Re: [Samba] Avoiding uid conflicts between rfc2307 user/groups and computers
- Date: Mon, 15 Jan 2018 13:31:00 +0100
- From: "L.P.H. van Belle via samba" <samba@xxxxxxxxxxxxxxx>
- Subject: Re: [Samba] Avoiding uid conflicts between rfc2307 user/groups and computers
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces@xxxxxxxxxxxxxxx] Namens
> Marco Gaiarin via samba
> Verzonden: maandag 15 januari 2018 13:03
> Aan: samba@xxxxxxxxxxxxxxx
> Onderwerp: Re: [Samba] Avoiding uid conflicts between rfc2307
> user/groups and computers
> Mandi! Rowland Penny via samba
> In chel di` si favelave...
> > You are clear in what you say, but I still do not think you
> need the ID
> > numbers for computers, 'SYSTEM' does not exist on a Unix machine.
It should !
See also my script :
> It is not the SYSTEM user (that is a local user to the workstation, so
> clearly does not exist on the domain).
Yes it does. Look at "Builtin\system" which is also "NT Authority\System.
> But still windows workstation, when accessing some shares with the
> SYSTEM user, try to logon with the machine account.
Correct, thats by design, and if you get access denied, you did hit the "winbind" "user SYSTEM" bug(s).
Fix, use acl_xattr:ignore system acl = yes for now.
> So, suppose i have a computer called KAIN, i spawn a cmd shell in
> SYSTEM context and then i try to write to \\my_server\share\text.txt;
> workstation at a fist glance, try to acess using KAIN$ account, and if
> fail, do a guest access.
Yes, which is totaly correct.
> If KAIN$ account have no UID (and 'Domain Computers' have no GID),
> clearly share acess fail.
No, the computer uses system, but if you test manualy it sets the computername.
> I hope i was clear now.
> dott. Marco Gaiarin GNUPG
> Key ID: 240A3D66
> Associazione ``La Nostra Famiglia''
> Polo FVG - Via della Bontà, 7 - 33078 - San Vito al
> Tagliamento (PN)
> marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711
> f +39-0434-842797
> Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
> (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
To unsubscribe from this list go to the following URL and read the