LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices



Reply
 
Search this Thread
Old 07-21-2004, 11:53 PM   #1
kenji1903
Member
 
Registered: Apr 2004
Location: M'sia, Aus, Chn
Distribution: Redhat Linux 8 & 9, Fedora Core 2, XP
Posts: 301

Rep: Reputation: 30
Map Windows NT Groups to UNIX Groups - why?


Code:
#!/bin/bash
#
# initGrps.sh
#

# Create UNIX groups
groupadd acctsdep
groupadd finsrvcs

# Map Windows Domain Groups to UNIX groups
net groupmap modify ntgroup="Domain Admins" unixgroup=root
net groupmap modify ntgroup="Domain Users" unixgroup=users
net groupmap modify ntgroup="Domain Guests" unixgroup=nobody

# Add Functional Domain Groups
net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d

# Map Windows NT machine local groups to local UNIX groups
net groupmap modify ntgroup="Administrators" unixgroup=sys
net groupmap modify ntgroup="Users" unixgroup=public
net groupmap modify ntgroup="Guests" unixgroup=nobody
net groupmap modify ntgroup="System Operators" unixgroup=daemon
net groupmap modify ntgroup="Account Operators" unixgroup=wheel
net groupmap modify ntgroup="Backup Operators" unixgroup=bin
net groupmap modify ntgroup="Print Operators" unixgroup=lp
net groupmap modify ntgroup="Replicators" unixgroup=kmem
net groupmap modify ntgroup="Power Users" unixgroup=ntadmin
6. Q: Why must I map Windows Domain Groups to UNIX groups?
A: Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are: Domain Guests, Domain Users, Domain Admins.

I got this snippet from www.samba.org, entitled "Samba-3 by Example"

I manage to get Samba working with domain logons without running anything from above, is it related?
 
Old 07-22-2004, 02:59 AM   #2
MS3FGX
Guru
 
Registered: Jan 2004
Location: NJ, USA
Distribution: Slackware, Debian
Posts: 5,852

Rep: Reputation: 351Reputation: 351Reputation: 351Reputation: 351
You only need to do that if you want to have your Windows users organized by groups and have group permissions.
 
Old 07-22-2004, 06:45 AM   #3
kenji1903
Member
 
Registered: Apr 2004
Location: M'sia, Aus, Chn
Distribution: Redhat Linux 8 & 9, Fedora Core 2, XP
Posts: 301

Original Poster
Rep: Reputation: 30
Thanks for the reply!

Are the last few lines of my /var/log/messages related to this issue?


Code:
Jul 20 15:05:22 redhat32 smbd[4888]: [2004/07/20 15:05:22, 0] rpc_server/srv_pipe.c:api_pipe_netsec_process(1397) 
Jul 20 15:05:22 redhat32 smbd[4888]:   failed to decode PDU 
Jul 20 15:05:22 redhat32 smbd[4888]: [2004/07/20 15:05:22, 0] rpc_server/srv_pipe_hnd.crocess_request_pdu(605) 
Jul 20 15:05:22 redhat32 smbd[4888]:   process_request_pdu: failed to do schannel processing. 
Jul 20 15:05:23 redhat32 smbd[4888]: [2004/07/20 15:05:23, 0] smbd/service.c:set_current_service(56) 
Jul 20 15:05:23 redhat32 smbd[4888]:   chdir (/home/samba/netlogon) failed 
Jul 20 15:05:24 redhat32 smbd[4888]: [2004/07/20 15:05:24, 0] smbd/service.c:set_current_service(56) 
Jul 20 15:05:24 redhat32 smbd[4888]:   chdir (/home/samba/netlogon) failed 
Jul 20 15:05:33 redhat32 smbd[4888]: [2004/07/20 15:05:33, 0] rpc_server/srv_util.c:get_domain_user_groups(376) 
Jul 20 15:05:33 redhat32 smbd[4888]:   get_domain_user_groups: primary gid of user [redhat32admin] is not a Domain group ! 
Jul 20 15:05:33 redhat32 smbd[4888]:   get_domain_user_groups: You should fix it, NT doesn't like that
 
Old 07-24-2004, 11:13 PM   #4
kenji1903
Member
 
Registered: Apr 2004
Location: M'sia, Aus, Chn
Distribution: Redhat Linux 8 & 9, Fedora Core 2, XP
Posts: 301

Original Poster
Rep: Reputation: 30
*bump*
 
Old 10-16-2007, 12:52 PM   #5
Medievalist
Member
 
Registered: Aug 2003
Distribution: Dead Rat
Posts: 175

Rep: Reputation: 37
Yes, that's the "NT doesn't like that" error.

Map the group the log is whinging about, and you will not only eliminate that error message, you will significantly speed up the login process for the client machine.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
groups (system default groups) Xavius Linux - General 2 07-18-2012 03:50 AM
limit to nesting groups within groups? geekgrl Linux - General 3 10-16-2007 12:50 PM
A problem with UNIX users groups pedrosan Linux - Newbie 4 06-09-2004 10:00 PM
winbind: wbinfo -g only lists global groups from PDC and not local groups saradiya Linux - Networking 0 12-01-2003 03:58 AM
Groups members of other groups bentz Linux - Security 6 06-23-2003 12:23 AM


All times are GMT -5. The time now is 01:55 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration