0

When trying to setup a Samba share on Fedora 29, I found that it was inaccessible over the network. Upon further inspection, I also found that it was inaccessible from the local machine as well.

I've been working on this for a couple of hours and cannot find the source of the problem.

My smb.conf (identical between the two machines):

[global]
    workgroup = WORKGROUP
    server string = Samba server (%v) on %h
    hosts allow = 127. 10.0.1.
    ntlm auth = yes

    log file = /var/log/samba/log.%m
    max log size = 50

    security = user
    passdb backend = tdbsam

    load printers = yes
    cups options = raw

[mattd]
    path = /home/mattd
    comment = Share
    writable = yes
    valid users = mattd

Samba service is active and running:

smb.service - Samba SMB Daemon
   Loaded: loaded (/usr/lib/systemd/system/smb.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2019-01-31 04:57:12 EST; 3min 36s ago
     Docs: man:smbd(8)
           man:samba(7)
           man:smb.conf(5)
 Main PID: 26861 (smbd)
   Status: "smbd: ready to serve connections..."
    Tasks: 4 (limit: 4915)
   Memory: 9.0M
   CGroup: /system.slice/smb.service
           ├─26861 /usr/sbin/smbd --foreground --no-process-group
           ├─26863 /usr/sbin/smbd --foreground --no-process-group
           ├─26864 /usr/sbin/smbd --foreground --no-process-group
           └─26865 /usr/sbin/smbd --foreground --no-process-group

Jan 31 04:57:12 minedlands systemd[1]: Starting Samba SMB Daemon...
Jan 31 04:57:12 minedlands systemd[1]: Started Samba SMB Daemon.
Jan 31 04:57:12 minedlands smbd[26861]: [2019/01/31 04:57:12.514592,  0] ../lib/util/become_daemon.c:138(daemon_ready)
Jan 31 04:57:12 minedlands smbd[26861]:   daemon_ready: STATUS=daemon 'smbd' finished starting up and ready to serve connections

The user mattd (my account) is working and I can log in fine over SSH.

I created a Samba account for this user:

$ smbpasswd -a mattd

The Samba account is enabled:

$ smbpasswd -e mattd

And can confirm that this Samba account exists:

$ pdbedit -L
mattd:1000:Matt D.

I have set the SELinux option to allow access to shares that are home directories:

$ setsebool -P samba_enable_home_dirs 1

However, SELinux has been disabled with setenforce 0 for testing.

Samba is accessible through the firewall:

$ firewall-cmd --zone=public --permanent --add-service=samba
$ firewall-cmd --reload

When I try to access the Samba share locally (I am connected over SSH), I can make a connection to the Samba service which asks me to authenticate:

$ smbclient //localhost/mattd --user mattd
Enter WORKGROUP\mattd's password:

But I am greeted with an access denied error:

session setup failed: NT_STATUS_ACCESS_DENIED

In summary:

  • This is my account.
  • I have permission to my own home directory (the share).
  • I have created the necessary Samba account in addition to my user account.
  • I am connecting via localhost and achieve communication with the Samba service.
  • The error message suggests a problem with authentication.
  • SELinux is not a factor.
  • Firewall is not a factor.
  • My smb.conf is identical to a working system.
  • I have restarted the Samba service.

Samba versions:

  • CentOS 7 is running Samba 4.8.3.
  • Fedora 29 is running Samba 4.9.4.

I can connect to the CentOS machine from the Fedora machine using smbclient so connections are possible.

I feel like I've covered all of the bases here but it just won't work. Although the title suggests that the configuration between these two machines is identical, either they are not the same or there is something between the two distributions that requires attention.

  • Anything in /var/log/messages, /var/log/secure/, /var/log/samba/*? – Janne Pikkarainen Jan 31 at 11:08
  • @JannePikkarainen There is not. – Zhro Jan 31 at 11:52
  • The fedora computer is joined to domain? Is it working if you use IP address instead hostname? – AtomiX84 Jan 31 at 14:16
  • It's part of a local workgroup and is not part of a domain. I don't think this should matter when connecting over localhost. And yes, there is no change when attempting to connect over 127.0.0.1. I can make a connection just fine; it's the authentication that is failing. – Zhro Jan 31 at 16:57
-1

Add to smb.conf

client lanman auth = yes
  • Client authorization is done with NTLMv2 as configured by default on both servers. LanMan a very old form of authentication that is not secure and is only relevant for DOS and Win9x clients. However, I did to test this anyways and I received the same NT_STATUS_ACCESS_DENIED. – Zhro Jan 31 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.