Hi list,
I'd like to raise the issue discussed in the thread below. I've faced
exactly the same problem and came to exactly the same way out - shutdown
winbindd and use "force unknown acl user".
We use "simple" mapping in the environment - all AD accounts have
corresponding NIS accounts (the same name) and the mapping is being done by
smbd.
The problem here is that I've got a problem with this - when just set up it
works perfectly. But if I change primary GID of the user to another one (in this
example - user1, old 38916 -> new 38901) I get the access denied error with
the following in logs (level 10, some private data masked):
[2007/06/18 16:22:33, 5] smbd/posix_acls.c:unpack_nt_owners(919)
unpack_nt_owners: validating owner_sids.
[2007/06/18 16:22:33, 10] passdb/lookup_sid.c:sid_to_uid(407)
sid_to_uid: winbind lookup for non-local sid
S-1-5-21-XXXXXXXXXX-XXXXXXXXX-XXXXXXXXXX-XXXXX failed
[2007/06/18 16:22:33, 3] passdb/lookup_sid.c:fetch_gid_from_cache(253)
fetch gid from cache 38916 -> S-1-5-21-273419216-XXXXXXXXX-XXXXXXXXXX-XXXXX
[2007/06/18 16:22:33, 5] smbd/posix_acls.c:unpack_nt_owners(962)
unpack_nt_owners: owner_sids validated.
[2007/06/18 16:22:33, 3] smbd/posix_acls.c:set_nt_acl(3134)
set_nt_acl: chown site/home/user1/test2. uid = 24983, gid = 38916.
[2007/06/18 16:22:33, 3] smbd/posix_acls.c:set_nt_acl(3138)
set_nt_acl: chown site/home/user1/test2, 24983, 38916 failed. Error =
Operation not permitted.
[2007/06/18 16:22:33, 10] locking/locking.c:del_share_entry(658)
del_share_entry: num_share_modes = 1
[2007/06/18 16:22:33, 10] locking/locking.c:del_share_entry(663)
del_share_entry: deleted share_mode_entry[0]: pid = 720, share_access = 0x7,
private_options = 0x0, access_mask = 0x12008a,
port = 0x0, type= 0x0, file_id = 4, dev = 0x14, inode = 17667723
[2007/06/18 16:22:33, 10] locking/locking.c:del_share_entry(673)
del_share_entry: deleting entry 0
[2007/06/18 16:22:33, 10] locking/locking.c:del_share_entry(695)
del_share_entry: Remaining table.
[2007/06/18 16:22:33, 10] smbd/close.c:close_normal_file(203)
close_normal_file: share_entry_count = 0 for file home/user1/test2
[2007/06/18 16:22:33, 10] locking/posix.c:posix_locking_close_file(1249)
posix_locking_close_file: file home/user1/test2 has no outstanding locks.
[2007/06/18 16:22:33, 2] smbd/close.c:close_normal_file(270)
avteresc closed file home/user1/test2 (numopen=0)
[2007/06/18 16:22:33, 5] smbd/files.c:file_free(459)
freed files structure 4172 (0 used)
[2007/06/18 16:22:33, 3] smbd/error.c:error_packet(147)
error packet at smbd/nttrans.c(1422) cmd=160 (SMBnttrans)
NT_STATUS_ACCESS_DENIED
I.e. at some stage of working on ACL Samba gets old GID from somewhere and tries
to chown the file to it.
Samba version is 3.0.20b from SLES9SP3 (but tested on 3.0.25 with the same
result).
Config file looks like this (again, some privates masked):
[global]
workgroup = LOCAL
realm = LOCAL.DOMAIN
server string = %L - Test Samba Server - %v
security = ADS
password server = dc.local.domain
username level = 2
lanman auth = No
log level = 10
syslog = 0
log file = /var/log/samba/smb.common.log
max log size = 100000
time server = Yes
deadtime = 15
socket options = IPTOS_LOWDELAY TCP_NODELAY
load printers = No
show add printer wizard = No
os level = 0
preferred master = No
local master = No
domain master = No
dns proxy = No
wins server = XX.XXX.X.XX, XXX.XX.X.XX
kernel oplocks = No
directory security mask = 01775
force unknown acl user = Yes
oplocks = No
level2 oplocks = No
[homes]
comment = Home
path = /home/%S
valid users = %S
read only = No
inherit permissions = Yes
browseable = No
Upon the connection request, though, Samba recognizes the UID/new GID correctly,
this strange glitch happens only at the moment of unpack_nt_owners. The file is
being created with correct UID/new GID but with 0 size.
My guess this could be something related to caching, but I've restarted
daemons, deleted some /var/lib/samba/*.tdb files related to winbindd with no
dice. Reverting GID back resolves the problem.
Could someone give me some assistance with this?
Regards,
Alexander
>Jeremy,
>
>We have found a solution to our problem, although it is not ideal. We
>have used the "force unknown acl user" flag in the smb.conf file,
>setting it to "yes". We have used this at the moment as a quick
fix to
>get around the problem, as we have not set up any authentication
>mechanism (winbind) within Samba.
>
>I'll send you the log file when I get a change to copy it over.
>
>Cheers,
>
>Mat
-----Original Message-----
From: Jeremy Allison [mailto:jra at samba.org]
Sent: 24 March 2006 17:12
To: Bradford, Matthew
Cc: samba at lists.samba.org
Subject: Re: [Samba] SFU Permission Denied
On Fri, Mar 24, 2006 at 01:00:18PM -0000, Bradford, Matthew
wrote:> This appears to be an old problem, but is a complete show stopper for
> us at the moment.
>
> We are trying to access an NFS file system, via Samba, from a WinXP
> client. Within Windows itself everything is fine, but when accessing
> the shares from within an SFU cshell, an error is returned when a file
> is created. The file is successfully created, but a "Permission
Denied"> error is returned.
>
> We receive the "Unable to validate owner sid" message in the log
file.
>
> Has any found a solution to this problem yet?
>
> We are using Samba 3.0.21c and SFU 3.5.
Debug level 10 log please ? I'm guessing that the problem might be the
uid/gid's on the file can't be looked up in the LSA. What
authentication/domain system are you using ?
Jeremy.
