Dear sssd users,
I would like to get informations about the use of sssd with samba (centos 7, samba 4.8.3).
I need it because I configured a samba share, accessible with sssd. The authentication is against a windows AD.
My /etc/nsswitch.cnf is configured only with sssd : /passwd: files sss// //shadow: files sss// //group: files sss/
For an other purpose, I set an sftpd access also configured with sssd against the AD.
I followed some discussions on the samba user list about samba + sssd. I would like to understand if there are some issues with sssd and samba 4.8.3 on centos 7 ? Or is it with next RHEL 8 ?
/The RHEL 8 documentation states this: // //// //"Red Hat only supports running Samba as a server with the winbindd // //service to provide domain users and groups to the local system. Due to // //certain limitations, such as missing Windows access control list (ACL) // //support and NT LAN Manager (NTLM) fallback, SSSD is not supported." // //// //https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm... //// //What's confusing is that the RHEL 7 documentation says: // //// //"Prior to Red Hat Enterprise Linux 7.1, only Winbind provided this // //functionality. In Red Hat Enterprise Linux 7.1 and later, you no longer // //need to run Winbind and SSSD in parallel to access SMB shares. For // //example, accessing the Access Control Lists (ACLs) no longer requires // //Winbind on SSSD clients." // //// //and // //// //"4.2.2. Determining Whether to Use SSSD or Winbind for SMB Shares // //For most SSSD clients, using SSSD is recommended:" // //// //and most worrisome, in my use case: // //// //"In environments with direct Active Directory integration where the // //clients use SSSD for general Active Directory user mappings, using // //Winbind for the SMB ID mapping instead of SSSD can result in // //inconsistent mapping." /
In my case, running samba 4.8.3 with SSSD on centos 7 do I need to : - enable and start winbind service , in conjunction to sssd ? - or only sssd is enough with samba ? - Do I have to fear issues in next release of sssd for the support of samba ? especially for acls support ?/ /
A nsswitch.conf like : passwd: files sss winbind shadow: files sss winbind group: files sss winbind
or
passwd: files winbind sss shadow: files winbind sss group: files winbind sss
Does not seem to work... I test and this is not stable.
Best Regards, Edouard
On Wed, Jun 19, 2019 at 01:57:59PM -0300, Edouard Guigné wrote:
Dear sssd users,
I would like to get informations about the use of sssd with samba (centos 7, samba 4.8.3).
I need it because I configured a samba share, accessible with sssd. The authentication is against a windows AD.
My /etc/nsswitch.cnf is configured only with sssd : /passwd: files sss// //shadow: files sss// //group: files sss/
For an other purpose, I set an sftpd access also configured with sssd against the AD.
I followed some discussions on the samba user list about samba + sssd. I would like to understand if there are some issues with sssd and samba 4.8.3 on centos 7 ? Or is it with next RHEL 8 ?
/The RHEL 8 documentation states this: // //// //"Red Hat only supports running Samba as a server with the winbindd // //service to provide domain users and groups to the local system. Due to // //certain limitations, such as missing Windows access control list (ACL) // //support and NT LAN Manager (NTLM) fallback, SSSD is not supported." // //// //https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm... //// //What's confusing is that the RHEL 7 documentation says: // //// //"Prior to Red Hat Enterprise Linux 7.1, only Winbind provided this // //functionality. In Red Hat Enterprise Linux 7.1 and later, you no longer // //need to run Winbind and SSSD in parallel to access SMB shares. For // //example, accessing the Access Control Lists (ACLs) no longer requires // //Winbind on SSSD clients." // //// //and // //// //"4.2.2. Determining Whether to Use SSSD or Winbind for SMB Shares // //For most SSSD clients, using SSSD is recommended:" // //// //and most worrisome, in my use case: // //// //"In environments with direct Active Directory integration where the // //clients use SSSD for general Active Directory user mappings, using // //Winbind for the SMB ID mapping instead of SSSD can result in // //inconsistent mapping." /
In my case, running samba 4.8.3 with SSSD on centos 7 do I need to :
I'm not an expert in this are, but look at some threads in the list archive e.g. this one: https://lists.fedoraproject.org/archives/list/sssd-users@lists.fedorahosted.... even has a full example.
- enable and start winbind service , in conjunction to sssd ?
Yes, that's my understanding with recent Samba releases
- or only sssd is enough with samba ?
- Do I have to fear issues in next release of sssd for the support of samba
? especially for acls support ?/ /
A nsswitch.conf like : passwd: files sss winbind shadow: files sss winbind group: files sss winbind
..but I don't think you need the NSS maps enabled, IIRC just the service must be running..
or
passwd: files winbind sss shadow: files winbind sss group: files winbind sss
Does not seem to work... I test and this is not stable.
Best Regards, Edouard
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
I _think_ I've found an issue with the combination of sssd and samba on RHEL/CentOS 7.6. There are a few threads in the list history about how to get these two to play nice despite the current "unsupported" status from RH. The gist of the issues are:
* Need to make sure only samba or nothing are updating the machine passwords as if sssd is doing it it won't update the secrets in samba's database. * Have to allocate an idmap range for the sss backend _and_ give a bit of space for a default backend to do its thing.
This seems to be as simple as:
Remove sssd-libwbclient and only use libwbclient (RPMs)
# /etc/samba.smb.conf:
[global] workgroup = AD security = ads realm = ad.mydomain.com kerberos method = system keytab
idmap config AD : backend = sss idmap config AD : range = 10000-1999999999
idmap config * : backend = tdb idmap config * : range = 9000-9999
# /etc/sssd/sssd.conf seems to need to contain (along with whatever realmd generates):
ldap_id_mapping = True # use sssd mastered uids/gids ad_maximum_machine_account_password_age = 0 # stop sssd messing with host password
We also have:
ignore_group_members = True # for speed ldap_idmap_range_size = 2000000 # we have lots of users
Then join making sure to use net join not adcli
$ realm join --membership-software=samba -U mydomain_admin ad.mydomain.com
On Fedora 30 the above works perfectly with all wbinfo commands working as expected and samba shares behave.
Fedora 30: $ rpm -q sssd samba sssd-2.2.0-1.fc30.x86_64 samba-4.10.4-1.fc30.x86_64
BUT (big but)
On CentOS 7.6 with exactly the same configuration .. it only sometimes works.
$ rpm -q sssd samba sssd-1.16.2-13.el7_6.8.x86_64 samba-4.8.3-4.el7.x86_64
I end up with behaviour along these lines:
# Config and domain join as above, then try some lookups.
$ wbinfo -n user086 S-1-5-21-*-*-*-39092 SID_USER (1) $ wbinfo -S S-1-5-21-*-*-*-39092 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-39092 to uid
$ systemctl stop smb $ systemctl restart winbind
$ wbinfo -S S-1-5-21-*-*-*-39092 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-39092 to uid
$ systemctl restart sssd
$ wbinfo -S S-1-5-21-*-*-*-39092 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-39092 to uid
$ systemctl restart sssd
$ wbinfo -S S-1-5-21-*-*-*-39092 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-39092 to uid
# Wait around 30 seconds ... ****** THIS BIT ******
$ wbinfo -S S-1-5-21-*-*-*-39092 42239092
Another run after scrubbing all config and tdb files, then after rejoin:
$ wbinfo -n user21b S-1-5-21-*-*-*-179094 SID_USER (1) $ wbinfo -n user20b S-1-5-21-*-*-*-153534 SID_USER (1)
$ wbinfo -s S-1-5-21-*-*-*-179094 AD\user21b 1 $ wbinfo -s S-1-5-21-*-*-*-153534 AD\user20b 1
$ wbinfo -S S-1-5-21-*-*-*-153534 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-153534 to uid $ wbinfo -S S-1-5-21-*-*-*-179094 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-179094 to uid
$ systemctl restart winbind $ systemctl restart sssd
# wbinfo -n user21b S-1-5-21-*-*-*-179094 SID_USER (1) # wbinfo -n user20b S-1-5-21-*-*-*-153534 SID_USER (1) # wbinfo -s S-1-5-21-*-*-*-179094 AD\user21b 1 # wbinfo -s S-1-5-21-*-*-*-153534 AD\user20b # wbinfo -S S-1-5-21-*-*-*-179094 42379094 # wbinfo -S S-1-5-21-*-*-*-153534 42353534
I'm still trying to nail down what's going on here, but it feels very timing orientated. Left for a few hours a working config suddenly doesn't seem to want to resolve the sss based id resolution. The wbinfo -S queries are the ones that stop working (sid to uid), all the -s, -i -n queries still work and -t and -D AD still say sensible things.
Importantly I can't get any of this to break on Fedora 30 though with the sssd and samba versions noted above.
Not sure if this is on the samba side or sssd-winbind-idmap .. or if I'm simply losing my mind here :)
Are there any known bugs or re-workings to the sss or winbind bits between sssd 1.16 and 2.2 or samba 4.8 and 4.10 that would account for this?
Carwyn
On Thu, Jun 27, 2019 at 02:52:41PM -0000, Carwyn Edwards wrote:
I _think_ I've found an issue with the combination of sssd and samba on RHEL/CentOS 7.6. There are a few threads in the list history about how to get these two to play nice despite the current "unsupported" status from RH. The gist of the issues are:
- Need to make sure only samba or nothing are updating the machine passwords as if sssd is doing it it won't update the secrets in samba's database.
- Have to allocate an idmap range for the sss backend _and_ give a bit of space for a default backend to do its thing.
This seems to be as simple as:
Remove sssd-libwbclient and only use libwbclient (RPMs)
# /etc/samba.smb.conf:
[global] workgroup = AD security = ads realm = ad.mydomain.com kerberos method = system keytab
idmap config AD : backend = sss idmap config AD : range = 10000-1999999999 idmap config * : backend = tdb idmap config * : range = 9000-9999
# /etc/sssd/sssd.conf seems to need to contain (along with whatever realmd generates):
ldap_id_mapping = True # use sssd mastered uids/gids ad_maximum_machine_account_password_age = 0 # stop sssd messing with host password
We also have:
ignore_group_members = True # for speed ldap_idmap_range_size = 2000000 # we have lots of users
Then join making sure to use net join not adcli
$ realm join --membership-software=samba -U mydomain_admin ad.mydomain.com
On Fedora 30 the above works perfectly with all wbinfo commands working as expected and samba shares behave.
Fedora 30: $ rpm -q sssd samba sssd-2.2.0-1.fc30.x86_64 samba-4.10.4-1.fc30.x86_64
BUT (big but)
On CentOS 7.6 with exactly the same configuration .. it only sometimes works.
Yes, we missed a change in Samba's idmap interface https://bugzilla.redhat.com/show_bug.cgi?id=1707759 / https://pagure.io/SSSD/sssd/issue/4005 which affects Centos 7.6. It is already fixed in Fedora and will be fixed in 7.7 as well.
bye, Sumit
$ rpm -q sssd samba sssd-1.16.2-13.el7_6.8.x86_64 samba-4.8.3-4.el7.x86_64
I end up with behaviour along these lines:
# Config and domain join as above, then try some lookups.
$ wbinfo -n user086 S-1-5-21-*-*-*-39092 SID_USER (1) $ wbinfo -S S-1-5-21-*-*-*-39092 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-39092 to uid
$ systemctl stop smb $ systemctl restart winbind
$ wbinfo -S S-1-5-21-*-*-*-39092 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-39092 to uid
$ systemctl restart sssd
$ wbinfo -S S-1-5-21-*-*-*-39092 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-39092 to uid
$ systemctl restart sssd
$ wbinfo -S S-1-5-21-*-*-*-39092 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-39092 to uid
# Wait around 30 seconds ... ****** THIS BIT ******
$ wbinfo -S S-1-5-21-*-*-*-39092 42239092
Another run after scrubbing all config and tdb files, then after rejoin:
$ wbinfo -n user21b S-1-5-21-*-*-*-179094 SID_USER (1) $ wbinfo -n user20b S-1-5-21-*-*-*-153534 SID_USER (1)
$ wbinfo -s S-1-5-21-*-*-*-179094 AD\user21b 1 $ wbinfo -s S-1-5-21-*-*-*-153534 AD\user20b 1
$ wbinfo -S S-1-5-21-*-*-*-153534 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-153534 to uid $ wbinfo -S S-1-5-21-*-*-*-179094 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-*-*-*-179094 to uid
$ systemctl restart winbind $ systemctl restart sssd
# wbinfo -n user21b S-1-5-21-*-*-*-179094 SID_USER (1) # wbinfo -n user20b S-1-5-21-*-*-*-153534 SID_USER (1) # wbinfo -s S-1-5-21-*-*-*-179094 AD\user21b 1 # wbinfo -s S-1-5-21-*-*-*-153534 AD\user20b # wbinfo -S S-1-5-21-*-*-*-179094 42379094 # wbinfo -S S-1-5-21-*-*-*-153534 42353534
I'm still trying to nail down what's going on here, but it feels very timing orientated. Left for a few hours a working config suddenly doesn't seem to want to resolve the sss based id resolution. The wbinfo -S queries are the ones that stop working (sid to uid), all the -s, -i -n queries still work and -t and -D AD still say sensible things.
Importantly I can't get any of this to break on Fedora 30 though with the sssd and samba versions noted above.
Not sure if this is on the samba side or sssd-winbind-idmap .. or if I'm simply losing my mind here :)
Are there any known bugs or re-workings to the sss or winbind bits between sssd 1.16 and 2.2 or samba 4.8 and 4.10 that would account for this?
Carwyn _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Applying the following patch to the version of sssd currently available in CentOS/RHEL 7.6 resolved this intermittent lookup issue for us:
https://patch-diff.githubusercontent.com/raw/SSSD/sssd/pull/811.patch
May be useful info for others given 7.7 release (and CentOS update) could be some time away sti..
Carwyn
I believe we are seeing the same thing. we are running in an unsupported configuration where we are using sssd+smbd. This is working fine for us, usually. we run commands like:
copy *.pdf \someserver\someshare\somefolder
and will intermittently get an Access Denied error on the windows client.
I was able to install winbind and start it and restart smbd. doing this immediately broke samba access. However, we were able to get successful resolution on users with wbinfo. is there a recipe here for allowing samba to share out folders while the system is joined with sssd?
[global] workgroup = ACME client signing = yes client use spnego = yes kerberos method = secrets and keytab password server = * realm = ACME.WIDGETS.COM security = ads kernel oplocks = yes vfs objects = acl_xattr map acl inherit = yes max connections = 0 max smbd processes = 0
passdb backend = tdbsam idmap config * : backend = tdb idmap config * : range = 10000-49999
printing = cups printcap name = cups load printers = yes cups options = raw
log level = 3 passdb:5 auth:5
[homes] comment = Home Directories valid users = %S, %D%w%S browseable = No read only = No inherit acls = Yes
On Fri, Nov 20, 2020 at 02:51:19AM -0000, Joe Gainey wrote:
I believe we are seeing the same thing. we are running in an unsupported configuration where we are using sssd+smbd. This is working fine for us, usually. we run commands like:
copy *.pdf \someserver\someshare\somefolder
and will intermittently get an Access Denied error on the windows client.
I was able to install winbind and start it and restart smbd. doing this immediately broke samba access. However, we were able to get successful resolution on users with wbinfo. is there a recipe here for allowing samba to share out folders while the system is joined with sssd?
[global] workgroup = ACME client signing = yes client use spnego = yes kerberos method = secrets and keytab password server = * realm = ACME.WIDGETS.COM security = ads kernel oplocks = yes vfs objects = acl_xattr map acl inherit = yes max connections = 0 max smbd processes = 0
passdb backend = tdbsam idmap config * : backend = tdb idmap config * : range = 10000-49999
Hi,
please check the messages earlier in this thread. You need SSSD's idmap plugin for winbind. Install the 'sssd-winbind-idmap' (or simialar) package and see man idmap_sss for details.
Which version of Samba and SSSD are you using on which platform?
bye, Sumit
printing = cups printcap name = cups load printers = yes cups options = raw log level = 3 passdb:5 auth:5
[homes] comment = Home Directories valid users = %S, %D%w%S browseable = No read only = No inherit acls = Yes _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
sssd-users@lists.fedorahosted.org