Re: samba-3.5.14 (and less) corrupting AD->UID mappings

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

On Thu, Aug 2, 2012 at 5:07 PM, Jason Haar <Jason_Haar@xxxxxxxxxxx> wrote:
> Hi there
> We've had three incidents this year where users connected to Samba
> shares (on CentOS systems) and appeared as the incorrect Windows
> account. e.g "dom\user1" would connect, but any files they created would
> be owned by Unix user "dom\user2"

And you're using Samba 3.5.14.... why? The built in Samba is
samba-3.5.10, as published by the upstream vendor, Red Hat. And the
current 3.x release is 3.6.6. By playing with an intermediate and
vendor unsupported version, you expose yourself to all the bugs fixed
in more recent releases, without the vendor support to address any
bugs known to exist in the old version.

If you need 3.6.6, which is the current 3.6 release, check out my SRPM
tools at for something that
builds very cleanly and compatibly with RHEL 6 and CentOS 6.

> This is of course pretty nasty. We normally delete all the cache and
> winbind TDB files and restart and that fixes it - but that isn't really
> a fix. There is a hint this may be associated with sites with RODCs -
> but last night we just had it happen on a site that has both "true" AD
> 2008-R2 DCs and RODCs - so maybe winbind was talking to the RODC there -
> maybe not - dunno
> Is this a known issue, and if not, what can I do to track down the
> cause, as it "sort of" diminishes the usefulness of Samba if you can't
> trust the file ownership anymore
> Thanks
> --
> Cheers
> Jason Haar
> Information Security Manager, Trimble Navigation Ltd.
> Phone: +1 408 481 8171
> PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:
To unsubscribe from this list go to the following URL and read the

[Linux]     [Info Cyrus]     [LARTC]     [Bugtraq]     [Netfilter]     [Internet Dating Forums]     [RAID]     [Yosemite News]     [Photography]

Add to Google Powered by Linux