0

so i ran into a disaster and have to get the server up and running on monday morning :D my ubuntu server setup with samba / winbind and joined to active directory domain controller holds the shared folders of many departments with specific access rights based on AD users.. my main server went nuts and everything stopped working on it. after some troubleshooting i decided not to waste my time and create a fresh new one with the EXACT same configuration, everything went well, i mounted the old disk on the new VM and i was able to access the share BUT.. the access rights are messed up , naturally new UIDs are assigned to different users. so i did some digging and i copied the old winbindd_idmap.tdb from the old server and restored it on the new one. it didnt work so i copied the whole /var/lib/samba to the new one and it didnt work. i event copied /etc/passwd and /etc/shadow and group but i knew it wasn't necessary as they don't hold any mapping. needless to say it didn't work. anyone knows how to perform a miracle and get the old user mapping on the new server so the access rights reflect correctly ?

Many thanks

This is my smb.conf:

[global]

# No .tld
workgroup = UFA
# Active Directory System
security = ads
# With .tld
realm = UFA.LOCAL
# Just a member server
domain master = no
local master = no
preferred master = no
# Disable printing error log messages when CUPS is not installed.
printcap name = /etc/printcap
load printers = no
# Works both in samba 3.2 and 3.6.        
idmap backend = tdb
idmap uid = 10000-99999
idmap gid = 10000-99999
# no .tld
idmap config UFA:backend = rid
idmap config UFA:range = 10000-99999
winbind enum users = yes
winbind enum groups = yes
# This way users log in with username instead of username@example.org
winbind use default domain = yes
# Inherit groups in groups
winbind nested groups = yes
winbind refresh tickets = yes
winbind offline logon = true
# Becomes /home/example/username
template homedir = /home/%D/%U
# No shell access
template shell = /bin/false
client use spnego = yes
client ntlmv2 auth = yes
encrypt passwords = yes
restrict anonymous = 2
log file = /var/log/samba/samba.log
log level = 2

[Share]

comment = Share
path = /share/
valid users = @UFA\"Domain Users"
force group = "domain users"
writable = yes
read only = no
force create mode = 0660
create mask = 0777
directory mask = 0777
force directory mode = 0770
access based share enum = yes
hide unreadable = yes
0

1- First solution so i found the problem, it turned out that the server was suddenly making a jump in the future of 1 day (date is 1 day ahead ) normally all services are messed up this point, i reboot the server and the time is corrected BUT services are still messed up at this point. I had to also delete all log files created with the wrong date and restart winbind, nmbd and smbd to correct the problem.

2- Second solution to bypass the issue of users getting messed up from one linux to another all you have to do is backup and restore access rights from a WINDOWS perspective and not from linux itsel. that way the windows reads to correct SIDs and will move them correctly. one way to do that is to bring both old and new server online, and access the shares from the windows domain controller and make use of icacls to backup from old and restore to new.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.