Samba filesharing access for users not working

DarkFlame · 01-10-2009, 04:30 PM

For the life of me, I can't believe how difficult it is to get Samba to share files to my WinXP Pro boxes. Here's the low-down on what I've got:

Ubuntu Server 8.10 with Samba 3.2.3, running headless (& apparently brainless - oh, that's me). I've got a RAID5 array mounted and I can see the data in PuTTY.

My WinXP box can see the server in the workgroup, and I can see folders for groups, profiles, users, Printers and Faxes, and "data" - it is "data" to which I need access.

When I click on it, I get the login dialog box http://www.readycashhomebuyers.com/Linux/ConPwDlg.jpg and it won't go away.

Here is my smb.conf file:

Code:

[global]
        workgroup = RCH-WORKGROUP
        printing = cups
        printcap name = cups
        printcap cache time = 750
        cups options = raw
        map to guest = Bad User
        include = /etc/samba/dhcp.conf
        logon path = \\%L\profiles\.msprofile
        logon home = \\%L\%U\.9xprofile
        logon drive = P:
        usershare allow guests = No
        winbind gid = 10000-20000
        winbind uid = 10000-20000
        security = user
        usershare max shares = 100
        add machine script = /usr/sbin/useradd  -c Machine -d /var/lib/nobody -s /bin/false %m$
        domain logons = No
        domain master = No

[homes]
        comment = Home Directories
        valid users = %S, %D%w%S
        browseable = No
        read only = No
        inherit acls = Yes

[profiles]
        comment = Network Profiles Service
        path = /NW-DATA/
        read only = No
        store dos attributes = Yes
        create mask = 0660
        directory mask = 0770
        valid users = david,april
        admin users = david,april
        guest account = admiral
        guest ok = yes

[data]
        comment =
        inherit acls = Yes
        path = /NW-DATA/DATA/
        read only = No
        force create mode = 0660
        force directory mode = 0770
        writeable = yes
        writable = yes

I have created the users david & april in both Linux & Samba, and given each of them the password that we use to log into our WinXP Pro boxes.

It's been suggested that maybe there are traces of SELinux (Security Enhanced), that might be found in the audit.log. So, here is my audit.log (/var/log/audit/audit.log):

Code:

type=DAEMON_START msg=audit(1231612498.610:7799): auditd start, ver=1.6.8 format=raw kernel=2.6.25.5-1.1-pae auid=4294967295 pid=8940 res=success
type=DAEMON_END msg=audit(1231613351.667:7800): auditd normal halt, sending auid=0 pid=32287 subj= res=success
type=DAEMON_START msg=audit(1231613648.327:9592): auditd start, ver=1.6.8 format=raw kernel=2.6.25.5-1.1-pae auid=4294967295 pid=2800 res=success
type=DAEMON_END msg=audit(1231615524.966:9593): auditd normal halt, sending auid=0 pid=6295 subj= res=success
type=DAEMON_START msg=audit(1231615588.094:6798): auditd start, ver=1.6.8 format=raw kernel=2.6.25.5-1.1-pae auid=4294967295 pid=2726 res=success
type=DAEMON_END msg=audit(1231621158.302:6799): auditd normal halt, sending auid=0 pid=6666 subj= res=success
type=DAEMON_START msg=audit(1231621221.653:5009): auditd start, ver=1.6.8 format=raw kernel=2.6.25.5-1.1-pae auid=4294967295 pid=2737 res=success
type=DAEMON_END msg=audit(1231624357.325:5010): auditd normal halt, sending auid=0 pid=5053 subj= res=success
type=DAEMON_START msg=audit(1231624430.258:299): auditd start, ver=1.6.8 format=raw kernel=2.6.25.5-1.1-pae auid=4294967295 pid=2737 res=success

I'm no longer sure what I'm looking for. I'm certain there is some simple solution, but for the life of me, I can't find it. I did have a copy of OpenSuSE installed that was working, and I had copied the share section for "data" from that smb.conf to the Ubuntu one (on different HDDs), and it worked. When I went to do a re-install, as a learning exercise, I wiped out the OpenSuSE drive (what I wanted to do), and then reinstalled Ubuntu on the Ubuntu drive (NOT what I wanted to do), which wiped out the working smb.conf on BOTH drives.

I've tried to get OpenSuSE working again, but I'm not having the same problem with IT. In fact, the info above is from OpenSuSE, and I have shared the folders, it shows shared in Konquerer, and the group Users has RW permission.

I can't think of anything else I've failed to mention, but I can provide any other information that is requested.

Any help is greatly appreciated.

billymayday · 01-10-2009, 04:47 PM

David,

are you trying to connect to homes? If so, humour me and try

Code:

[homes]
        comment = Home Directories
        path = /home/%u/
        browseable = no
        writable = yes
        create mode = 644
        directory mode =755

Are you trying to run domains? If not, for now I'd comment out

Code:

        logon path = \\%L\profiles\.msprofile
        logon home = \\%L\%U\.9xprofile
        logon drive = P:
        usershare allow guests = No
        winbind gid = 10000-20000
        winbind uid = 10000-20000
        usershare max shares = 100
        add machine script = /usr/sbin/useradd  -c Machine -d /var/lib/nobody -s /bin/false %m$

To rule out selinux use "sudo setenforce 0" to turn it off, try to connect and turn it back on with "sudo setenforce 1". At least I assume ubuntu uses setenforce.

billymayday · 01-10-2009, 04:59 PM

Also make sure you have something like

Code:

log file = /var/log/samba/%m.log

That should make your life easier

DarkFlame · 01-10-2009, 07:55 PM

Quote:

Originally Posted by billymayday

David,

are you trying to connect to homes? If so, humour me and try

Code:

[homes]
        comment = Home Directories
        path = /home/%u/
        browseable = no
        writable = yes
        create mode = 644
        directory mode =755

Bill, I wasn't consciously trying to connect to homes, but the section is there (OpenSuSE - the one I'm working on now - trying to re-install it, but I'll try the same thing on my Ubuntu HDD, too) So, I've added the above code to the homes section. It now looks like this:

Code:

[homes]
        comment = Home Directories
        path = /home/%u
        valid users = %S, %D%w%S
        browseable = No
        writable = Yes
        read only = No
        inherit acls = Yes
        create mode = 644
        directory mode = 755

Quote:

Originally Posted by billymayday

Are you trying to run domains? If not, for now I'd comment out

Code:

        logon path = \\%L\profiles\.msprofile
        logon home = \\%L\%U\.9xprofile
        logon drive = P:
        usershare allow guests = No
        winbind gid = 10000-20000
        winbind uid = 10000-20000
        usershare max shares = 100
        add machine script = /usr/sbin/useradd  -c Machine -d /var/lib/nobody -s /bin/false %m$

I've now commented out those lines. The section now looks like this:

Code:

[global]
        workgroup = RCH-WORKGROUP
        printing = cups
        printcap name = cups
        printcap cache time = 750
        cups options = raw
        map to guest = Bad User
        include = /etc/samba/dhcp.conf
#       logon path = \\%L\profiles\.msprofile
#       logon home = \\%L\%U\.9xprofile
#       logon drive = P:
#       usershare allow guests = No
#       winbind gid = 10000-20000
#       winbind uid = 10000-20000
        security = user
#       usershare max shares = 100
#       add machine script = /usr/sbin/useradd  -c Machine -d /var/lib/nobody -s /bin/false %m$
        domain logons = No
        domain master = No
        log file = /var/log/samba/%m.log

Quote:

Originally Posted by billymayday

Also make sure you have something like

Code:

log file = /var/log/samba/%m.log

That should make your life easier

I have added it to the [global] section. See the last line in the code above.

Quote:

Originally Posted by billymayday

To rule out selinux use "sudo setenforce 0" to turn it off, try to connect and turn it back on with "sudo setenforce 1". At least I assume ubuntu uses setenforce.

I'm going to try the changes above first, then I'll attempt the setinforce command. I want to see if the code changes make the difference, or if it's the setinforce. We're going to try to get the kids into bed, first, so it will take me a little while - an hour at most, I hope.

DarkFlame · 01-10-2009, 08:00 PM

Bill,

I also did testparm, & here's the output from that (bold/red emphasis is mine):

Code:

RCH-SERVER:/etc/samba # testparm smb.conf
Load smb config files from smb.conf
Processing section "[homes]"
Processing section "[profiles]"
Global parameter guest account found in service section!
Processing section "[users]"
Processing section "[groups]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[DATA]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

I don't guess that's a fatal error? I couldn't find a "service" section. However, in the [profiles] section there is a reference to the guest account:

Code:

[profiles]
        comment = Network Profiles Service
        path = /NW-DATA/
        read only = No
        store dos attributes = Yes
        create mask = 0660
        directory mask = 0770
        valid users = david,april
        admin users = david,april
        guest account = admiral
        guest ok = yes

Can that kill the ability to access the files from the XP boxes?

billymayday · 01-10-2009, 08:04 PM

Try setenforce first - it will take 30 seconds literally

Lose the valid users in homes (at least for now)

Samba has General and Services (ie shares, printers, etc). You'll see in man smb.conf that they put (G) or (S) next to parameters so you know what they apply to (although some work in both but they don't label these (GS).

Good luck with the kids.

DarkFlame · 01-10-2009, 08:25 PM

Nope, the code changes made no difference (OpenSuSE). I can't get into anything.

The setenforce is an invalid command in OpenSuSE. I did try

Code:

set enforce 0

& it made no difference.

I'm going to disconnect the OpenSuSE HDD, connect the Ubuntu HDD, reboot the server, and try the changes there, too. I'll give an update asap - the kids are all in bed, it wasn't as much of an ordeal tonight as I had expected.

DarkFlame · 01-10-2009, 08:44 PM

Now working in Ubuntu.

Check this out!

Code:

root@RCH-SERVER:/home/admiral# setenforce 0
The program 'setenforce' is currently not installed.  You can install it by typing:
apt-get install selinux-utils
bash: setenforce: command not found
root@RCH-SERVER:/home/admiral#

Does that mean Ubuntu HAS SELinux, or not? When I tried it in OpenSuSE, it just gave me an error message that the command was not found. Should I install it & try it again? (note, this is not my last build. I'm going to keep building until I can do it by myself and easily. Once I get it working (again), I'm going to make sure not to destroy the smb.conf file. Silly me! astid.)

Ok, I'm going to make the code changes now & will update you when I've done them.

DarkFlame · 01-10-2009, 08:54 PM

Here's Ubuntu's smb.conf:

Code:

[global]
        workgroup = RCH-WORKGROUP
        server string = %h server (File & Print Server)
        map to guest = Bad User
;       obey pam restrictions = Yes
;       passdb backend = tdbsam
;       pam password change = Yes
;       passwd program = /usr/bin/passwd %u
;       passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        username map = /etc/samba/smbusers
        unix password sync = Yes
        syslog = 0
        log file = /var/log/samba/log.%m
        max log size = 1000
        dns proxy = No
        usershare allow guests = Yes
        usershare owner only = No
        panic action = /usr/share/samba/panic-action %d
        encrypt passwords = yes
        security = user

[homes]
        comment = Home Directories
        read only = No

[printers]
        comment = All Printers
        path = /var/spool/samba
        create mask = 0700
        printable = Yes
        browseable = No

[print$]
        comment = Printer Drivers
        path = /var/lib/samba/printers

[DATA]
        comment = Network Data Drive
        path = /NW-DATA/DATA
        valid users = david,april
        read only = No
        browsable = yes
        writeable = yes
        create mask = 0664
        force create mode = 0660
        directory mask = 0775
        force directory mode = 0770

None of the domain stuff was there, so I couldn't comment it out. But there were a few things that got me thinking ... The username map & the unix password sync. I guess I could comment them out to see (I'll try that after doing another server reboot.

And, I added the missing text in the [homes] section.

The logfile command was already there.

DarkFlame · 01-10-2009, 08:57 PM

I had to comment out "unix password sync" because testparm returned:

ERROR: the 'unix password sync' parameter is set and there is no valid 'passwd program' parameter.

I'm rebooting the U Server now.

DarkFlame · 01-10-2009, 09:12 PM

The latest "error" from /var/log/samba/log.rch-david

Code:

[2009/01/10 21:02:06,  0] smbd/service.c:make_connection(1366)
  rch-david (192.168.2.81) couldn't find service ::{2227a280-3aea-1069-a2de-08002b30309d}

The latest entry from /var/log/samba/log.smbd

Code:

[2009/01/10 20:59:28,  0] smbd/server.c:main(1213)
  smbd version 3.2.3 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2008

The bottom one doesn't raise any red flags to me (not that I'd see one if it was draped across my face!). But, the top one seems to think that there's some kind of missing service. I think this may be the "smoking gun" for which I'm looking. I think I need to figure out how to determine what services are needed, and what services are running.

DarkFlame · 01-10-2009, 09:19 PM

Here's my services status:

Code:

root@RCH-SERVER:/var/log/samba# service --status-all
apparmor module is loaded.
2 profiles are loaded.
2 profiles are in enforce mode.
   /usr/sbin/cupsd
   /usr/lib/cups/backend/cups-pdf
0 profiles are in complain mode.
1 processes have profiles defined.
1 processes are in enforce mode :
   /usr/sbin/cupsd (4605)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
 * atd is running.
Avahi mDNS/DNS-SD Daemon is running
Usage: bootmisc.sh [start|stop]
Usage: checkfs.sh [start|stop]
Usage: checkroot.sh [start|stop]
Usage: /etc/init.d/citadel {start|stop|restart|force-reload}
Usage: /etc/init.d/console-setup {start|reload|restart|force-reload|stop}
 * cron is running.
Status of Common Unix Printing System: cupsd is running.
 * dbus is running.
Usage: hostname.sh [start|stop]
 * Usage: hwclock.sh {start|stop|reload|force-reload|show}
 *        start sets kernel (system) clock from hardware (RTC) clock
 *        stop and reload set hardware (RTC) clock from kernel (system) clock
 * Usage: hwclock.sh {start|stop|reload|force-reload|show}
 *        start sets kernel (system) clock from hardware (RTC) clock
 *        stop and reload set hardware (RTC) clock from kernel (system) clock
Usage: /etc/init.d/keyboard-setup {start|reload|restart|force-reload|stop}
Usage: /etc/init.d/killprocs start|stop
 * klogd is running.
Usage: /etc/init.d/loopback {start|stop|restart|force-reload}
Usage: /etc/init.d/mdadm {start|stop|restart|reload|force-reload}
 * Loading kernel modules... 
 * Loading manual drivers... 
Usage: mountall-bootclean.sh [start|stop]
Usage: mountall.sh [start|stop]
Usage: mountdevsubfs [start|stop]
Usage: mountkernfs [start|stop]
Usage: mountnfs-bootclean.sh [start|stop]
Usage: /etc/init.d/mountnfs.sh start|stop
Usage: mountoverflowtmp [start|stop]
Usage: mountall-mtab.sh [start|stop]
Usage: /etc/init.d/networking {start|stop|restart|force-reload}
Usage: /etc/init.d/procps {start|stop|restart|force-reload}
Usage: /etc/init.d/rc.local start|stop
Usage: /etc/init.d/rmnologin start|stop
 * rsync is not running.
 * nmbd is running.
 * smbd is running.
Usage: /etc/init.d/sendsigs start|stop
 * sshd is running.
 * syslogd is running.
Usage: /etc/init.d/udev {start|stop|restart|reload|force-reload}
Usage: /etc/init.d/udev {start|stop|restart|reload|force-reload}
 * Firewall is not runningUsage: /etc/init.d/umountfs start|stop
Usage: umountnfs.sh [start|stop]
Usage: /etc/init.d/umountroot start|stop
Usage: urandom start|stop
Usage: /etc/init.d/wpa-ifupdown {start|stop|restart|force-reload}
root@RCH-SERVER:/var/log/samba#

DarkFlame · 01-10-2009, 09:21 PM

Now I've just found something strange. The system didn't mount my RAID5 array (where the DATA resides). Let me get that mounted & see what I can find from there. When I tried to go to it in Windows Explorer, it just gave me an error saying "the network path was not found" - little wonder on that one!

DarkFlame · 01-10-2009, 09:28 PM

Ok, my instructions say to do this:

Code:

#  re-name or delete the /etc/mdadm/mdadm.conf file
sudo rm mdadm.conf
#  remove mdadm
sudo apt-get remove mdadm
#  re-boot
sudo shutdown -h now
#  re-install mdadm 
sudo apt-get install mdadm

#mount the array by running this:
sudo mdadm --assemble --scan
#should result in the following response: 
/dev/md/0 has been started with 4 drives.

#Now, make the directory where the mounted array data can be found:
mkdir /NW-DATA

#Now, mount the data:
mount -t ext3 /dev/md/0 /NW-DATA

#& I should then be able to see the folder in PuTTY.

So, I'm going down that path. Strange!

DarkFlame · 01-10-2009, 09:33 PM

Ok, I'm back up with the data. What a mess! Let me see if I have access...