Re: [Samba] RFC2307: Recommendations for mapping Administrator account
- Date: Thu, 8 Feb 2018 10:55:30 +0100
- From: Denis Cardon via samba <samba@xxxxxxxxxxxxxxx>
- Subject: Re: [Samba] RFC2307: Recommendations for mapping Administrator account
I provisioned a new domain with "--use-rfc2307" as I want to use the
"ad" idmap backend on my domain members.
unless you have really specific requirements, you should really stick
with RID mapping, it will be easier on the long run.
I am thinking of mapping the "Administrator" account to UID 10000
(this is where my UID range for the domain will be starting), as the
account must be known to the domain members (otherwise I got funny
behavior).It seems a lot of people are mapping that account to root
(UID 0) though. Even the Samba Wiki mentions that. Is that such a good
root on linux would be the equivalent of "Local System" on Windows.
Windows Administrator account is definitly not "Local System", so in
order to follow privileges separation of Windows, I would say it is
better not to map Administrator to root.
Moreover, in more security conscious context, Administrator account
should not be used alltogether, since it does not map to a physical
The best thing is to disable that account altogether, and have named
accounts like dcardon-adm part of "domain admins" for specific tasks
needing "domain admins" rights. But even in this case, except for
joining a new DC (and a few non frequent other things like changing the
schema), you shouldn't need "domain admins" level privileges. You should
just use Delegated rights on the OU you are managing.
I know that mapping the account to uidNumber=0 using RFC2307 AD attrs
will not work globally, as this is out of the idmap range. I could map
the account on each member locally using a custom username map, but I
was wondering if this is even desirable.
Does it have any implications on the Samba AD DC, if the Administrator
account has such a custom mapping? From what I understand the UID on
the DC will still be 0.
Tranquil IT Systems
Les Espaces Jules Verne, bâtiment A
12 avenue Jules Verne
44230 Saint Sébastien sur Loire
tel : +33 (0) 220.127.116.11.55
Samba install wiki for Frenchies : https://dev.tranquil.it
WAPT, software deployment made easy : https://wapt.fr
To unsubscribe from this list go to the following URL and read the