DescriptionPavel Filipensky
2022-04-26 13:34:47 UTC
+++ This bug was initially created as a clone of Bug #2059151 +++
for 8.6 ztsream
Description of problem:
Since a recent Samba upgrade (4.14 / 4.15 ?), unix group membership rules are erroneously applied to /etc/samba/smbuser unix user accounts (i.e. entries without the '@' prefix).
Version-Release number of selected component (if applicable):
Tested with latest samba-4.15.5-3.el8.x86_64
How reproducible:
Always
Steps to Reproduce:
1. /etc/samba/smbusers entry : "root = administrator admin"
2. start a Samba session with a Samba user account belonging to the Unix group "admin"
Actual results:
User access is refused
Expected results:
User should be granted access
Additional info:
1. user "didier" is member of the unix group "admin". The user is mapped to the 'root'-account, which does not have a valid Samba account ; hence access is denied.
[2022/02/28 09:53:40.769579, 3, pid=4179984, effective(0, 0), real(0, 0), class=auth] ../../source3/auth/auth.c:202(auth_check_ntlm_password)
check_ntlm_password: Checking password for unmapped user [SAMBA]\[didier]@[CP0043] with the new password interface
[2022/02/28 09:53:40.769593, 3, pid=4179984, effective(0, 0), real(0, 0), class=auth] ../../source3/auth/auth.c:205(auth_check_ntlm_password)
check_ntlm_password: mapped user is: [SAMBA]\[root]@[CP0043]
[2022/02/28 09:53:40.770828, 3, pid=4179984, effective(0, 0), real(0, 0), class=auth] ../../source3/auth/check_samsec.c:399(check_sam_security)
check_sam_security: Couldn't find user 'root' in passdb.
[2022/02/28 09:53:40.770854, 2, pid=4179984, effective(0, 0), real(0, 0), class=auth] ../../source3/auth/auth.c:348(auth_check_ntlm_password)
check_ntlm_password: Authentication for user [didier] -> [root] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1
2. https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html#USERNAMEMAP states : "The list of usernames on the right may contain names of the form @group in which case they will match any UNIX username in that group."
The @-prefix is not present, nevertheless group membership rules are applied.
3. Mitigation :
3a. accounts which are not a member of unix group "admin" are granted access ;
3b. commenting out the "root = administrator admin" smbusers entry grants access to members of unix group "admin".
4. Summary :
It seems (unwanted) group membership rules are applied *without* the "@" prefix.
--- Additional comment from Pavel Filipensky on 2022-04-06 08:24:05 UTC ---
Fix is in progress. Bug was created in samba upstream:
https://bugzilla.samba.org/show_bug.cgi?id=15041
--- Additional comment from Pavel Filipensky on 2022-04-13 08:57:43 UTC ---
Patch for samba-4.15 and samba-4.16 ready. Plan is to fix it in RHEL 8.7 and 9.1 and then to create zstream bugs for 8.6 and 9.0.