OMV 6.X (RC1) Active Directory

    Hi Dohn, you help me a lot, ty!


    I have everything done, but I can't change permissions from Windows...


    I'm having problems when I'm trying to change permissions from Windows Domain Controler and I don't know why...


    When I created the shared folder I own to my ADADMIN and ADAdminGroup with all permissions, and all permissions to for other users, but when I'm trying to add new group or change permissions in my Windows computer with de owner user (adadmin) i can't, it says "Access Denied"... Have you any issue with it?

    Zitat von donh

    Are you trying to change the permissions using windows? It used to work there. I don.t have much experience with things newer than win 7 or server 2012 r2. I have retired and use linux these days.

    Yes, I allways use windows for set permissions in shared folders, but I'm new with open media vault and it seems to doesn't work like other tools. I'll investigate, thanks!

    Zitat von donh

    What versions are you using?

    I am using OpenMediaVault 6.1.0-0 and as Windows AD a Windows Server 2019.


    I think I've figured out the problem as to why it wouldn't let me change permissions from Windows... in the SMB/CIFS shared settings I had "Guests only" selected, and changing to "Guests allowed" seems to let me edit permissions fine from Windows. I put this in case it helps anyone!

    Hi there,


    I am currently trying to integrate my OpenMediaVault into a Linux domain based on FreeIPA. It looks like I have to use ipasam as passdb backend instead of ldapsam. In CentOS it is probably sufficient to place the file ipasam.so in the same directory as ldapsam.so. However, I can't find ldapsam.so anywhere on my OpenMediaVault server. When I put the file where I think I should put it, I still get the response "No builtin nor plugin backend for ipasam found" when I test with "pdbedit -L -b ipasam". "pdbedit -L -b tdbsam" works as it should. Does anyone here know where I can store a passdb plugin file (*.so) in omv so that samba can find and use it?


    If I then manage to integrate my omv into my domain, I will be happy to post the complete procedure here in the thread. Even if it is not directly about Active Directory.

    • Offizieller Beitrag

    I don't have freeipa to test with so this is only a guess. I would try under a vm if it were me. Freeipa is available on debian 11.

    You can see what freeipa will install with apt install freeipa --dry-run. I see promising things in the list.


    Please let us know what you find.

    Thanks for testing.

    Thanks for the quick reply.


    When I try "apt install freeipa --dry-run" this is what I get (translated from German):

    Code
    root@greenvault-data:~# apt install freeipa --dry-run
Package lists are read... Done
Dependency tree is built... Done
Status information is read in... Done
Package freeipa is not available, but is referenced by another package
referenced by another package. This may mean that the package is missing, that it has been replaced
or is only available from another source.

E: There is no installation candidate for package "freeipa".

    "apt-cache search freeipa" shows me similar results to yours:

    Am I missing any repositories?


    What I found out is that ipasam.so is included in the package freeipa-server-trust-ad (https://manpages.debian.org/ex…adtrust-install.1.en.html), but it seems to be only available in experimental. Actually, I only need this small passdb backend plugin and would like to avoid installing dozens of packages + dependencies for it, which I don't need at all. The package "freeipa-client-samba" (bullseye-backports), which I want to use to set up the Samba server, does not contain the ipasam.so either.


    Some more information that I didn't mention in my first post: The freeipa-client is already installed on my omv (via bullseye-backports) and connected and I can already login to SSH with my domain users. I just need to get Samba to get its users from FreeIPA. I have already extracted the ipasam.so file from my domain controller, which needs the above package to provide user sids and NT password hashes, and just need to put it in the right place on my omv samba server. I just need to know where it is. I should then be able to set up my omv Samba roughly according to these instructions: https://superuser.com/question…ents-accessing-cifs-share

    Do you mean the values UID_MAX and GID_MAX? They only control up to which value new users with useradd or similar assign numbers. Wouldn't that provoke conflicts if I moved these values into the range of my domain? Or have I misunderstood something?


    But that's right. With id, for example, I can already display my domain users on omv:

    Code
    root@greenvault-data:~# id kristian
uid=1750400007(kristian) gid=1750400007(kristian) Gruppen=1750400007(kristian),1750400006(emby_user),1750400012(users)

    Local user:

    Code
    root@greenvault-data:~# id Kristian_Local
uid=1000(Kristian_Local) gid=100(users) Gruppen=100(users),1000(DieGruenen)


    I thought it couldn't be that hard to get Samba to use this user base but I don't see it in the GUI and logging in with domain users on the Samba share doesn't work either in any case. I also can't make domain users the owner of files via chown or assign access rights with chmod. :/

    I have set UID_MAX and GID_MAX in the login.defs to 1750600000 (Posix ID range in FreeIPA: 1750400000 to 1750600000). Unfortunately, I do not yet see my domain users in the Web GUI. I cannot tab (auto complete) the users with chown or chmod either. However, I can assign file permissions to domain users on the command line if I enter the full user name manually.

    • Offizieller Beitrag

    I added in samba extras

    winbind enum users = yes


    winbind enum groups = yes


    Maybe there is something for freeipa.?


    Also look at nsswitch..conf.


    That is about all I can think of. Maybe a freeipa forum might help?


    One other thing. In past version I had to change login.defs. Seems some setting is making the windows users in the range elow 60,000. Tried a lot of things before I ended up with the right combo for windows ad.


    Good luck

    I have now managed to display my domain users in the interface. To do this, I had to add this line to /etc/sssd/sssd.conf in addition to the change you suggested to UID_MAX and GID_MAX in /etc/login.defs:

    Code
    [domain/my.domain] ## Should already be there after ipa-client-install command
enumerate = true


    Then empty the ssssd cache once and the users were there. The information about this came from an older post here in the forum: OMV / FreeIPA Integration


    However, I still haven't managed to get them to log on to SMB. I am still grateful for any tips.

    • Offizieller Beitrag

    Seems you are very close.

    Zitat von MacroMars

    However, I still haven't managed to get them to log on to SMB. I am still grateful for any tips.

    Not sure what you mean. If you mean log in to the web ui that would require some setting in the AD. Maybe a group the has that access?


    If you mean can't access shares that should be setting the permissions of the share.


    This may be of interest too.

    Thema
    Hide Shared Folders that a User can't access (workaround for access based share enum)
    See here, Guide by @TechSmurf

    Samba 'access based share enum' workaround for workgroups (Hide shares that users don't have access to)

    Greetings
    David
    davidh2k

    For the WebUI, it is sufficient to add the domain user to the local group openmediavault-admin. It's a pity that I can't add another group to that group that I can then manage from my DC. But I'm sure there are other ways to achive that if I dig a little deeper..


    What I actually meant was that if I try to access from my Windows client via unc path (\\server.my.domain\) and try to log in there, the login data of the local users work but not those of the domain users. I immediately get the message incorrect password or user name, when I try it with a domain user.

Jetzt mitmachen!

Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!

Benutzerkonto erstellen Anmelden