samba - Dec 2016 - Share 'IPC$' has wide links and unix extensions enabled

>> On Fri, 30 Sep 2016 12:14:44 -0400 (EDT)
>> schulz at adi.com (Thomas Schulz) wrote:
>> 
>>>> On Fri, 30 Sep 2016 10:14:32 -0400 (EDT)
>>>> Thomas Schulz via samba <samba at lists.samba.org>
wrote:
>>>> 
>>>>> We are running Samba 4.4.6 as a file server.
>>>>> In the logs for a few client machines I see entries such
as:
>>>>> 
>>>>> [2016/09/29 22:36:58.862575,  0]
>>>>>     ../source3/param/loadparm.c:4402(widelinks_warning)
>>>>>   Share 'IPC$' has wide links and unix extensions
enabled. These
>>>>>   parameters are incompatible. Wide links will be disabled
for
>>>>> this share.
>>>>> 
>>>>> I assume that Share 'IPC$' is some sort of
automatically created
>>>>> share as we define no such share. We do have wide links
enabled
>>>>> globally but we do not have unix extensions enabled
anywhere. I
>>>>> assume that this message is harmless, but I am wondering
where it
>>>>> comes from.
>>>>> 
>>>>> Tom Schulz
>>>>> Applied Dynamics Intl.
>>>>> schulz at adi.com
>>>>> 
>>>> 
>>>> It is set automatically, try reading 'man smb.conf'
>>>> 
>>>> Rowland
>>> 
>>> We have the following in our smb.conf file in the global section:
>>> 
>>> unix extensions = no
>>> wide links = yes
>>> 
>>> Interesting that testparam does not show the setting for wide links
>>> and I did not remember that we had that setting in smb.conf until I
>>> went to edit smb.conf to add it.
>>> 
>>> Reading the smb.conf man page, I don't see anything about a
share IPC$
>>> or anything to show why unix extensions would be automatically
enabled
>>> for any share when 'unix extensions = no' is set globally
in smb.conf.
>>> No other share generates any widelinks_warning messages, so I think
>>> that the setting 'unix extensions = no' is working in
general.
>>> 
>>> Tom Schulz
>>> Applied Dynamics Intl.
>>> schulz at adi.com
>> 
>> OK, according to 'man smb.conf', 'unix extensions =
yes' is the default
>> and if turned on 'wide links' will be disabled, but you have it
set to
>> 'no' and 'wide links' turned on.
>> 
>> If you turn on wide links with 'unix extensions = yes', this is
when
>> you are supposed to get the message, but you are getting it with
'unix
>> extensions = no'. I seem to remember this coming up before. Can you
try
>> setting 'allow insecure wide links = yes' and see if this stops
the
>> log message.
>> 
>> Either way, it looks like a bug
>> 
>> Rowland
>
> I have not seen that error since setting 'allow insecure wide links =
yes',
> but the error did not occure constantly so I will keep checking the logs
> for awhile.
> 
> I have found that share IPC$ only exists if security = domain. It is not
> there with security = ads. I can map a share to IPC$, but all access is
> denied. I will probably swtich this server over to security = ads
> sometime soon.
> 
> Tom Schulz
Setting 'allow insecure wide links = yes' does not stop the errors. I
have
been assuming that the messages were not a problem, but yesterday a user
was unable to access some directories that were accessed through wide
links. The log showed share IPC$ but the share with the problem was share
'users'.
I have filed bug 12459.

Tom Schulz
Applied Dynamics Intl.
schulz at adi.com