samba - Mar 2015 - Windows XP sees fedora14/samba3 shares but not fedora20/samba4 shares

Hello,

A windows XP machine 'X' (the only one left in the LAN) sees all
fedora14/samba3 shares on f14 machine 'A' but cannot see fedora20/samba4
shares on machines 'B' or 'C'.

'X' can ping all of the others by name, and all of the others
'A', 'B'
and 'C' CAN see ALL of the other shares INCLUDING on the XP machine
'X'.

Machine 'X' sees the computers 'A' 'B' 'C' but
when 'B' or 'C' are
clicked, 'X' tries to log in and asks for a password INSTEAD OF SHOWING
THE SHARES.  When 'A' is clicked, 'X' shows the shares.

All WORKGROUP'S are the same. All share permissions are 775.

So, why can't 'X' see the f20/samba4 shares?

Is there some change in f20/samba4 smb.conf that I need to make that
system-config-samba doesn't know about?

Please suggest things to look at, both on the f20/samba4 side and on the
XP side.

Many thanks.

	-Al

Hi,
isn't it possible, that your new Samba4 server uses higher SMB protocol, 
than the old MS windows XP machine can understand/handle?

Not sure about this, but might be worth checking?

cheers :]

-- 
*Karel Lang*
*Unix/Linux Administration*
lang at afd.cz | +420 731 13 40 40
AUFEER DESIGN, s.r.o. | www.aufeerdesign.cz


On 03/06/2015 02:42 AM, Al Schapira wrote:
> Hello,
>
> A windows XP machine 'X' (the only one left in the LAN) sees all
> fedora14/samba3 shares on f14 machine 'A' but cannot see
fedora20/samba4
> shares on machines 'B' or 'C'.
>
> 'X' can ping all of the others by name, and all of the others
'A', 'B'
> and 'C' CAN see ALL of the other shares INCLUDING on the XP machine
'X'.
>
> Machine 'X' sees the computers 'A' 'B' 'C'
but when 'B' or 'C' are
> clicked, 'X' tries to log in and asks for a password INSTEAD OF
SHOWING
> THE SHARES.  When 'A' is clicked, 'X' shows the shares.
>
> All WORKGROUP'S are the same. All share permissions are 775.
>
> So, why can't 'X' see the f20/samba4 shares?
>
> Is there some change in f20/samba4 smb.conf that I need to make that
> system-config-samba doesn't know about?
>
> Please suggest things to look at, both on the f20/samba4 side and on the
> XP side.
>
> Many thanks.
>
> 	-Al
>
>
>
>
>
>

Hello Al,

Am 06.03.2015 um 02:42 schrieb Al Schapira:
> A windows XP machine 'X' (the only one left in the LAN) sees all
> fedora14/samba3 shares on f14 machine 'A' but cannot see
fedora20/samba4
> shares on machines 'B' or 'C'.
> 
> 'X' can ping all of the others by name, and all of the others
'A', 'B'
> and 'C' CAN see ALL of the other shares INCLUDING on the XP machine
'X'.
> 
> Machine 'X' sees the computers 'A' 'B' 'C'
but when 'B' or 'C' are
> clicked, 'X' tries to log in and asks for a password INSTEAD OF
SHOWING
> THE SHARES.  When 'A' is clicked, 'X' shows the shares.
> 
> All WORKGROUP'S are the same. All share permissions are 775.
> 
> So, why can't 'X' see the f20/samba4 shares?
> 
> Is there some change in f20/samba4 smb.conf that I need to make that
> system-config-samba doesn't know about?
> 
> Please suggest things to look at, both on the f20/samba4 side and on the
> XP side.

Sorry. But your A, B, C, X, whaterver makes reading your post more
confusing than it helps, to explain what problem you're having. :-)

You'r problem is, that you can't access a share from XP, but you can
from different OS, right? (if not, retry to explain in simple words,
without A, B,... :-))

Please provide some information:
- show your smb.conf of the host, you can't access
- what is shown in the logs, if you try to access the share
- can you access the share via \\ip\sharename?


Regards,
Marc

Am 06.03.2015 um 06:40 schrieb Karel Lang AFD:
> isn't it possible, that your new Samba4 server uses higher SMB
protocol,
> than the old MS windows XP machine can understand/handle?
> 
> Not sure about this, but might be worth checking?
Not if he uses the defaults. The default is even in 4.2:
server min protocol = LANMAN1
(not to be confused with 'server max protocol'!)

But you're right. It's worth checking, because we don't know his
smb.conf.


Regards,
Marc

Marc, et al,

Thanks for your reply.  Sorry, I didn't mean to be confusing.

Summary of problem:
  1) XP sees samba shares on fedora14/samba3 machine, but not on
fedora20/samba4 machines.
  2) all fedora machines see all shares including on XP machine.
  3) clicking on f20 machine from XP tries to log in rather than showing
the shares. Login is not successful.
  4) all machines can ping each other by name.

Attached files:
  my-f14-smb.conf (comments stripped off)
  my-f20-smb.conf (comments stripped off)   <--- XP cannot see shares
  default-f20-smb.conf

  f20-samba-logs (log.nmbd, smbd, lap3 on f20 machine
  f14-samba-logs   --"-- on f14 machine

Hope this is clearer.
Thanks.

	-Al

On Fri, 2015-03-06 at 18:11 +0100, Marc Muehlfeld wrote:
> Hello Al,
> 
> Am 06.03.2015 um 02:42 schrieb Al Schapira:
> > A windows XP machine 'X' (the only one left in the LAN) sees
all
> > fedora14/samba3 shares on f14 machine 'A' but cannot see
fedora20/samba4
> > shares on machines 'B' or 'C'.
> > 
> > 'X' can ping all of the others by name, and all of the others
'A', 'B'
> > and 'C' CAN see ALL of the other shares INCLUDING on the XP
machine 'X'.
> > 
> > Machine 'X' sees the computers 'A' 'B'
'C' but when 'B' or 'C' are
> > clicked, 'X' tries to log in and asks for a password INSTEAD
OF SHOWING
> > THE SHARES.  When 'A' is clicked, 'X' shows the
shares.
> > 
> > All WORKGROUP'S are the same. All share permissions are 775.
> > 
> > So, why can't 'X' see the f20/samba4 shares?
> > 
> > Is there some change in f20/samba4 smb.conf that I need to make that
> > system-config-samba doesn't know about?
> > 
> > Please suggest things to look at, both on the f20/samba4 side and on
the
> > XP side.
> 
> 
> Sorry. But your A, B, C, X, whaterver makes reading your post more
> confusing than it helps, to explain what problem you're having. :-)
> 
> You'r problem is, that you can't access a share from XP, but you
can
> from different OS, right? (if not, retry to explain in simple words,
> without A, B,... :-))
> 
> Please provide some information:
> - show your smb.conf of the host, you can't access
> - what is shown in the logs, if you try to access the share
> - can you access the share via \\ip\sharename?
> 
> 
> Regards,
> Marc
> 
-------------- next part --------------
[global]
	workgroup = GAMMA5
	server string = Samba Server Version %v
	log file = /var/log/samba/log.%m
	max log size = 50
	security = share
	cups options = raw
[homes]
	comment = Home Directories
	browseable = no
	writable = yes
[printers]
	comment = All Printers
	path = /var/spool/samba
	browseable = no
	printable = yes
[ADS1-SHARE]
	path = /home/ads/ADS1-SHARE
	read only = no
	guest ok = yes
[ADS1-LAP3]
	comment = ADS1-LAP3
	path = /other/LAP3
	read only = no
	guest ok = yes
-------------- next part --------------
[global]
	workgroup = GAMMA5
	server string = Samba Server Version %v
	log file = /var/log/samba/log.%m
	max log size = 50
	security = user
	cups options = raw
[homes]
	comment = Home Directories
	browseable = no
	writable = yes
[printers]
	comment = All Printers
	path = /var/spool/samba
	browseable = no
	printable = yes
[ADS2-SHARE]
	path = /home/ads/ADS2-SHARE
	read only = no
	guest ok = yes
[ADS2-BACKUPS]
	path = /other/LAP3/BACKUPS
	read only = no
	guest ok = yes
-------------- next part --------------
# This is the main Samba configuration file. For detailed information about the
# options listed here, refer to the smb.conf(5) manual page. Samba has a huge
# number of configurable options, most of which are not shown in this example.
#
# The Official Samba 3.2.x HOWTO and Reference Guide contains step-by-step
# guides for installing, configuring, and using Samba:
# http://www.samba.org/samba/docs/Samba-HOWTO-Collection.pdf
#
# The Samba-3 by Example guide has working examples for smb.conf. This guide is
# generated daily: http://www.samba.org/samba/docs/Samba-Guide.pdf
#
# In this file, lines starting with a semicolon (;) or a hash (#) are
# comments and are ignored. This file uses hashes to denote commentary and
# semicolons for parts of the file you may wish to configure.
#
# Note: Run the "testparm" command after modifying this file to check
for basic
# syntax errors.
#
#---------------
# Security-Enhanced Linux (SELinux) Notes:
#
# Turn the samba_domain_controller Boolean on to allow Samba to use the useradd
# and groupadd family of binaries. Run the following command as the root user to
# turn this Boolean on:
# setsebool -P samba_domain_controller on
#
# Turn the samba_enable_home_dirs Boolean on if you want to share home
# directories via Samba. Run the following command as the root user to turn this
# Boolean on:
# setsebool -P samba_enable_home_dirs on
#
# If you create a new directory, such as a new top-level directory, label it
# with samba_share_t so that SELinux allows Samba to read and write to it. Do
# not label system directories, such as /etc/ and /home/, with samba_share_t, as
# such directories should already have an SELinux label.
#
# Run the "ls -ldZ /path/to/directory" command to view the current
SELinux
# label for a given directory.
#
# Set SELinux labels only on files and directories you have created. Use the
# chcon command to temporarily change a label:
# chcon -t samba_share_t /path/to/directory
#
# Changes made via chcon are lost when the file system is relabeled or commands
# such as restorecon are run.
#
# Use the samba_export_all_ro or samba_export_all_rw Boolean to share system
# directories. To share such directories and only allow read-only permissions:
# setsebool -P samba_export_all_ro on
# To share such directories and allow read and write permissions:
# setsebool -P samba_export_all_rw on
#
# To run scripts (preexec/root prexec/print command/...), copy them to the
# /var/lib/samba/scripts/ directory so that SELinux will allow smbd to run them.
# Note that if you move the scripts to /var/lib/samba/scripts/, they retain
# their existing SELinux labels, which may be labels that SELinux does not allow
# smbd to run. Copying the scripts will result in the correct SELinux labels.
# Run the "restorecon -R -v /var/lib/samba/scripts" command as the
root user to
# apply the correct SELinux labels to these files.
#
#--------------
#
#======================= Global Settings ====================================
[global]

# ----------------------- Network-Related Options -------------------------
#
# workgroup = the Windows NT domain name or workgroup name, for example,
MYGROUP.
#
# server string = the equivalent of the Windows NT Description field.
#
# netbios name = used to specify a server name that is not tied to the hostname.
#
# interfaces = used to configure Samba to listen on multiple network interfaces.
# If you have multiple interfaces, you can use the "interfaces ="
option to
# configure which of those interfaces Samba listens on. Never omit the localhost
# interface (lo).
#
# hosts allow = the hosts allowed to connect. This option can also be used on a
# per-share basis.
#
# hosts deny = the hosts not allowed to connect. This option can also be used on
# a per-share basis.
#
# max protocol = used to define the supported protocol. The default is NT1. You
# can set it to SMB2 if you want experimental SMB2 support.
#
	workgroup = GAMMA5
	server string = Samba Server Version %v

;	netbios name = MYSERVER

;	interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24
;	hosts allow = 127. 192.168.12. 192.168.13.

;	max protocol = SMB2
# --------------------------- Logging Options -----------------------------
#
# log file = specify where log files are written to and how they are split.
#
# max log size = specify the maximum size log files are allowed to reach. Log
# files are rotated when they reach the size specified with "max log
size".
#

	# log files split per-machine:
	log file = /var/log/samba/log.%m
	# maximum size of 50KB per log file, then rotate:
	max log size = 50

# ----------------------- Standalone Server Options ------------------------
#
# security = the mode Samba runs in. This can be set to user, share
# (deprecated), or server (deprecated).
#
# passdb backend = the backend used to store user information in. New
# installations should use either tdbsam or ldapsam. No additional configuration
# is required for tdbsam. The "smbpasswd" utility is available for
backwards
# compatibility.
#

	security = user
;	passdb backend = tdbsam


# ----------------------- Domain Members Options ------------------------
#
# security = must be set to domain or ads.
#
# passdb backend = the backend used to store user information in. New
# installations should use either tdbsam or ldapsam. No additional configuration
# is required for tdbsam. The "smbpasswd" utility is available for
backwards
# compatibility.
#
# realm = only use the realm option when the "security = ads" option
is set.
# The realm option specifies the Active Directory realm the host is a part of.
#
# password server = only use this option when the "security = server"
# option is set, or if you cannot use DNS to locate a Domain Controller. The
# argument list can include My_PDC_Name, [My_BDC_Name], and [My_Next_BDC_Name]:
#
# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
#
# Use "password server = *" to automatically locate Domain
Controllers.

;	realm = MY_REALM

;	password server = <NT-Server-Name>

# ----------------------- Domain Controller Options ------------------------
#
# security = must be set to user for domain controllers.
#
# passdb backend = the backend used to store user information in. New
# installations should use either tdbsam or ldapsam. No additional configuration
# is required for tdbsam. The "smbpasswd" utility is available for
backwards
# compatibility.
#
# domain master = specifies Samba to be the Domain Master Browser, allowing
# Samba to collate browse lists between subnets. Do not use the "domain
master"
# option if you already have a Windows NT domain controller performing this
task.
#
# domain logons = allows Samba to provide a network logon service for Windows
# workstations.
#
# logon script = specifies a script to run at login time on the client. These
# scripts must be provided in a share named NETLOGON.
#
# logon path = specifies (with a UNC path) where user profiles are stored.
#
#

;	domain master = yes
;	domain logons = yes

	# the following login script name is determined by the machine name
	# (%m):
;	logon script = %m.bat
	# the following login script name is determined by the UNIX user used:
;	logon script = %u.bat
;	logon path = \\%L\Profiles\%u
	# use an empty path to disable profile support:
;	logon path 
	# various scripts can be used on a domain controller or a stand-alone
	# machine to add or delete corresponding UNIX accounts:

;	add user script = /usr/sbin/useradd "%u" -n -g users
;	add group script = /usr/sbin/groupadd "%g"
;	add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M
-d /nohome -s /bin/false "%u"
;	delete user script = /usr/sbin/userdel "%u"
;	delete user from group script = /usr/sbin/userdel "%u"
"%g"
;	delete group script = /usr/sbin/groupdel "%g"


# ----------------------- Browser Control Options ----------------------------
#
# local master = when set to no, Samba does not become the master browser on
# your network. When set to yes, normal election rules apply.
#
# os level = determines the precedence the server has in master browser
# elections. The default value should be reasonable.
#
# preferred master = when set to yes, Samba forces a local browser election at
# start up (and gives itself a slightly higher chance of winning the election).
#
;	local master = no
;	os level = 33
;	preferred master = yes

#----------------------------- Name Resolution -------------------------------
#
# This section details the support for the Windows Internet Name Service (WINS).
#
# Note: Samba can be either a WINS server or a WINS client, but not both.
#
# wins support = when set to yes, the NMBD component of Samba enables its WINS
# server.
#
# wins server = tells the NMBD component of Samba to be a WINS client.
#
# wins proxy = when set to yes, Samba answers name resolution queries on behalf
# of a non WINS capable client. For this to work, there must be at least one
# WINS server on the network. The default is no.
#
# dns proxy = when set to yes, Samba attempts to resolve NetBIOS names via DNS
# nslookups.

;	wins support = yes
;	wins server = w.x.y.z
;	wins proxy = yes

;	dns proxy = yes

# --------------------------- Printing Options -----------------------------
#
# The options in this section allow you to configure a non-default printing
# system.
#
# load printers = when set you yes, the list of printers is automatically
# loaded, rather than setting them up individually.
#
# cups options = allows you to pass options to the CUPS library. Setting this
# option to raw, for example, allows you to use drivers on your Windows clients.
#
# printcap name = used to specify an alternative printcap file.
#

;	load printers = yes
	cups options = raw

;	printcap name = /etc/printcap
	# obtain a list of printers automatically on UNIX System V systems:
;	printcap name = lpstat
;	printing = cups

# --------------------------- File System Options ---------------------------
#
# The options in this section can be un-commented if the file system supports
# extended attributes, and those attributes are enabled (usually via the
# "user_xattr" mount option). These options allow the administrator to
specify
# that DOS attributes are stored in extended attributes and also make sure that
# Samba does not change the permission bits.
#
# Note: These options can be used on a per-share basis. Setting them globally
# (in the [global] section) makes them the default for all shares.

;	map archive = no
;	map hidden = no
;	map read only = no
;	map system = no
;	encrypt passwords = yes
;	guest ok = no
;	guest account = nobody
;	store dos attributes = yes


#============================ Share Definitions =============================
[homes]
	comment = Home Directories
	browseable = no
	writable = yes
;	valid users = %S
;	valid users = MYDOMAIN\%S

[printers]
	comment = All Printers
	path = /var/spool/samba
	browseable = no
;	guest ok = no
;	writable = No
	printable = yes

# Un-comment the following and create the netlogon directory for Domain Logons:
;	[netlogon]
;	comment = Network Logon Service
;	path = /var/lib/samba/netlogon
;	guest ok = yes
;	writable = no
;	share modes = no

# Un-comment the following to provide a specific roving profile share.
# The default is to use the user's home directory:
;	[Profiles]
;	path = /var/lib/samba/profiles
;	browseable = no
;	guest ok = yes

# A publicly accessible directory that is read only, except for users in the
# "staff" group (which have write permissions):
;	[public]
;	comment = Public Stuff
;	path = /home/samba
;	public = yes
;	writable = yes
;	printable = no
;	write list = +staff

[ADS2-SHARE]
	path = /home/ads/ADS2-SHARE
	read only = no
;	browseable = yes
	guest ok = yes

[ADS2-BACKUPS]
	path = /other/LAP3/BACKUPS
	read only = no
;	browseable = yes
	guest ok = yes
-------------- next part --------------
[root at ADS2 samba]# tail log.nmbd
[2015/03/06 10:24:37.798704,  0] ../lib/util/become_daemon.c:136(daemon_ready)
  STATUS=daemon 'nmbd' finished starting up and ready to serve
connectionsGot SIGTERM: going down...
[2015/03/06 10:46:20,  0] ../source3/nmbd/nmbd.c:908(main)
  nmbd version 4.1.17 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2013
[2015/03/06 10:46:20.418755,  0] ../source3/nmbd/nmbd.c:949(main)
  standard input is not a socket, assuming -D option
[2015/03/06 10:46:20.420396,  0] ../lib/util/become_daemon.c:147(daemon_status)
  STATUS=daemon 'nmbd' : No local IPv4 non-loopback interfaces
available, waiting for interface ...NOTE: NetBIOS name resolution is not
supported for Internet Protocol Version 6 (IPv6).
[2015/03/06 10:46:26.445016,  0] ../lib/util/become_daemon.c:136(daemon_ready)
[root at ADS2 samba]# 


[root at ADS2 samba]# tail -20 log.smbd

[2015/03/06 10:24:37,  0] ../source3/smbd/server.c:1189(main)
  smbd version 4.1.17 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2013
[2015/03/06 10:24:43.398287,  0] ../lib/util/become_daemon.c:136(daemon_ready)
  STATUS=daemon 'smbd' finished starting up and ready to serve
connectionsFailed to delete pidfile /run/smbd.pid. Error was No such file or
directory
[2015/03/06 10:46:26,  0] ../source3/smbd/server.c:1189(main)
  smbd version 4.1.17 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2013
[2015/03/06 10:46:39.019270,  0] ../lib/util/become_daemon.c:136(daemon_ready)
[root at ADS2 samba]# 





-------------- next part --------------
[root at ADS1 samba]# tail log.lap3    
...
[2015/03/06 14:40:08.111518,  1] smbd/service.c:1070(make_connection_snum)
  lap3 (::ffff:192.168.1.18) connect to service ADS1-LAP3 initially as user
nobody (uid=99, gid=99) (pid 2075)
[root at ADS1 samba]# 

[root at ADS1 samba]# tail log.nmbd
...
[2015/03/06 13:57:29,  0] nmbd/nmbd.c:857(main)
  nmbd version 3.5.11-79.fc14 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2010
[root at ADS1 samba]# 

[root at ADS1 samba]# tail -20 log.smbd
...
[2015/03/06 13:57:30,  0] smbd/server.c:1141(main)
  smbd version 3.5.11-79.fc14 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2010
[2015/03/06 13:57:30.852507,  0] smbd/server.c:501(smbd_open_one_socket)
  smbd_open_once_socket: open_socket_in: Address already in use
[2015/03/06 13:57:30.859526,  0] smbd/server.c:501(smbd_open_one_socket)
  smbd_open_once_socket: open_socket_in: Address already in use
[2015/03/06 14:00:30.994947,  1] smbd/server.c:282(remove_child_pid)
  Could not find child 1863 -- ignoring
[2015/03/06 14:13:31.362424,  1] smbd/server.c:282(remove_child_pid)
  Could not find child 1878 -- ignoring
[2015/03/06 14:26:31.737796,  1] smbd/server.c:282(remove_child_pid)
  Could not find child 2002 -- ignoring
[2015/03/06 14:39:32.098302,  1] smbd/server.c:282(remove_child_pid)
  Could not find child 2074 -- ignoring
[2015/03/06 14:52:32.488289,  1] smbd/server.c:282(remove_child_pid)
  Could not find child 2089 -- ignoring
[root at ADS1 samba]#

On Thu, Mar 5, 2015 at 8:42 PM, Al Schapira <a_schapira at verizon.net>
wrote:
> Hello,
>
> A windows XP machine 'X' (the only one left in the LAN) sees all
> fedora14/samba3 shares on f14 machine 'A' but cannot see
fedora20/samba4
> shares on machines 'B' or 'C'.
Would the fastest, simplest, and above all *safest* solution to this
be to get rid of the  XP host? Microsoft ended all support in April,
2014, There can be software access to proprietary data, or old
permanent license on such a host, reasons to keep such a machine
alive. But it's a basic security risk on your internal network.

On 08/03/15 16:12, Nico Kadel-Garcia wrote:
> On Thu, Mar 5, 2015 at 8:42 PM, Al Schapira <a_schapira at
verizon.net> wrote:
>> Hello,
>>
>> A windows XP machine 'X' (the only one left in the LAN) sees
all
>> fedora14/samba3 shares on f14 machine 'A' but cannot see
fedora20/samba4
>> shares on machines 'B' or 'C'.
> Would the fastest, simplest, and above all *safest* solution to this
> be to get rid of the  XP host? Microsoft ended all support in April,
> 2014, There can be software access to proprietary data, or old
> permanent license on such a host, reasons to keep such a machine
> alive. But it's a basic security risk on your internal network.
Hi, whilst I agree that it would be best to remove any XP clients, this 
is not always possible.
You also seem to have missed the point that the OP has now fixed their 
problem :-)

Rowland