samba - Oct 2016 - Share 'IPC$' has wide links and unix extensions enabled

> On Fri, 30 Sep 2016 12:14:44 -0400 (EDT)
> schulz at adi.com (Thomas Schulz) wrote:
> 
> > > On Fri, 30 Sep 2016 10:14:32 -0400 (EDT)
> > > Thomas Schulz via samba <samba at lists.samba.org> wrote:
> > > 
> > > > We are running Samba 4.4.6 as a file server.
> > > > In the logs for a few client machines I see entries such as:
> > > > 
> > > > [2016/09/29 22:36:58.862575,  0]
> > > >     ../source3/param/loadparm.c:4402(widelinks_warning)
> > > >   Share 'IPC$' has wide links and unix extensions
enabled. These
> > > >   parameters are incompatible. Wide links will be disabled
for
> > > > this share.
> > > > 
> > > > I assume that Share 'IPC$' is some sort of
automatically created
> > > > share as we define no such share. We do have wide links
enabled
> > > > globally but we do not have unix extensions enabled
anywhere. I
> > > > assume that this message is harmless, but I am wondering
where it
> > > > comes from.
> > > > 
> > > > Tom Schulz
> > > > Applied Dynamics Intl.
> > > > schulz at adi.com
> > > > 
> > > 
> > > It is set automatically, try reading 'man smb.conf'
> > > 
> > > Rowland
> > 
> > We have the following in our smb.conf file in the global section:
> > 
> > unix extensions = no
> > wide links = yes
> > 
> > Interesting that testparam does not show the setting for wide links
> > and I did not remember that we had that setting in smb.conf until I
> > went to edit smb.conf to add it.
> > 
> > Reading the smb.conf man page, I don't see anything about a share
IPC$
> > or anything to show why unix extensions would be automatically enabled
> > for any share when 'unix extensions = no' is set globally in
smb.conf.
> > No other share generates any widelinks_warning messages, so I think
> > that the setting 'unix extensions = no' is working in general.
> > 
> > Tom Schulz
> > Applied Dynamics Intl.
> > schulz at adi.com
> 
> OK, according to 'man smb.conf', 'unix extensions = yes' is
the default
> and if turned on 'wide links' will be disabled, but you have it set
to
> 'no' and 'wide links' turned on.
> 
> If you turn on wide links with 'unix extensions = yes', this is
when
> you are supposed to get the message, but you are getting it with 'unix
> extensions = no'. I seem to remember this coming up before. Can you try
> setting 'allow insecure wide links = yes' and see if this stops the
> log message.
> 
> Either way, it looks like a bug
> 
> Rowland
I have not seen that error since setting 'allow insecure wide links =
yes',
but the error did not occure constantly so I will keep checking the logs
for awhile.

I have found that share IPC$ only exists if security = domain. It is not
there with security = ads. I can map a share to IPC$, but all access is
denied. I will probably swtich this server over to security = ads
sometime soon.

Tom Schulz
Applied Dynamics Intl.
schulz at adi.com