Site Maintenance this evening The site will be offline for hosting changes. Time TBC

+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 24
*nix Thread, Mapping AD groups to Unix groups in Technical; I have a new linux machine set up and it is joined to the domain. I want to enable a ...
  1. #1

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,680
    Thank Post
    516
    Thanked 2,451 Times in 1,897 Posts
    Blog Entries
    24
    Rep Power
    832

    Mapping AD groups to Unix groups

    I have a new linux machine set up and it is joined to the domain. I want to enable a map so that the local 'adm' group on the linux machine contains the 'Domain Admins' group of the AD.

    Does anyone know how to do this?

  2. #2

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,680
    Thank Post
    516
    Thanked 2,451 Times in 1,897 Posts
    Blog Entries
    24
    Rep Power
    832

    Re: Mapping AD groups to Unix groups

    And, to answer my own question.

    You use 'net group add/modify'.

    And on Ubuntu group maps are already set up but are set to null (so Domain Admins -> -1) so you have to use 'net group modify ntgroup="Domain Admins" unixgroup=blah.

  3. #3

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,680
    Thank Post
    516
    Thanked 2,451 Times in 1,897 Posts
    Blog Entries
    24
    Rep Power
    832

    Re: Mapping AD groups to Unix groups

    Well I seem to have a problem. I am trying to set up CUPS + Samba (and eventually pykota).

    I have the machine joined to the domain fine, I have used the net group modify command to map Domain Admins -> adm etc... but when I set up the samba print$ share (per http://us1.samba.org/samba/docs/man/...-printing.html) I add @adm as a write list member for the share and also @adm as 'printer admin' in the [printers] share details.

    When I try and follow the instructions for adding drivers to the share via the windows method, the driver list is empty and the 'Add Driver' button greyed out. I am guessing that this is due to the group mappings not working properly.

    Any advice?

  4. #4

    webman's Avatar
    Join Date
    Nov 2005
    Location
    North East England
    Posts
    8,406
    Thank Post
    639
    Thanked 961 Times in 661 Posts
    Blog Entries
    2
    Rep Power
    324

    Re: Mapping AD groups to Unix groups

    Can you not just give write to @"Domain Admins" instead of adm?

  5. #5

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,680
    Thank Post
    516
    Thanked 2,451 Times in 1,897 Posts
    Blog Entries
    24
    Rep Power
    832

    Re: Mapping AD groups to Unix groups

    hmm... I hadn't tried it without the domain in front of it. I'll try and see.

  6. #6

    webman's Avatar
    Join Date
    Nov 2005
    Location
    North East England
    Posts
    8,406
    Thank Post
    639
    Thanked 961 Times in 661 Posts
    Blog Entries
    2
    Rep Power
    324

    Re: Mapping AD groups to Unix groups

    If getent passwd and getent group include domain users and groups, then I don't see why it shouldn't work.

  7. #7

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,680
    Thank Post
    516
    Thanked 2,451 Times in 1,897 Posts
    Blog Entries
    24
    Rep Power
    832

    Re: Mapping AD groups to Unix groups

    Tried it and it still doesn't work. Any other ideas?

  8. #8

    webman's Avatar
    Join Date
    Nov 2005
    Location
    North East England
    Posts
    8,406
    Thank Post
    639
    Thanked 961 Times in 661 Posts
    Blog Entries
    2
    Rep Power
    324

    Re: Mapping AD groups to Unix groups

    I presume you've tried the usual wbinfo with '-u', '-g' and '-a user%pass' to test everything's working?

  9. #9

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,680
    Thank Post
    516
    Thanked 2,451 Times in 1,897 Posts
    Blog Entries
    24
    Rep Power
    832

    Re: Mapping AD groups to Unix groups

    Yep. getent works fine. I have the full lists working. And the wbinfo is working fine too.

    All the authentication stuff works fine, it just seems to be the use of iit for checking share permissions.

  10. #10

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Mapping AD groups to Unix groups

    you need to use 'net groupmap' to associate the correct SSID for Domain Admins with a local unix group.

  11. #11

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,680
    Thank Post
    516
    Thanked 2,451 Times in 1,897 Posts
    Blog Entries
    24
    Rep Power
    832

    Re: Mapping AD groups to Unix groups

    I already have done that... (I mistyped my earlier message). I have Domain Admins -> adm, Domain users -> users and Domain Guests -> nobody.

  12. #12

    SimpleSi's Avatar
    Join Date
    Jun 2005
    Location
    Lancashire
    Posts
    5,812
    Thank Post
    1,476
    Thanked 592 Times in 444 Posts
    Rep Power
    168

    Re: Mapping AD groups to Unix groups

    Maybe of no help at all but I can't get proper adminstrative remote control of my Ubuntu/CUPS/Samba printerserver and thats on a peer to peer network with no security at all.

    I believe that CUPS adminstration is broken on Ubuntu due to philosphicall differences (eg geek war) in the community.

    This info is 4 months old so maybe things have changed?

    regards

    Simon

  13. #13

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Mapping AD groups to Unix groups

    I think that deserves a separate thread SimpleSi.

  14. #14

    SimpleSi's Avatar
    Join Date
    Jun 2005
    Location
    Lancashire
    Posts
    5,812
    Thank Post
    1,476
    Thanked 592 Times in 444 Posts
    Rep Power
    168

    Re: Mapping AD groups to Unix groups

    @geoff - not looking for any help - just saying I believe CUPS adminstration is broken under Ubunutu and maybe that's why options are greyed out and not actually a permissions problem.

    regards
    Simon

  15. #15

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,680
    Thank Post
    516
    Thanked 2,451 Times in 1,897 Posts
    Blog Entries
    24
    Rep Power
    832

    Re: Mapping AD groups to Unix groups

    I think I'll go over to the ubuntu forums site and post about it.

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Internet Filtering groups
    By steele_uk in forum How do you do....it?
    Replies: 4
    Last Post: 17th July 2007, 01:33 PM
  2. ISA 2004 Blocking Groups
    By drewinc in forum Windows
    Replies: 4
    Last Post: 11th June 2007, 12:37 PM
  3. Unusual groups in AD
    By Kyle in forum Windows
    Replies: 3
    Last Post: 19th April 2007, 07:35 AM
  4. Censornet Groups
    By leon in forum *nix
    Replies: 7
    Last Post: 21st February 2007, 10:46 PM
  5. Security Groups in 2003
    By SpuffMonkey in forum Windows
    Replies: 1
    Last Post: 19th July 2006, 11:18 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •