Project

General

Profile

Tâche #33400

Scénario #33397: Mise à jour de sécurité samba 4.13

Traceback dans les postservice "30-gposcript" et "07-eolead-gpo"

Added by Joël Cuissinat almost 2 years ago. Updated almost 2 years ago.

Status:
Fermé
Priority:
Normal
Assigned To:
Gilles Grandgérard
Target version:
sprint 2021 46-49 Equipe MENSR
Start date:
11/15/2021
Due date:
% Done:

100%

Remaining (hours):
0.0

Description

Exemple dans https://dev-eole.ac-dijon.fr/jenkins/job/2.8.0/job/test-instance-acadc1-2.8.0-amd64/470/parsed_console/

            run-parts: executing /usr/share/eole/postservice/30-gposcript instance
            * Import GPO eole_script from export /usr/share/eole/gpo/eole_script.tar.gz
            * Fix netlogon
            * Import GPO
            Using temporary directory /tmp/tmpsjun37am (use --tmpdir to change)
            GPO 'eole_script' created as {DC98FF34-FB03-4CE5-BB04-65736B03DD56}

            WARNING: No such parser for ps.ps1

            WARNING: Falling back to simple copy-restore.

            WARNING: No such parser for comment.cmtx

            WARNING: Falling back to simple copy-restore.

            WARNING: No such parser for installMinion.ps1

            WARNING: Falling back to simple copy-restore.

            WARNING: No such parser for Registry.xml

            WARNING: Falling back to simple copy-restore.
            * Version différente, positionne à 393225
            Modified CN={DC98FF34-FB03-4CE5-BB04-65736B03DD56},CN=Policies,CN=System,DC=domseth,DC=ac-test,DC=fr
            Modified 1 records successfully
            * Fix GPO

            ERROR(<class 'TypeError'>): uncaught exception - getntacl() missing 1 required positional argument: 'session_info'
              File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 186, in _run
                return self.run(*args, **kwargs)
              File "/usr/lib/python3/dist-packages/gpo_utils/helper.py", line 46, in run
                self.check_gpos_acl()
              File "/usr/lib/python3/dist-packages/gpo_utils/gpo_eole.py", line 315, in check_gpos_acl
                fsacl = getntacl(self.lp, root_policy_path, direct_db_access=direct_db_access, service=SYSVOL_SERVICE)
            Check sysvol ACL NOK, do sysvolreset, please wait ...
            Reset sysvol ACL OK
            * Import GPO eole_script : OK

backup-gpo.png View (4.33 KB) Daniel Dehennin, 11/15/2021 03:50 PM

Associated revisions

Revision f25c1d2c (diff)
Added by Gilles Grandgérard almost 2 years ago

Suite migration samba 4.13, session_info est obligatoire

REF #33400

Revision 6a94ece5 (diff)
Added by Joël Cuissinat almost 2 years ago

fix migration samba 4.13 (suite)

REF #33400

History

#1 Updated by Daniel Dehennin almost 2 years ago

J’ai fait un test

  1. Une sauvegarde du GPO eole_script par RSAT donne Objet de stratégie de groupe :eole_script...Échec
  2. juste après un samba-tool ntacl sysvolreset
    root@addc:~# samba-tool ntacl sysvolcheck
Unknown parameter encountered: "rndc command" 
Ignoring unknown parameter "rndc command" 
Unknown parameter encountered: "rndc command" 
Ignoring unknown parameter "rndc command"
  3. ajout d’un GPO pour associer l’extension .md comme document texte
    root@addc:~# samba-tool ntacl sysvolcheck
Unknown parameter encountered: "rndc command" 
Ignoring unknown parameter "rndc command" 
Unknown parameter encountered: "rndc command" 
Ignoring unknown parameter "rndc command" 
ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: DB ACL on GPO directory /home/sysvol/dompedago.etb1.lan/Policies/{560B0FB3-F157-4C41-81FC-BFFF8CBF590D} O:DAG:DAD:PAI(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) does not match expected value O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) from GPO object
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 186, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/ntacl.py", line 443, in run
    provision.checksysvolacl(samdb, netlogon, sysvol,
  File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1893, in checksysvolacl
    check_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp,
  File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1843, in check_gpos_acl
    check_dir_acl(policy_path, dsacl2fsacl(acl, domainsid), lp,
  File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1786, in check_dir_acl
    raise ProvisioningError('%s ACL on GPO directory %s %s does not match expected value %s from GPO object' % (acl_type(direct_db_access), path, fsacl_sddl, acl))

La seule différence notée est

--- /tmp/ntacls.orig    2021-11-15 15:42:27.317607228 +0100
+++ /tmp/ntacls    2021-11-15 15:42:37.533602968 +0100
@@ -1 +1 @@
-O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)
+O:DAG:DAD:PAI(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)

À noter les lettre AI en plus en début de seconde ligne.

#2 Updated by Joël Cuissinat almost 2 years ago

  • Status changed from Nouveau to En cours

#3 Updated by Joël Cuissinat almost 2 years ago

  • Assigned To set to Gilles Grandgérard

#4 Updated by Joël Cuissinat almost 2 years ago

Suite à cette correction, une nouvelle erreur apparaît :

19:50:36             * Fix GPO
19:50:36             ERROR(<class 'NameError'>): uncaught exception - name 'system_session_unix' is not defined
19:50:36               File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 186, in _run
19:50:36                 return self.run(*args, **kwargs)
19:50:36               File "/usr/lib/python3/dist-packages/gpo_utils/helper.py", line 46, in run
19:50:36                 self.check_gpos_acl()
19:50:36               File "/usr/lib/python3/dist-packages/gpo_utils/gpo_eole.py", line 314, in check_gpos_acl
19:50:36                 session_info = system_session_unix()

#5 Updated by Joël Cuissinat almost 2 years ago

  • Status changed from En cours to Résolu
  • % Done changed from 0 to 100

Diffusé en stable 2.8 le 18/11/2021

#6 Updated by Joël Cuissinat almost 2 years ago

  • Status changed from Résolu to Fermé
  • Remaining (hours) set to 0.0

Tests OK

Also available in: Atom PDF