samba - Dec 2003 - Debian + Samba 3.0 + Mac OS X 10.[2-3] -> insufficient privileges

hi all,

I've read trough the list and see discussions with similar problems.
I've setup a file server and users can connect to it via SMB/CIFS.
Windows users just happy. The problem starts with the Mac users.
All Mac users are using OS X (versions 10.2,10.3).
I'm vetoing several files right now, permission inheriting turned on,
I've forced the create mode and directory mode to 0777 and has force
group = users option.

There's no problem when I create a folder, copy a file through Finder.
But when I copy a folder which has sub-folders and files under
sub-folders I got the strange "Insufficient privilege" error.

This causes much headache to me. There's no option: users want to use
Finder - and they are right - and not Terminal.

Anyone has found a solution to this very embarassing problem?
Maybe 3.0.1rc1 helps? It's a _production_ server. I wouldn't like to
lose more than 100 gigs of data.

Bye,
Ago
-----------
Deim ?goston
LSC Linux Support Center Kft.
e-mail: deim.agoston@lsc.hu
Tel/fax:06-1/341-0457

Ah, yeah, it's the .DS_Store files that are causing the trouble for 
you.  They get written when copying folders to the server, so if you 
veto them you get that odd error in OS-X.  Curiously, you can delete 
those files later w/o hurting things (I think you lose any file 
comments), but you can't veto them.

I noticed that you also reference files created from Netatalk 
(:2eDS_Store, .AppleDouble, etc.).  Be careful with using Netatalk with 
Samba.  You'll end up with files with two (but independant) resource 
forks as well as incompatible file namings.  That can spell disaster 
when you try to have OS-X (via SMB) and OS-9 (via AFP) clients working 
on the same files.

Take a look at the Baltra patch for Netatalk (http://www.baltra.org) it 
was written specificly to use Netatalk and Samba together in a mixed 
environment with OS-9 and OS-X clients (as well as Windows and other 
Unix machines).

The relevent part of my smb.conf looks like this:

unix charset = UTF8
unicode = yes
dos charset = ASCII
encrypt passwords = yes
veto files = /Temporary Items/Network Trash 
Folder/TheFindByContentFolder/TheVolumeSettingsFolder/
delete veto files = yes

I don't have an explicit parameter for 'hide dot files' and it looks
like that setting is 'yes' by default, so I guess I am hiding them.  
That makes sense since they don't show up on Windows or Mac clients, but 
they are accessable.  I used 'dos charset = ASCII' to prevent OS-X from 
copying files with some bad chars (like ? and /) to the server.  Make 
sure you have people use some sane naming on their files or else they 
may get some error when trying to name or copy files on the server.

My Samba, btw, is running tandom with Netatalk-1.6.4-Baltra.

Good luck!


Phil

Deim Agoston wrote:
>Philip Edelbrock <phil@edgedesign.us> irta:
>  
>
>>I've had some luck with OS-X and Samba 3.x.  What you are probably 
>>running into is the file server blocking either the .DS_Store files 
>>(OS-X tries to put one in each directory) or the resource forks of files
>>(._filename).  You will get these strange privilege errors in these 
>>cases.  Does this ring any bells?
>>    
>>
>Aye, I'm vetoing the files .DS_Store, 2DS_Store, .AppleDouble etc.
>Hmm. I've have a good chance that if it works the users will start to
>complain that they don't want to see that files. Maybe some of them -
>the power users with big ego - will delete them as a proof on concept
>that MacOS 9 with AFP and with Mac servers would be a better choice.
>Did you turned on the hide dot files option?
>What codepage do you use? I've used cp850 and utf8 as unix charset and
>display to be compatible with everything. Thanks your help,
>
>Ago
>
>-----------
>Deim ?goston
>LSC Linux Support Center Kft.
>e-mail: deim.agoston@lsc.hu
>Tel/fax:06-1/341-0457
>
>  
>