Re: [Samba] [samba] idmap question
- Date: Thu, 10 Aug 2017 11:51:59 +0100
- From: Rowland Penny via samba <samba@xxxxxxxxxxxxxxx>
- Subject: Re: [Samba] [samba] idmap question
On Thu, 10 Aug 2017 12:19:36 +0200
"L.P.H. van Belle via samba" <samba@xxxxxxxxxxxxxxx> wrote:
> Hai Mathias,
> Type: wbinfo --all-domains
> You should see 3 domainnames.
> BUILTIN => idmap config *
> HOSTNAME => ? Dont know where this one maps to.
> NTDOM => idmap config NTDOM
On a Unix domain member, I get 4
I have no idea where 'EXAMPLE' comes from, I have never set up any
smb.conf that contains 'workgroup = EXAMPLE' on the Unix domain member.
> I use for example ( for debian ) the following.
> I use this as followed.
> ## map id's outside to NT domain to tdb files.
> idmap config *: backend = tdb
> idmap config *: range = 2000-2999
> ## map ids from the domain and (*) the range may not overlap !
> idmap config NTDOM : backend = ad
> idmap config NTDOM : schema_mode = rfc2307
> idmap config NTDOM : range = 10000-3999999
> And i think, but i never use that you can match the hostname also.
> idmap config HOSTNAME : backend = tdb
> idmap config HOSTNAME : range = 3000-9999
> ! But I cant confirm about the "HOSTNAME" part if thats 100% correct.
It probably would work, but I have never tried it.
> Id 0-1999 (local linux users) 0-999 for system users (*this can
> differ on an other os. ) 2000-2999 BUILDIN\...... ( example
> is BUILDIN\administrators) 3000-9999 HOSTNAME\ ?
> 10000-99999 NTDOM\users i start here at 10.000 because samba
> backend AD starts also at 10.000.
> Now "NTDOM\Domain Admins" is member of : BUILDIN\administrators
> And "NTDOM\Domain users" is member of : BUILDIN\users
> SePrivileges should be set on : BUILDIN\administrators, and not as
> most examples show "domain admins" And because of this you should
> always set : winbind expand groups = 2 But I preffer winbind expand
> groups = 4 Backtrace for example very thing backup related and see
> which groups are used and with SePrivileges you should set.
Never tried this, but you are quite correct, you should NEVER give
'Domain Admins' a gidNumber. I do it another way, I create a group
'Unix Admins', give this group a gidNumber and add this to 'Domain
To unsubscribe from this list go to the following URL and read the