DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 5505C3858417
Date: Mon, 17 Jan 2022 13:04:43 +0100
From: Corinna Vinschen <corinna-cygwin@cygwin.com>
To: cygwin@cygwin.com
Subject: Re: Help with standalone samba SID-uid mapping
Message-ID: <YeVbW7iqmn6LfDb9@calimero.vinschen.de>
Mail-Followup-To: cygwin@cygwin.com
References: <064846E1-8D6D-41D2-97D9-4C3793502CEE@house.org>
 <YeFKleBRwCZcikxb@calimero.vinschen.de>
 <7BA06F03-FCFA-492E-898F-F423F03E15F6@house.org>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <7BA06F03-FCFA-492E-898F-F423F03E15F6@house.org>
Precedence: list
Reply-To: cygwin@cygwin.com
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>

On Jan 14 11:57, Chris Roehrig wrote:
> On Fri Jan 14 2022, at 2:04 AM, Corinna Vinschen <corinna-cygwin@cygwin.com> wrote:
> > These look like your standard Windows SIDs, so they are your SIDs for
> > users cristina and croehrig on Windows.  They should show up as such in
> > ls -l output, unless the SID is actuall wrong, e. g., they map to your
> > accounts on another machine or something like that.
> 
> No those are the SIDs supplied by the Samba server (see below for my local Windows SIDs).   Here they are directly on the Linux machine:
> housesrv[11]% smbcacls --numeric //housesrv/Users croehrig
> Enter WORKGROUP\croehrig's password: 
> REVISION:1
> CONTROL:0x9004
> OWNER:S-1-5-21-751087815-2087572193-42305691-1000
> GROUP:S-1-22-2-601
> ACL:S-1-5-21-751087815-2087572193-42305691-1000:0/0x0/0x001f01ff
> ACL:S-1-22-2-601:0/0x0/0x001200a9
> ACL:S-1-1-0:0/0x0/0x001200a9
> 
> (I think that Samba now uses a more complex IDMAP algorithm than when
> the Cygwin document above was written and now provides a full domain
> component to its SIDs.)

That may be so, but in my installation, Samba reports the Unix User ID
as owner, i. e.

  $ icacls \\\\server\\corinna\\foo
  \\server\corinna\foo S-1-22-1-500:(R,W,D,WDAC,WO)
                       S-1-22-2-11125:(R)
                       Everyone:(R)

and that's with Samba 4.15.3.  I'm doing the mapping via the AD
uidNumber and gidNumber fields.  I'm using this setup for so long that I
don't remember if I ever saw a "normal", Windows-like SID for the user
returned by Samba.  I never ran winbindd, up until Samba 4.15.3, which
was the first one forcing me to do so when using AD support.

> I just added those SIDs to  /etc/passwd and /etc/groups (double
> entries now) and it now works for the user, but (oddly) not the group:
> 
> tyto[6]% ls -l //housesrv/Users/				## NB: this is a UNC path to the samba share
> total 0
> drwxr-xr-x 1 cristina Unix_Group+603 0 Jan 12 16:06 cristina
> drwxr-xr-x 1 croehrig Unix_Group+601 0 Jan 14 09:18 croehrig
> [...]
> tyto[10]% cat /etc/group
> croehrig:S-1-22-2-601:601:
> cristina:S-1-22-2-603:603:
> croehrig:S-1-5-21-1290748074-662758565-4273641972-1006:601:
> cristina:S-1-5-21-1290748074-662758565-4273641972-1008:603:

Hmm, that's weird.  I just tried this myself.  First I created a stock
/etc/group file with all local and AD accounts.  Next I changed
/etc/nsswitch.conf:

  - group: db
  + group: files

Exit/restart Cygwin. `ls -l' now prints

  -rw-r--r-- 1 corinna Unknown+Group 13342 Jan 17 10:46 //calimero/corinna/foo

Now I add this line to /etc/group:

  mygroup:S-1-22-2-11125:11125:

Exit/restart Cygwin.  Now `ls -l' prints

  -rw-r--r-- 1 corinna mygroup 13342 Jan 17 10:46 //calimero/corinna/foo

So it works, apparently.  Did you set `group: db' in /etc/nsswitch.conf,
by any chance?


Corinna

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple