samba - Apr 2023 - clients not connecting to samba shares

On 2023-03-29 23:28, Gary Dale via samba wrote:
> On 2023-03-29 15:50, Rowland Penny via samba wrote:
>>
>>
>> On 29/03/2023 20:06, Gary Dale via samba wrote:
>>>>
>>> Following the advice of 
>>>
https://wiki.samba.org/index.php/Distribution-specific_Package_Installation,
>>> below the installation report after I did a more thorough purging
of
>>> Samba-related stuff. I took the further advice and changed the
realm
>>> to HOME.RAHIM-DALE-ORG. The DC remains TheLibrarian.
>>>
>>> # apt install acl attr samba samba-dsdb-modules samba-vfs-modules 
>>> winbind libpam-winbind libnss-win bind krb5-config krb5-user
dnsutils
>>
>> I have updated that list.
>>
>>>
>>> Creating config file /etc/samba/smb.conf with new version
>>
>> This is why you need to remove the smb.conf, the package install 
>> creates one for a standalone server.
>>
>>>
>>>
>>> The reported errors seem to be due to further configuration being 
>>> needed for a DC.
>>>
>>> Next I continued with the wiki at 
>>>
https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller
>>
>> I have updated that wikipage slightly.
>>
>>>
>>> First I verified that /etc/resolv.conf was correct then I updated 
>>> /etc/hosts to reflect the new realm name.
>>>
>>> Next I ran: samba-tool domain provision --use-rfc2307 --interactive
>>>
>>> This failed with an error:
>>>
>>> ERROR(<class 'samba.provision.ProvisioningError'>):
Provision failed
>>> - ProvisioningError: guess_names: 'realm =' was not
specified in
>>> supplied /etc/samba/smb.conf.? Please remove the smb.conf file and 
>>> let provision generate it
>>
>> I moved the deletion on the wikipage, from where it was, it sounded 
>> like you only had to remove the smb.conf if the provision had run 
>> successfully.
>>
>>>
>>> So I removed the smb.conf and ran it again. This time I got:
>>>
>>> INFO 2023-03-29 15:01:07,831 pid:17352 
>>> /usr/lib/python3/dist-packages/samba/provision/__init__.py #2122: 
>>> Looking up IPv4 addresses
>>> INFO 2023-03-29 15:01:07,832 pid:17352 
>>> /usr/lib/python3/dist-packages/samba/provision/__init__.py #2139: 
>>> Looking up IPv6 addresses
>>> WARNING 2023-03-29 15:01:07,833 pid:17352 
>>> /usr/lib/python3/dist-packages/samba/provision/__init__.py #2146:
No
>>> IPv6 address will be assigned
>>> Error: Unable to parse dn 
>>> 'CN=Schema,CN=Configuration,DC=home,DC=rahim-dale,DC=org,'
>>
>> I know you updated /etc/hosts, but did the computer pick this up, 
>> does it think it is in the home.rahim-dale.org dns domain ?
>
> The computer should query /etc/hosts each time. The actual problem was 
> a typo in the file - I put a comma in when it only allows spaces to 
> separate the names.
>
>
>>
>>> I'm not sure what is causing this error. The only samba log is
named
>>> log.%m and it has nothing from the time of running samba-tool
either
>>> time.
>>
>> There wouldn't be anything in the logs at this point, Samba
hasn't
>> started, though thinking about it, did you stop any running Samba 
>> processes before the provision.
>>
>> I can assure this does work, to test it, I setup Debian 11 in a VM 
>> and created a new domain, the only real difference is that I used 
>> Samba from backports.
>>
>> I really suggest you use backports, even the Debian Samba maintainer 
>> (Michael Tokarev) is telling you to use backports.
>
> Baokports are for people who need something that the stable version 
> doesn't provide. That's not me. I run Debian/Stable on my servers
for
> a reason. I run Testing on my workstation because I want to help test 
> things. And I run it my new laptop because it requires drivers that 
> aren't available in Stable.
>
> Debian does update stable when a serious issue is found that can't be 
> patched. However that is a vector for breakage - it wasn't that long 
> ago that an update to ghostscript broke a lot programs in Stable that 
> used it to produce PDFs. We had to choose between a security flaw or a 
> lack of functionality.
>
> I'll wait until Bookworm becomes Stable to get the Samba upgrade.
>
>>
>> If it helps I can send you my notes.
>>
>> Rowland
>>
> BTW: After I fixed /etc/hosts, removed the /etc/samba/smb.conf and 
> re-ran provisioning, I was able to start samba. I connected my VM to 
> the new domain and I have almost everything working (for some reason 
> I've lost the E: drive letter for network mapping).
>
> Thanks for your help! Greatly appreciated.
>
Actually, I was probably a little optimistic in assessment. My network 
shares are problematic. I tried using 
https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs 
to get the shares working but that let me down a rabbithole

The basic problem is my Linux computers use NSF to connect to network 
shares, If I set up the shares as described in the wiki, my Linux 
computers lose access - there doesn't appear to be a mapping between, 
for example, "Domain Users" and users. If I don't set up all the
file
ownerships to use "Domain Users", my Windows users can't use them 
(except for the domain Administrator).

And even going into the security tab on files or folders properties 
usually crashes the window - even when I'm logged in as the domain 
Administrator.

My first attempt to fix this was to upgrade to the backports version of 
Samba since you indicated it might be necessary for an up-to-date 
Windows 10 machine. The upgrade had no impact - the problems remain the 
same.

In the past this was resolvable by manually mapping the Windows groups 
to the Linux ones - and this was working on my server until recently. 
However I gather that some change to either Windows or Samba caused that 
to stop working.

Any advice on how to proceed?

Thanks.

On 31/03/2023 22:38, Gary Dale via samba wrote:
> Actually, I was probably a little optimistic in assessment. My network 
> shares are problematic. I tried using 
> https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs 
> to get the shares working but that let me down a rabbithole
> 
> The basic problem is my Linux computers use NSF to connect to network 
> shares, If I set up the shares as described in the wiki, my Linux 
> computers lose access - there doesn't appear to be a mapping between, 
> for example, "Domain Users" and users.

Hmm, this is one of the problems of using a DC as a fileserver with the 
'ad' idmap backend.

On a standard Samba DC using the idmap backend (the default), if you 
look in idmap.ldb, you should find something ike this:

dn: CN=S-1-5-21-627072207-2265849604-124128874-513
cn: S-1-5-21-627072207-2265849604-124128874-513
objectClass: sidMap
objectSid: S-1-5-21-627072207-2265849604-124128874-513
type: ID_TYPE_GID
xidNumber: 100
distinguishedName: CN=S-1-5-21-627072207-2265849604-124128874-513

Which clearly shows that Domain Users (the RID 513) is mapped to the 
Unix ID (xidNumber) 100

If you check /etc/group on the DC you will find this:

grep '100' /etc/group
users:x:100:<LIST_OF_LOCAL_USERS>

So, as standard, Domain Users is mapped to the Unix group users.
If you give Domain Users a gidNumber attribute (you have to, to get the 
'ad' idmap backend to work on Unix domain members), whatever number you 
use will override the '100' and break the mapping. You might think that 
you could use '100' for the gidNumber and yes you could, but this would 
mean that the idmap config range for the domain would have to start at 
100 and that isn't really a good idea.

> If I don't set up all the file 
> ownerships to use "Domain Users", my Windows users can't use
them
> (except for the domain Administrator).
> 
> And even going into the security tab on files or folders properties 
> usually crashes the window - even when I'm logged in as the domain 
> Administrator.
That should not happen, though there was a known bug, which I though had 
been fixed.
> 
> My first attempt to fix this was to upgrade to the backports version of 
> Samba since you indicated it might be necessary for an up-to-date 
> Windows 10 machine. The upgrade had no impact - the problems remain the 
> same.
> 
> In the past this was resolvable by manually mapping the Windows groups 
> to the Linux ones - and this was working on my server until recently. 
> However I gather that some change to either Windows or Samba caused that 
> to stop working.
The problem is, you shouldn't really have Linux groups per se, you 
should have Windows groups that are also Linux groups i.e. everything is 
in AD.
> 
> Any advice on how to proceed?
Can we start with the smb.conf you are using now.

What version of NFS are you using 3 or 4 ?

Rowland