.html" title="Chapter 11. Account Information Databases"><link rel="next" href="NetCommand.html" title="Chapter 13. Remote and Local Management: The Net Command"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Group Mapping: MS Windows and UNIX</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="passdb.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="NetCommand.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="groupmapping"></a>Chapter 12. Group Mapping: MS Windows and UNIX</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jean François</span> <span class="surname">Micouleau</span></h3></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="orgname">Samba Team</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jerry@samba.org">jerry@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="groupmapping.html#id2595891">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="groupmapping.html#id2596307">Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2596644">Warning: User Private Group Problems</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2596702">Nested Groups: Adding Windows Domain Groups to Windows Local Groups</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2597278">Important Administrative Information</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2597518">Default Users, Groups, and Relative Identifiers</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2598143">Example Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="groupmapping.html#id2598220">Configuration Scripts</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2598231">Sample smb.conf Add Group Script</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2598403">Script to Configure Group Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="groupmapping.html#id2598530">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="groupmapping.html#id2598543">Adding Groups Fails</a></span></dt><dt><span class="sect2"><a href="groupmapping.html#id2598630">Adding Domain Users to the Workstation Power Users Group</a></span></dt></dl></dd></dl></div><p> 2 2 <a class="indexterm" name="id2595765"></a> 3 3 <a class="indexterm" name="id2595774"></a> … … 28 28 </p><p> 29 29 <a class="indexterm" name="id2595905"></a> 30 <a class="indexterm" name="id259591 1"></a>30 <a class="indexterm" name="id2595912"></a> 31 31 <a class="indexterm" name="id2595918"></a> 32 32 <a class="indexterm" name="id2595925"></a> … … 44 44 <a class="indexterm" name="id2596088"></a> 45 45 <a class="indexterm" name="id2596095"></a> 46 <a class="indexterm" name="id259610 1"></a>46 <a class="indexterm" name="id2596102"></a> 47 47 <a class="indexterm" name="id2596110"></a> 48 48 In both cases, when winbindd is not running, only locally resolvable groups can be recognized. Please refer to … … 51 51 group mappings</a>. 52 52 </p><div class="figure"><a name="idmap-store-gid2sid"></a><p class="title"><b>Figure 12.3. IDMAP Storing Group Mappings.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/idmap-store-gid2sid.png" width="270" alt="IDMAP Storing Group Mappings."></div></div></div><br class="figure-break"><p> 53 <a class="indexterm" name="id259619 6"></a>53 <a class="indexterm" name="id2596197"></a> 54 54 <a class="indexterm" name="id2596203"></a> 55 55 <a class="indexterm" name="id2596210"></a> … … 92 92 <a class="indexterm" name="id2596393"></a> 93 93 <a class="indexterm" name="id2596400"></a> 94 <a class="indexterm" name="id259640 6"></a>94 <a class="indexterm" name="id2596407"></a> 95 95 When an MS Windows NT4/200x/XP machine is made a domain member, the “<span class="quote">Domain Admins</span>” group of the 96 96 PDC is added to the local <code class="constant">Administrators</code> group of the workstation. Every member of the … … 158 158 be avoided by assuring that the Windows domain group name does not overlap 159 159 with any user account name. 160 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259670 1"></a>Nested Groups: Adding Windows Domain Groups to Windows Local Groups</h3></div></div></div><a class="indexterm" name="id2596708"></a><p>160 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596702"></a>Nested Groups: Adding Windows Domain Groups to Windows Local Groups</h3></div></div></div><a class="indexterm" name="id2596708"></a><p> 161 161 <a class="indexterm" name="id2596719"></a> 162 162 This functionality is known as <code class="constant">nested groups</code> and was first added to 163 163 Samba-3.0.3. 164 164 </p><p> 165 <a class="indexterm" name="id259673 4"></a>165 <a class="indexterm" name="id2596735"></a> 166 166 All MS Windows products since the release of Windows NT 3.10 support the use of nested groups. 167 167 Many Windows network administrators depend on this capability because it greatly simplifies security … … 220 220 <a class="indexterm" name="id2596963"></a> 221 221 <a class="indexterm" name="id2596970"></a> 222 <a class="indexterm" name="id259697 6"></a>222 <a class="indexterm" name="id2596977"></a> 223 223 <a class="indexterm" name="id2596983"></a> 224 224 UNIX/Linux has no concept of support for nested groups, and thus Samba has for a long time not supported … … 232 232 <a class="indexterm" name="id2597021"></a> 233 233 <a class="indexterm" name="id2597028"></a> 234 <a class="indexterm" name="id259703 4"></a>235 <a class="indexterm" name="id259704 1"></a>234 <a class="indexterm" name="id2597035"></a> 235 <a class="indexterm" name="id2597042"></a> 236 236 In effect, Samba supplements the <code class="filename">/etc/group</code> data via the dynamic 237 237 <code class="literal">libnss_winbind</code> mechanism. Beginning with Samba-3.0.3, this facility is used to provide … … 245 245 <a class="indexterm" name="id2597088"></a> 246 246 <a class="indexterm" name="id2597095"></a> 247 <a class="indexterm" name="id259710 1"></a>247 <a class="indexterm" name="id2597102"></a> 248 248 <a class="indexterm" name="id2597108"></a> 249 249 <a class="indexterm" name="id2597115"></a> … … 269 269 <a class="indexterm" name="id2597219"></a> 270 270 <a class="indexterm" name="id2597226"></a> 271 <a class="indexterm" name="id259723 2"></a>272 <a class="indexterm" name="id25972 39"></a>271 <a class="indexterm" name="id2597233"></a> 272 <a class="indexterm" name="id2597240"></a> 273 273 Having completed these two steps, the execution of <code class="literal">getent group demo</code> will show demo 274 274 members of the global <code class="constant">Domain Users</code> group as members of the group … … 278 278 added to the <code class="constant">demo</code> group now have the same local access permissions as local domain 279 279 users have. 280 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259727 7"></a>Important Administrative Information</h3></div></div></div><p>280 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2597278"></a>Important Administrative Information</h3></div></div></div><p> 281 281 Administrative rights are necessary in two specific forms: 282 282 </p><div class="orderedlist"><ol type="1"><li><p>For Samba-3 domain controllers and domain member servers/clients.</p></li><li><p>To manage domain member Windows workstations.</p></li></ol></div><p> 283 <a class="indexterm" name="id259730 8"></a>283 <a class="indexterm" name="id2597309"></a> 284 284 <a class="indexterm" name="id2597316"></a> 285 285 <a class="indexterm" name="id2597323"></a> … … 297 297 </p><p> 298 298 <a class="indexterm" name="id2597375"></a> 299 <a class="indexterm" name="id259738 1"></a>299 <a class="indexterm" name="id2597382"></a> 300 300 Administrative tasks on a Windows domain member workstation can be done by anyone who is a member of the 301 301 <code class="constant">Domain Admins</code> group. This group can be mapped to any convenient UNIX group. … … 312 312 Such a request violates every understanding of basic UNIX system security. 313 313 </p><p> 314 <a class="indexterm" name="id259744 7"></a>314 <a class="indexterm" name="id2597448"></a> 315 315 <a class="indexterm" name="id2597454"></a> 316 316 <a class="indexterm" name="id2597461"></a> … … 327 327 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2597518"></a>Default Users, Groups, and Relative Identifiers</h3></div></div></div><p> 328 328 <a class="indexterm" name="id2597526"></a> 329 <a class="indexterm" name="id259753 5"></a>329 <a class="indexterm" name="id2597536"></a> 330 330 <a class="indexterm" name="id2597542"></a> 331 331 <a class="indexterm" name="id2597549"></a> … … 348 348 aliases, and RIDs are shown in <a class="link" href="groupmapping.html#WKURIDS" title="Table 12.1. Well-Known User Default RIDs">Well-Known User Default RIDs</a>. 349 349 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 350 <a class="indexterm" name="id259764 0"></a>350 <a class="indexterm" name="id2597641"></a> 351 351 <a class="indexterm" name="id2597647"></a> 352 352 <a class="indexterm" name="id2597654"></a> … … 357 357 </p></div><p> 358 358 <a class="indexterm" name="id2597680"></a> 359 <a class="indexterm" name="id259768 6"></a>359 <a class="indexterm" name="id2597687"></a> 360 360 It is permissible to create any domain group that may be necessary; just make certain that the essential 361 361 domain groups (well known) have been created and assigned their default RIDs. Other groups you create may
Note:
See TracChangeset
for help on using the changeset viewer.
