#135 repquota/warnquota need 'user enumeration' enabled.

[Marco Gaiarin]

In samba, expecially in AD mode, it is suggested (it is the default) to disable 'user enumeration', eg add to smb.conf:

winbind enum users = no
winbind enum groups = no

this for performance reason, and consider that an AD domain can have many users and group, also organized in a 'forest' with multidomain linked...

Anyway, this clearly have impact on the NSS samba provider (winbind) and lead to 'getent passwd' that 'does not work', eg:

root@vdmsv1:~# getent passwd
root:x:0:0:root:/root:/bin/bash
[... all local users, not 'gaio' ...]
root@vdmsv1:~# getent passwd gaio
gaio:*:10000:10513:Marco Gaiarin:/home/gaio:/bin/bash

so, if i ask with 'getent' all the 'passwd' database, i gent only local one; if i ask esplicitly a domain user, i get it.

But this 'broke' also repquota:

root@vdmsv1:~# repquota -a
*** Report for user quotas on device /dev/sdc1
Block grace time: 28days; Inode grace time: 28days
                        Block limits                File limits
User            used    soft    hard  grace    used  soft  hard  grace
----------------------------------------------------------------------
root      -- 16735556       0       0            664     0     0       
debian-spamd --    1216       0       0             17     0     0       
help      --      48       0       0             10     0     0       

while clearly quota are here, if i can specify explicitly the user:

oot@vdmsv1:~# quota gaio
Disk quotas for user gaio (uid 10000): 
     Filesystem  blocks   quota   limit   grace   files   quota   limit   grace
      /dev/sdc1  557816  52428800 57671680            2012   50000   55005        

And clearly 'warnquota' does not work, because as 'repquota' enumerate users and found no one.

I suppose that 'fixing' this can be a bit hard, but for examples repquota ad warnquota can be modified to add an 'explicit user' option (eg, '-U gaio'), so we can wrap warnquota in an external script that enumerate users.

I hope i was clear. Thanks.

[Jan Kara]

Well, there's a better solution for this. If you have quota-tools >= 4.04 and if you run at least on kernel 4.6, there is support for Q_GETNEXTQUOTA quotactl and thus quota scanning doesn't need to use iteration over users through getpwent().

[Marco Gaiarin]

Cool! Thanks!

I'm still on debian stretch (quota 4.03), but buster have 4.04!

[Jan Kara]

OK, closing the bug for now. Feel free to reopen in case you have issues with newer versions.