1

I have ran into an issue with SAMBA during a recent server build. Below is a configuration I have used many times without issues.

Samba Configuration - (Anonymous is commented out but works fine when enabled)

    [global]
    workgroup = SAMBA
    security = user
    map to guest = Bad User
    passdb backend = tdbsam

    printing = cups
    printcap name = cups
    load printers = yes
    cups options = raw

    log file = /var/log/samba/%m
    log level = 1

    #[Anonymous]
    #comment = Anonymous File Server Share
    #path = /tmp
    #browsable =yes
    #writable = yes
    #guest ok = yes
    #read only = no

    [hes]
    comment = stuff
    path = /u01/app2
    valid users = hesowner, oracle
    writable = yes
    browsable = yes
    printable = no
    invalid users = None

Testing shares local with smbclient works just fine.

    [root@test1 ~]# smbclient -U hesowner //test1/hes
    Enter SAMBA\hesowner's password:
    Domain=[TEST1] OS=[Windows 6.1] Server=[Samba 4.6.2]
    smb: \> ls
    .                                   D        0  Tue Aug 29 14:39:32 2017
    ..                                  D        0  Tue Aug 29 14:33:15 2017
    reports                             D        0  Tue Aug 29 14:33:15 2017
    forms                               D        0  Tue Aug 29 14:33:53 2017
    eis_ws_approvals                    D        0  Tue Aug 29 14:45:20 2017

            52403200 blocks of size 1024. 36431144 blocks available
    smb: \>

So the problem is in Windows10 Pro when trying to access the share via \\test1\hes I just get a prompt for user/pass repeatedly and cannot access the share.

Here is the logs...

   [2017/09/07 11:54:20.051608,  2] ../source3/smbd/service.c:319(create_connection_session_info)
   guest user (from session setup) not permitted to access this share (hes)
   [2017/09/07 11:54:20.051670,  1] ../source3/smbd/service.c:502(make_connection_snum)
     create_connection_session_info failed: NT_STATUS_ACCESS_DENIED
    [2017/09/07 11:54:20.125206,  2] ../source3/smbd/service.c:319(create_connection_session_info)
     guest user (from session setup) not permitted to access this share (hes)
    [2017/09/07 11:54:20.125265,  1] ../source3/smbd/service.c:502(make_connection_snum)
     create_connection_session_info failed: NT_STATUS_ACCESS_DENIED
    [2017/09/07 11:54:20.161800,  2] ../source3/smbd/service.c:319(create_connection_session_info)
     guest user (from session setup) not permitted to access this share (hes)
    [2017/09/07 11:54:20.161824,  1] ../source3/smbd/service.c:502(make_connection_snum)
      create_connection_session_info failed: NT_STATUS_ACCESS_DENIED
    [2017/09/07 11:54:20.237828,  2] ../source3/smbd/service.c:319(create_connection_session_info)
     guest user (from session setup) not permitted to access this share (hes)
    [2017/09/07 11:54:20.237851,  1] ../source3/smbd/service.c:502(make_connection_snum)
     create_connection_session_info failed: NT_STATUS_ACCESS_DENIED

I see it is mentioning "guest user" which is odd. Nothing works when removing "map to guest = Bad User"

I'm at a complete loss...

Thanks for the help.

1

2 Answers 2

1

if anyone else runs into this problem, my solution was to adjust the security policies on the Windows client.

Run > Secpol.msc

then I set Local Policies > Security Options > Network Security: LAN Manager authentication level to 'Send NTLMv2 response only. Refuse LM & NTLM'

Otherwise you can edit SAMABA instead.

Add the below line to the global section of the smb.conf file.

ntlm auth = yes

Did not resolve myself. Found the solution here.

1

I wouldn't recommend enabling legacy protocols, like NTLM. This works in a Win7 environment (which supports SMB2.10 only) on Ubuntu 14/samba-4.3.11 Active Directory. It also sets a "natural" barrier to the lower Windows versions being able to connect to any share.

$ grep -E "m[ai][xn] protocol" /etc/samba/smb.conf
        client ipc max protocol = SMB3
        client ipc min protocol = SMB2_10
        client max protocol = SMB3
        client min protocol = SMB2_10
        server max protocol = SMB3
        server min protocol = SMB2_10

A configuration optimization and consolidation could be make, for sure - ensure you've enabled the highest possible SMB version support:

$ testparm -l --show-all-parameters | grep -E "m[ai][xn] protocol|smb encrypt"
smb encrypt=P_ENUM,default|No|False|0|Off|disabled|if_required|Yes|True|1|On|enabled|auto|desired|required|mandatory|force|forced|enforced,
server max protocol=P_ENUM,default|SMB2|SMB3|SMB3_11|SMB3_10|SMB3_02|SMB3_00|SMB2_24|SMB2_22|SMB2_10|SMB2_02|NT1|LANMAN2|LANMAN1|CORE|COREPLUS|CORE+,
max protocol=P_ENUM,default|SMB2|SMB3|SMB3_11|SMB3_10|SMB3_02|SMB3_00|SMB2_24|SMB2_22|SMB2_10|SMB2_02|NT1|LANMAN2|LANMAN1|CORE|COREPLUS|CORE+,
server min protocol=P_ENUM,default|SMB2|SMB3|SMB3_11|SMB3_10|SMB3_02|SMB3_00|SMB2_24|SMB2_22|SMB2_10|SMB2_02|NT1|LANMAN2|LANMAN1|CORE|COREPLUS|CORE+,
min protocol=P_ENUM,default|SMB2|SMB3|SMB3_11|SMB3_10|SMB3_02|SMB3_00|SMB2_24|SMB2_22|SMB2_10|SMB2_02|NT1|LANMAN2|LANMAN1|CORE|COREPLUS|CORE+,
client max protocol=P_ENUM,default|SMB2|SMB3|SMB3_11|SMB3_10|SMB3_02|SMB3_00|SMB2_24|SMB2_22|SMB2_10|SMB2_02|NT1|LANMAN2|LANMAN1|CORE|COREPLUS|CORE+,
client min protocol=P_ENUM,default|SMB2|SMB3|SMB3_11|SMB3_10|SMB3_02|SMB3_00|SMB2_24|SMB2_22|SMB2_10|SMB2_02|NT1|LANMAN2|LANMAN1|CORE|COREPLUS|CORE+,
client ipc max protocol=P_ENUM,default|SMB2|SMB3|SMB3_11|SMB3_10|SMB3_02|SMB3_00|SMB2_24|SMB2_22|SMB2_10|SMB2_02|NT1|LANMAN2|LANMAN1|CORE|COREPLUS|CORE+,
client ipc min protocol=P_ENUM,default|SMB2|SMB3|SMB3_11|SMB3_10|SMB3_02|SMB3_00|SMB2_24|SMB2_22|SMB2_10|SMB2_02|NT1|LANMAN2|LANMAN1|CORE|COREPLUS|CORE+,

Some related output from the production environment:

$smbstatus | grep -E "SMB|NTLM|^PID|\-\-{1,}"
PID       Username         Group              Machine            Protocol Version
------------------------------------------------------------------------------
11724     AD-User-ID       User-Group         X.X.X.X (ipvX:X.X.X.X:51177) SMB2_10
4834      AD-User-ID       User-Group         X.X.X.X (ipvX:X.X.X.X:54652) SMB2_10
1512      AD-User-ID       User-Group         X.X.X.X (ipvX:X.X.X.X:50496) SMB2_10
21140     AD-User-ID       User-Group         X.X.X.X (ipvX:X.X.X.X:62753) SMB2_10
26057     AD-User-ID       User-Group         X.X.X.X (ipvX:X.X.X.X:54410) SMB2_10
1513      AD-User-ID       User-Group         X.X.X.X (ipvX:X.X.X.X:50498) SMB2_10
11351     AD-User-ID       User-Group         X.X.X.X (ipvX:X.X.X.X:51152) SMB2_10
11464     AD-User-ID       User-Group         X.X.X.X (ipvX:X.X.X.X:65059) SMB2_10
5056      AD-User-ID       User-Group         X.X.X.X (ipvX:X.X.X.X:54671) SMB2_10
1511      AD-User-ID       User-Group         X.X.X.X (ipvX:X.X.X.X:50494) SMB2_10

...and the lab one Centos7/samba-4.4.4 Active Directlry. You should be able to use encryption with your version of SAMBA and Win10, make sure the parameter smb encrypt is configured appropriately for mixed SMB2/3 environment.

PID     Username     Group        Machine                                   Protocol Version  Encryption           Signing
----------------------------------------------------------------------------------------------------------------------------------------
10884   AD-User-ID      User-Group        X.X.X.X (ipvX:X.X.X.X:4867)       SMB2_10           -                    HMAC-SHA256

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .