samba - Mar 2002 - Windows for Workgroups

Hi,

The following is (myself) quoted from an exchange with the security group
about what at first appeared to be a security hole in Samba.  One of the
group suggested I ask the question here.

Can you shed some light?

Thanks!
> I recently brought up a computer (RedHat 7.2, kernel 2.4.9-31, Samba
> 2.2.1a-4), preparatory to going live with it, and mapped to a Windows For
> Workgroups (WFW) machine which runs several production Internet servers
> (believe it or not, with few problems, and for over six years now).  The
> machine on which I was seeing the errors (Samba 2.0.6 on the 2.2.15-4mdk
> kernel) has been mapped to a share on the same machine for about a year,
> again with no problems.
> 
> Apparently the newer Samba/kernel has issues with WFW such that it works
for
> a while and then both Linux systems and the WFW box all become confused,
> even to the point of causing WFW to reboot.  Once this confusion sets in,
> attempts to access the share on WFW result in the messages like that
> reported below.
> > > Mar 24 10:51:21 mrserver kernel: smb_retry: signal failed,
error=-3
> > > Mar 24 10:51:21 mrserver kernel: smb_retry: signal failed,
error=-3
> > > Mar 24 10:51:21 mrserver kernel: smb_lookup: find //absolute
failed,
> > > error=-5
> I am apparently going to have to move the software onto NT.  This is not a
> happy choice, since it may mean buying another Micro$oft license at a time
> when I'm trying to edge M$ out of my life and business.  Not to mention
the
> unwanted expense.  Connectivity to older machines is _essential_ for a lot
> of us on limited budgets, and can make the difference between giving M$ the
> boot or having to continue with it.
> 
> I hope the problem is a fluke and not the result of a decision to drop
> support for these systems.  This is not the only WFW computer which is in
> use here and the prospect of being forced into unwanted upgrades is, for an
> old M$ victim, all-too-familiar.

Michael L. Wright
System Administrator, Vashti.Net

MichaelW@Vashti.Net
Voice: 850-877-0050

On Thu, 28 Mar 2002, Michael L. Wright / System Administrator, Vashti.Net wrote:
> > Apparently the newer Samba/kernel has issues with WFW such that it
works for
> > a while and then both Linux systems and the WFW box all become
confused,
> > even to the point of causing WFW to reboot.  Once this confusion sets
in,
> > attempts to access the share on WFW result in the messages like that
> > reported below.
> 
> > > > Mar 24 10:51:21 mrserver kernel: smb_retry: signal failed,
error=-3
> > > > Mar 24 10:51:21 mrserver kernel: smb_retry: signal failed,
error=-3
> > > > Mar 24 10:51:21 mrserver kernel: smb_lookup: find //absolute
failed,
> > > > error=-5
There are no smb* messages before those?

The signal failed message means that smbmount has crashed, that makes
smbfs unable to reconnect to the server after the server has disconnected
(and smb servers like to disconnect when you are idle).

The problem lies in smbmount(*) and it would be interesting to see if
there is anything in the smbmount logfile (/var/log/samba/smbmount.log).
Maybe even try running smbmount on a higher loglevel (debug=5).

Strange that 2.0.6 would be better than 2.2 as there were a few bugs that
would cause smbmount in 2.0 to terminate. You could try running 2.0.6 on
your RH7.2 box, or you could try upgrading samba to 2.2.3a.


(* well, if your WFW crashes then that could be seen as a problem too ...)

> > I hope the problem is a fluke and not the result of a decision to drop
> > support for these systems.  This is not the only WFW computer which is
in
> > use here and the prospect of being forced into unwanted upgrades is,
for an
> > old M$ victim, all-too-familiar.
No, there is no such decision. But old systems are probably not tested as
much and I doubt many see WFW as an important target. I know I don't, nor
do I care much about OS/2 ...

However, I'll be happy to help you debug this. Some random thoughts:

1. Why does the connection go away? Some uses of smbfs can cause it to
   mistake a signal as a lost connection and then it retries. Perhaps your 
   use triggers this a lot and the WFW server can't handle the multiple 
   reconnects.
   Other errors in the kernel log would show that (-512 errors are often 
   caused by that)

2. A network trace of the packets that kill the WFW box could show what is 
   happening.

3. Why does smbmount crash? The smbmount logfile may show something, if 
   not you may need to add some debugging output to it.

   smbmount does most of it's long-time work in send_fs_socket() and the
   crash is caused by something in it (or one of the functions it calls).

4. Is the smbmount crash causing the WFW crash or does WFW crash anyway.
   If it is the 2nd then fixing smbmount won't help, the event that kills 
   the WFW must also be fixed.

It helps if you can build samba from source and are able to make some
simple changes to a .c file.

/Urban