Questions[likewise-open](server)

I have installed likewise-open and joined the domain succesfully on Ubuntu 12.04.

When I login with a domain user that is a member of Domain Admins I don't get administrator priveledges on the Ubuntu box.

I edited the /etc/sudoers file and added:

%HOME\\Domain^Admins ALL=(ALL) ALL

but this didn't work either. I can't run any sudo commands!

EDIT:

I've now also tried this (taken from PowerBroker docs):

On Ubuntu, you can simply add your domain account to the admin group 
in the /etc/group file by entering a line like the following as 
root:

admin:x:115:LIKEWISEDEMO\kathy

but this too didn't work!

Please see edit below, as it turns out that the problem is with uid/gid to sid mapping and shows a workaround that will help understand the problem more quickly.

We have a Ubuntu 11.04 server machine (lets's call it data) joined to Windows Domain with tools provided by likewise-open So far so good, because i am able to:

1. Log on to machine with AD credentials
2. Set permissions for files and folders with extended ACLs and they work. So by setting "Domain Admins" permission on the folder, i can log onto machine with different domain admin account and access that folder.

So the computer itself understands which domain groups i am member of and can correctly handle permissions.

But the problem is when i want to access files from samba share. Windows doesn't seem to understand that we are talking about same "Domain Admins" or any other domain user/group.

Details

The home folder has is acl-enabled

My share as it's in smb.conf:

[home]
        path = /home/local/MYDOMAIN
        browsable = yes
        guest ok = no
        read only = no
        writeable = yes
        valid users = MYDOMAIN\Administrator, @MYDOMAIN\"Domain Users", @MYDOMAIN\"Domain Admins"
        write list = @MYDOMAIN\"Domain Users", @MYDOMAIN\"Domain Admins"
        nt acl support = yes
        create mask = 700
        directory mask = 700
        hide dot files = yes

So far so good, i can access the share given that folder has read/execute permissions bits set for "others"

So lets try to access test_directory with domain permissions set. I remove any unix permissions:

janis.veinbergs@data:/home/local/MYDOMAIN$ whoami
janis.veinbergs
janis.veinbergs@data:/home/local/MYDOMAIN$ id janis.veinbergs
...1319633408(domain^admins)...
janis.veinbergs@data:/home/local/MYDOMAIN$ cd /home/local/MYDOMAIN
janis.veinbergs@data:/home/local/MYDOMAIN$ sudo chown root:root ./test_directory/
janis.veinbergs@data:/home/local/MYDOMAIN$ sudo chmod 700 ./test_directory/

So on the machine, if i try

ls ./test_directory/

Obviously, i get

ls: cannot open directory ./test_directory/: Permission denied

So i add all permissions for "Domain Admins". (I could have skipped the MYDOMAIN\ thing, because MYDOMAIN is the default domain for the machine)

$ sudo setfacl -m g:MYDOMAIN\\"Domain Admins":rwx ./test_directory/

I can do things in the directory

$ echo "yay" >> ./test_directory/test.txt
$ ls ./test_directory/
test.txt

So far so good, data understands domain groups.

But if i try to access that share on windows machine (from powershell):

PS> whoami
mydomain\janis.veinbergs
PS> gci \\data\home\test_directory
Get-ChildItem : Access to the path '\\data\home\test_directory' is denied.

Now, from data, i'll add permissions for others, so i can access that folder from windows:

$ sudo chmod o+rx ./test_directory/

Now, from windows, i can see files:

PS> gci \\data\home\test_directory


    Directory: \\data\home\test_directory


Mode                LastWriteTime     Length Name                                                                                      
----                -------------     ------ ----                                                                                      
-----       2012.02.06.     14:56          4 test.txt  

Now i can view permissions in properties window (localized, but you can get the idea)

I wonder why it shows Unix Group\domain^admins rather than MYDOMAIN\domain^admins ? What am i missing here and how to make it work?

EDIT: Found a workaround

I'v found a workaround and possible cause but don't know how to resolve It turns out that some wrong mapping between id's are happening.

If i look up the sid-to-gid mapping with wbinfo for MYDOMAIN\Domain Admins group i find that the mapped unix gid is 10010. And this if i set permissions using gid, not the name, the permissions works and windows understands them:

$ sudo setfacl -m g:10010:rwx ./test_directory/

When i enumerate permissions in numerical form, to see gid's and sid's, i see that when settings permissions like MYDOMAIN\"Domain Admins", it actually uses a different GID

$ getfacl -n ./test_directory/
# file: test_directory/
# owner: 0
# group: 0
user::rwx
group::r-x
group:10010:rwx  <-- this is the actual GID mapping for MYDOMAIN\\"Domain Admins" group (setfacl -m g:10010:rwx) and it works when browsing share with windows
group:1319633408:rwx <-- this entry is when setting permission like setfacl -m g:MYDOMAIN\\"Domain Admins":rwx
mask::rwx
other::---

I then looked at my idmap configuration in smb.conf:

   idmap domains = ALL
   idmap config ALL:backend = lwicompat_v4
   idmap config ALL:default = yes
   idmap config ALL:readonly = yes
   idmap uid = 10000-33554431
   idmap gid = 10000-33554431

I see that the gid from ACL entry 1319633408 doesn't go into the defined scope. So i tried extending scope to 10000-3355443100, restarted smbd, but it still didn't work.

So now i have a workaround, to set permissions using gid's, sid's, but thats not user friendly. What should i do to fix this?

I am using net use to map shares on a windows machine to Red Hat Linux using Likewise CIFS. I was wondering if there is a way to check which user a particular share was mapped as. I desire this information because Guest Mode is enabled which will mount the share as guest if invalid credentials are received. Therefore I am curios to know if the share got mounted as guest or as a different local user. If possible I would like to do this from the command line so it can be automated in a script.

Is likewise available via RHN?

I've used likewise-open a few times in ubuntu on small projects but looking at it again for a larger project. I have seen press releases regarding the support of likewise and redhat but can't find it in RHN.

The likewise enterprise site offers 'free downloads' of the open version in RPM format but I'd prefer to have something manged via RHN as that is the general policy here.

Has anyone got their Linux systems authenticating against Active Directory without using Likewise Open?

We are close to implementing Likewise Open, but first we need to rename roughly 70 of 110 Linux servers so that their hostnames are not longer than 15 characters. This is required because Likewise Open actually joins the Linux computer to the domain, and it fails to do so if the hostname is too long due to some legacy NetBIOS naming limitation.

• Is there a way to authenticate via AD, using only LDAP perhaps?
• What are the advantages/disadvantages over doing it like that vs just using Likewise?