samba - Jul 2004 - How can Windows 2000 mount a share as a service?

I've asked every M$ expert I know, trolled through M$ TechNet, experimented
with SRVANY/INSTSRV login scripts which hard-code username/passwords to
login to a Samba 2.2.8a SMB server.  I've experiment with and without the
"Allow service to interact with Desktop" switch turned on.

I am stuck. :(   I can find no way to mount a share as a service, so that
IIS can serve web-pages from a shared content directed located on a network
drive.

When I run my login script when I'm logged in as the Administrator or
another user, the script works fine.  The share's mounted and available as
the specified drive letter specified in the script.

I'm using just the standard "net use" as follows:

net use z: \\192.168.0.1\Web mypassword /user:webuser

I've fiddled with adding a domain name to the user, to no avail. I've
experimented with using the samba server's "Netbios" name as well
as DNS
name, to no avail.

The script only seems to work when SOMEONE is logged into the machine.  When
it's run as a service, no dice.  It just fails with a single digit error
code (5, I think).  The error is opaque and non-descriptive.  It's as if SMB
mounting was specifically prohibited by the OS at some internal bowel juncture.

This is insane.  Surely, people running web-server clusters behind load
balancers don't manually synchronise their content!  My web application
accepts user-uploaded files, so I can't use the "manual resync"
method
anyway.  The upload area needs to be shared by all web-server members.

There must be a solution for this very common requirement.  I don't want or
need a "SAN" block-device-level solution, I want a file-level
solution.

If anyone can share some ideas or experise, I would be very grateful.  This
must be a solved problem somewhere.

=MB=

Well, Windoze mounted network shares are user specific.  Each user 
profile stores the share that that user uses.  Or in your case when the 
LOGON script is run.  Note LOGON script.  What it looks like you need to 
do is try using DFS.  Add the samba shares to the DFS and have IIS pull 
the shared data from DFS.  I'm fairly certain w2k/2k3 server machines 
can do this.  I've only experimented with DFS so far, but having samba 
shares in DFS is not a problem in my test environment.  You may need to 
use Samba 3.0.4+ for it to work, though I'm not sure.

Malcolm Baldridge wrote:
>I've asked every M$ expert I know, trolled through M$ TechNet,
experimented
>with SRVANY/INSTSRV login scripts which hard-code username/passwords to
>login to a Samba 2.2.8a SMB server.  I've experiment with and without
the
>"Allow service to interact with Desktop" switch turned on.
>
>I am stuck. :(   I can find no way to mount a share as a service, so that
>IIS can serve web-pages from a shared content directed located on a network
>drive.
>
>When I run my login script when I'm logged in as the Administrator or
>another user, the script works fine.  The share's mounted and available
as
>the specified drive letter specified in the script.
>
>I'm using just the standard "net use" as follows:
>
>net use z: \\192.168.0.1\Web mypassword /user:webuser
>
>I've fiddled with adding a domain name to the user, to no avail.
I've
>experimented with using the samba server's "Netbios" name as
well as DNS
>name, to no avail.
>
>The script only seems to work when SOMEONE is logged into the machine.  When
>it's run as a service, no dice.  It just fails with a single digit error
>code (5, I think).  The error is opaque and non-descriptive.  It's as if
SMB
>mounting was specifically prohibited by the OS at some internal bowel
juncture.
>
>This is insane.  Surely, people running web-server clusters behind load
>balancers don't manually synchronise their content!  My web application
>accepts user-uploaded files, so I can't use the "manual
resync" method
>anyway.  The upload area needs to be shared by all web-server members.
>
>There must be a solution for this very common requirement.  I don't want
or
>need a "SAN" block-device-level solution, I want a file-level
solution.
>
>If anyone can share some ideas or experise, I would be very grateful.  This
>must be a solved problem somewhere.
>
>=MB>  
>

On Fri, 2004-07-09 at 17:11, Malcolm Baldridge wrote:
> I've asked every M$ expert I know, trolled through M$ TechNet,
experimented
> with SRVANY/INSTSRV login scripts which hard-code username/passwords to
> login to a Samba 2.2.8a SMB server.  I've experiment with and without
the
> "Allow service to interact with Desktop" switch turned on.
> 
> I am stuck. :(   I can find no way to mount a share as a service, so that
> IIS can serve web-pages from a shared content directed located on a network
> drive.
> 
> When I run my login script when I'm logged in as the Administrator or
> another user, the script works fine.  The share's mounted and available
as
> the specified drive letter specified in the script.
> 
> I'm using just the standard "net use" as follows:
> 
> net use z: \\192.168.0.1\Web mypassword /user:webuser
> 
> I've fiddled with adding a domain name to the user, to no avail.
I've
> experimented with using the samba server's "Netbios" name as
well as DNS
> name, to no avail.
> 
> The script only seems to work when SOMEONE is logged into the machine. 
When
> it's run as a service, no dice.  It just fails with a single digit
error
> code (5, I think).  The error is opaque and non-descriptive.  It's as
if SMB
> mounting was specifically prohibited by the OS at some internal bowel
juncture.
> 
> This is insane.  Surely, people running web-server clusters behind load
> balancers don't manually synchronise their content!  My web application
> accepts user-uploaded files, so I can't use the "manual
resync" method
> anyway.  The upload area needs to be shared by all web-server members.
> 
> There must be a solution for this very common requirement.  I don't
want or
> need a "SAN" block-device-level solution, I want a file-level
solution.
> 
> If anyone can share some ideas or experise, I would be very grateful.  This
> must be a solved problem somewhere.
-----
Microsoft DFS (supported by Samba)

<http://www.microsoft.com/ntserver/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp>

Craig

OK, welcome to Windows security 101.

Services typically run at System level authority, and M$ does not like to have
system authority programs participate in File&Print activities.

To test your scripts, I suggest you invent something on your box that will pop
you a system level CMD session so you can test batch and other programs right in
that session. One way to do this is to
install the RSHD that comes with the Win2KRK (rshsvc they call it) and then
rexec to localhost and crank up a cmd session. Just make sure rshsvc is set to
allow desktop interaction and you will see
your cmd session.

Last I knew, System also didn't like drive letter based mappings. So try
"NET USE \\SERVER\SHARENAME passWORD /user:DOMAIN\UserID /PERSIST:NO"

PERSIST NO is critical in System level shares or else you get the share stuck in
System's restart connections at boot list... but it doesn't have the
ID/pw any more... most annoying to get those
cleared. Actually you need only add NET USE /PERSIST:NO to the begining of your
script, not each net use.

Then, you are stuck using UNC for everything, if you have a non UNC friendly
program, SORRY!

The other thing you might run into which is most annoying on Windows is that if
(I forget if this is separate between System and users on the box or global to
the box) Windows does not like multiple
credentials being used. If it is box wide, then a user logging in to the desktop
and trying to attach to the same Samba server would have to match credentials...
if it is separate between users and
System, then at least everything system does would have to have the same
credentials used. You might run into issues with things (IPC$ maybe) where M$
did deem networking at System level was an OK
Idea is using System credentials to network, and here you come with a file share
and different credentials...

Anyway.... start with a System level CMD session so you can hack around with
what works and what does not for you... write down what works and what does
not... hack on!

-- 
Michael Lueck
Lueck Data Systems

Remove the upper case letters NOSPAM to contact me directly.

Here is an wild idea, why don't you make that service login as an user
(there is a way,(in services)to make your service run as user XXXXX.)
combine that with a login script, or even a home drive mapping, and your
service should have a mapped drive....

but this is theoretical, never tryed it for real..
we have an update service running on the machines, that distrebute file 
and register updates for our
work stations, and it also uses a mapped drive, and it works fine..
at this service of our, is also executed as a differend special user...

dunno... it's not beautyfull, but hey it works for us...

Greets

Collen Blijenberg <MLHJ>


Malcolm Baldridge wrote:
>I've asked every M$ expert I know, trolled through M$ TechNet,
experimented
>with SRVANY/INSTSRV login scripts which hard-code username/passwords to
>login to a Samba 2.2.8a SMB server.  I've experiment with and without
the
>"Allow service to interact with Desktop" switch turned on.
>
>I am stuck. :(   I can find no way to mount a share as a service, so that
>IIS can serve web-pages from a shared content directed located on a network
>drive.
>
>When I run my login script when I'm logged in as the Administrator or
>another user, the script works fine.  The share's mounted and available
as
>the specified drive letter specified in the script.
>
>I'm using just the standard "net use" as follows:
>
>net use z: \\192.168.0.1\Web mypassword /user:webuser
>
>I've fiddled with adding a domain name to the user, to no avail.
I've
>experimented with using the samba server's "Netbios" name as
well as DNS
>name, to no avail.
>
>The script only seems to work when SOMEONE is logged into the machine.  When
>it's run as a service, no dice.  It just fails with a single digit error
>code (5, I think).  The error is opaque and non-descriptive.  It's as if
SMB
>mounting was specifically prohibited by the OS at some internal bowel
juncture.
>
>This is insane.  Surely, people running web-server clusters behind load
>balancers don't manually synchronise their content!  My web application
>accepts user-uploaded files, so I can't use the "manual
resync" method
>anyway.  The upload area needs to be shared by all web-server members.
>
>There must be a solution for this very common requirement.  I don't want
or
>need a "SAN" block-device-level solution, I want a file-level
solution.
>
>If anyone can share some ideas or experise, I would be very grateful.  This
>must be a solved problem somewhere.
>
>=MB>  
>

Only applications specifically written as services can be used as
services.

What you need to do is make a mapping in IIS to a virtual folder

	Select the web you are working on
	Right click -> Create new virtual directory
	Up comes a wizard....

	In that wizard name your new virtual directory [content] or
whatever, click next
	
The next dialog will ask for the path: \\marvin\share
	Uncheck the box below that says "Always use the authenticated
user's Credentials"
	Enter a username and password, click next
	Set the attributes:

		Read
	Clear:
		Run scripts
		Execute
		Write
		Browse

Click next
	

Now click finish.



-----Original Message-----
From: samba-bounces+jalifrangis=xialys.com@lists.samba.org
[mailto:samba-bounces+jalifrangis=xialys.com@lists.samba.org] On Behalf
Of Malcolm Baldridge
Sent: Friday, July 09, 2004 5:12 PM
To: SAMBA
Subject: [Samba] How can Windows 2000 mount a share as a service?

I've asked every M$ expert I know, trolled through M$ TechNet,
experimented
with SRVANY/INSTSRV login scripts which hard-code username/passwords to
login to a Samba 2.2.8a SMB server.  I've experiment with and without
the
"Allow service to interact with Desktop" switch turned on.

I am stuck. :(   I can find no way to mount a share as a service, so
that
IIS can serve web-pages from a shared content directed located on a
network
drive.

When I run my login script when I'm logged in as the Administrator or
another user, the script works fine.  The share's mounted and available
as
the specified drive letter specified in the script.

I'm using just the standard "net use" as follows:

net use z: \\192.168.0.1\Web mypassword /user:webuser

I've fiddled with adding a domain name to the user, to no avail. I've
experimented with using the samba server's "Netbios" name as well
as DNS
name, to no avail.

The script only seems to work when SOMEONE is logged into the machine.
When
it's run as a service, no dice.  It just fails with a single digit error
code (5, I think).  The error is opaque and non-descriptive.  It's as if
SMB
mounting was specifically prohibited by the OS at some internal bowel
juncture.

This is insane.  Surely, people running web-server clusters behind load
balancers don't manually synchronise their content!  My web application
accepts user-uploaded files, so I can't use the "manual resync"
method
anyway.  The upload area needs to be shared by all web-server members.

There must be a solution for this very common requirement.  I don't want
or
need a "SAN" block-device-level solution, I want a file-level
solution.

If anyone can share some ideas or experise, I would be very grateful.
This
must be a solved problem somewhere.

=MB-- 
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba

you might be able to use cygwin. It will allow to start a linux like 
service when windoze boots. Maybe you could use smbmount on in the 
startup.I use it to start an ssh server and get into all my windoze clients.
http://www.cygwin.com/

Malcolm Baldridge wrote:
> I've asked every M$ expert I know, trolled through M$ TechNet,
experimented
> with SRVANY/INSTSRV login scripts which hard-code username/passwords to
> login to a Samba 2.2.8a SMB server.  I've experiment with and without
the
> "Allow service to interact with Desktop" switch turned on.
> 
> I am stuck. :(   I can find no way to mount a share as a service, so that
> IIS can serve web-pages from a shared content directed located on a network
> drive.
> 
> When I run my login script when I'm logged in as the Administrator or
> another user, the script works fine.  The share's mounted and available
as
> the specified drive letter specified in the script.
> 
> I'm using just the standard "net use" as follows:
> 
> net use z: \\192.168.0.1\Web mypassword /user:webuser
> 
> I've fiddled with adding a domain name to the user, to no avail.
I've
> experimented with using the samba server's "Netbios" name as
well as DNS
> name, to no avail.
> 
> The script only seems to work when SOMEONE is logged into the machine. 
When
> it's run as a service, no dice.  It just fails with a single digit
error
> code (5, I think).  The error is opaque and non-descriptive.  It's as
if SMB
> mounting was specifically prohibited by the OS at some internal bowel
juncture.
> 
> This is insane.  Surely, people running web-server clusters behind load
> balancers don't manually synchronise their content!  My web application
> accepts user-uploaded files, so I can't use the "manual
resync" method
> anyway.  The upload area needs to be shared by all web-server members.
> 
> There must be a solution for this very common requirement.  I don't
want or
> need a "SAN" block-device-level solution, I want a file-level
solution.
> 
> If anyone can share some ideas or experise, I would be very grateful.  This
> must be a solved problem somewhere.
> 
> =MB=