0

Environment:

  • fresh Debian 10 Samba 4.9.5-Debian as AD-DC, using internal LDAP, internal DNS, RFC2307 enabled, libnss-winbind enabled and configured, libpam-winbind enabled and configured
  • fresh Debian 10 Samba 4.9.5-Debian as Fileserver, joined to the AD-Domain, RFC2307 enabled, libnss-winbind enabled and configured, libpam-winbind enabled and configured
  • Windows 7 and Windows 10 Clients
  • Various Linux Servers will join the AD-Domain
  • Microsoft RSAT Tools installed on Windows 7 for Management

AD-Users and AD-Groups simply work on Windows, both have NIS User/Group IDs assigned.

getent passwd on the fileserver shows all AD-users. getent group on the fileserver shows all AD-groups, but all AD-groups appear empty on Linux. Windows RSAT tools show group members as expected.

Output is somegroup:x:23456:.

Expected output is somegroup:x:23456:joe.user,tim.trouble,n.o.clue.

It seems I'm missing a little detail that needs to be configured.

Alexander Foken
  • 401
  • 1
  • 4
  • 5

2 Answers2

1

Solution was a missing parameter in smb.conf, shown in Linux nested groups with winbind

winbind expand groups defaults to 0 since Samba 4.2, has to be non-zero to list user members in getent group.

I've set winbind expand groups = 10 in smb.conf on the file server, that works for our little Samba-AD.

Alexander Foken
  • 401
  • 1
  • 4
  • 5
0

Have a look at winbind enum users + winbind enum groups. They default to no in smb.conf.

Quoting winbind enum users:

If the winbind enum users parameter is no, calls to the getpwent system call will not return any data.

and winbind enum groups:

If the winbind enum groups parameter is no, calls to the getgrent() system call will not return any data.

That said, you should not need to enable the settings. Users and groups can be enumerated via wbinfo -u and wbinfo -g.

dpat
  • 156
  • 4
  • winbind enum users and winbind enum groups are enabled. wbinfo -u and wbinfo -g return the AD users and AD groups. getent group doesn't list group **members** as expected. – Alexander Foken May 14 '21 at 19:40
  • Now I get what you mean. And yes, it seems listing the group members do not work remotely. The closest I've found is, that the group membership requires a special permission to be able to do so, see: https://serverfault.com/a/626997/351892 JFTR: On the Domain Controller, group members can be listed with: `samba-tool group listmembers $GROUPNAME". – dpat May 15 '21 at 14:35
  • serverfault.com/a/626997/351892 looks promising, but the domain users have no "security" tab in RSAT tools on Win7. I see no way to grant the "read group membership" permissions. – Alexander Foken May 17 '21 at 12:59