samba - Aug 2018 - explorer.exe crashes on security tab access

Clearly this is some kind of bug. Can you submit a bug report or should I?

Also can you elaborate why it's bad practice to create files/folders as a
local Unix user/group on a Samba DC?

On Thu, Aug 16, 2018 at 9:50 PM, Rowland Penny via samba <
samba at lists.samba.org> wrote:
> On Thu, 16 Aug 2018 21:20:29 +0200
> Kacper <kacper at kacper.se> wrote:
>
> > The same thing happen if the group on a file is wheel or any other
> > unix group. I also now observed that this also happens to unix users
> > that are not mapped in idmap.ldb.
> >
> > For example:
> > # useradd myunixuser
> > # touch myfile
> > # chown myunixuser myfile
> > # chgrp SAMDOM\sambauser myfile
> >
> > alos crashes explorer.
> >
>
> First and foremost, you shouldn't be creating files/folders in a Samba
> share directory as a local Unix user/group on a Samba Unix domain member
> or DC.
>
> Having said this, it shouldn't crash Explorer on Windows, but it does,
> tested on win7 and win10
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

This is a long-standing issue going back at least a year from what I can see in
mailing list archives.

Still not working as of Samba 4.8.3. I think MS broke something with one of the
Windows 10 updates.
 
In my situation, this is a brand-new 4.8.3 install. For me the crashes happen
when I try to edit the share folder permissions right out of the box from
whatever Samba set in there by default. So, I tried blowing away all perms for
the shares via command line on the Samba server, and low-and-behold I’m now able
to use Windows to edit and set the perms.
 
Anyway since no one anywhere seems to have posted a fix for this, (well, that I
could find at least), this is what worked for me:
 
Blow away all ACL’s and set a new fresh one that will give the Domain Admins
group “Full Control” (in Windows terms), and full inheritance:
 
EXAMPLE:
 
smbcacls //yourserver/sharename / -U administrator%youradminpassword -S
"ACL:<DOMAIN>\Domain Admins:ALLOWED/0x13/FULL"
 
..where <DOMAIN> is your domain – minus the brackets.
 
You should then be able to edit the share’s security as the
YOURDOMAIN\administrator user.
 
Some background on smbcacls as follows:
 
The general command line is as follows:
 
smbcacls //server/sharename /path -U administrator%adminpassword <-S|-a>
“ACL:<DOMAIN\username or
groupname:ALLOWED|DENIED>/<FLAGS>/<MASK>
 
-S or -a: -S will blow away all ACL’s and add the one you specify. This is used
if you want to start fresh. After you use -S, any subsequent ACL additions you
will use the -a flag.
 
FLAGS: Special things such as whether or not Inheritance is set, whether that
inheritance is propagated, etc. This field is poorly documented no matter where
you look, especially the man page. In most cases you’ll want 0x13 in that field,
which means Object Inheritance, (OI), Container Inheritance (CI), and what ever
(I) is, because it’s not documented even at Microsoft’s ACE (what they call
ACL’s) page.
 
MASK: see the man page under the “ACL FORMAT” section. What’s NOT in the man
page however is that you can also specify special permissions. IE: If you use
the “Set special permissions” on a file in Windows. Generally speaking however,
the options you would use would be either READ, CHANGE, or FULL. READ THE MAN
PAGE IF YOU DON’T UNDERSTAND THESE!
 
This example will ADD an ACL, giving Domain Users change access, and retain
Inheritance.
 
                smbcacls //server/share /MyDir -U
administrator%youradmiinpassword -a "ACL:YOURDOMAIN\Domain
Users:ALLOWED/0x13/CHANGE"
 
smbcacls does not support recursive changes. So if you want to set permissions
for all files in a tree, script it on the command line as in the example below.
 
                find yourdir -exec smbcacls //server/share /{} -U
administrator%youradminpassword -S "ACL:YOURDOMAIN\Domain
Admins:ALLOWED/0x13/FULL" \;
 
- ‘yourdir’ is the directory you want to change, including all files and subdirs
below it.
- //server/share / is the root of the share that ‘yourdir’ is on. If ‘yourdir’
is below that level, you need to put that path. EG: //server/share /path/to/{}
(note I didn’t include ‘yourdir’ in that. Just up to the dir yourdir is in).


-Glenn



On 2018-08-17, 4:45 AM, "Kacper" <kacper at kacper.se> wrote:

    Clearly this is some kind of bug. Can you submit a bug report or should I?
    
    Also can you elaborate why it's bad practice to create files/folders as
a
    local Unix user/group on a Samba DC?
    
    On Thu, Aug 16, 2018 at 9:50 PM, Rowland Penny via samba <
    samba at lists.samba.org> wrote:
    
    > On Thu, 16 Aug 2018 21:20:29 +0200
    > Kacper <kacper at kacper.se> wrote:
    >
    > > The same thing happen if the group on a file is wheel or any other
    > > unix group. I also now observed that this also happens to unix
users
    > > that are not mapped in idmap.ldb.
    > >
    > > For example:
    > > # useradd myunixuser
    > > # touch myfile
    > > # chown myunixuser myfile
    > > # chgrp SAMDOM\sambauser myfile
    > >
    > > alos crashes explorer.
    > >
    >
    > First and foremost, you shouldn't be creating files/folders in a
Samba
    > share directory as a local Unix user/group on a Samba Unix domain
member
    > or DC.
    >
    > Having said this, it shouldn't crash Explorer on Windows, but it
does,
    > tested on win7 and win10
    >
    > --
    > To unsubscribe from this list go to the following URL and read the
    > instructions:  https://lists.samba.org/mailman/options/samba
    >

On Fri, 17 Aug 2018 09:56:32 -0400
Glenn Bergeron <glenn at gbitservices.ca> wrote:
> This is a long-standing issue going back at least a year from what I
> can see in mailing list archives.
> 
> Still not working as of Samba 4.8.3. I think MS broke something with
> one of the Windows 10 updates. 
> In my situation, this is a brand-new 4.8.3 install. For me the
> crashes happen when I try to edit the share folder permissions right
> out of the box from whatever Samba set in there by default. 
Samba doesn't set the share folder permissions, the sysadmin does,
unless you are referring to sysvol & netlogon and in this case, the
permissions set do not cause the problem.

It doesn't actually seem to be the permissions that are the problem, it
seems to be what is set on the share directory.

Rowland

Ok, we identified that this is a Windows bug. Is there any way to know
if and when a Windows fix will be available from Microsoft?
On Fri, Aug 17, 2018 at 10:45 AM Kacper <kacper at kacper.se>
wrote:
>
> Clearly this is some kind of bug. Can you submit a bug report or should I?
>
> Also can you elaborate why it's bad practice to create files/folders as
a local Unix user/group on a Samba DC?
>
> On Thu, Aug 16, 2018 at 9:50 PM, Rowland Penny via samba <samba at
lists.samba.org> wrote:
>>
>> On Thu, 16 Aug 2018 21:20:29 +0200
>> Kacper <kacper at kacper.se> wrote:
>>
>> > The same thing happen if the group on a file is wheel or any other
>> > unix group. I also now observed that this also happens to unix
users
>> > that are not mapped in idmap.ldb.
>> >
>> > For example:
>> > # useradd myunixuser
>> > # touch myfile
>> > # chown myunixuser myfile
>> > # chgrp SAMDOM\sambauser myfile
>> >
>> > alos crashes explorer.
>> >
>>
>> First and foremost, you shouldn't be creating files/folders in a
Samba
>> share directory as a local Unix user/group on a Samba Unix domain
member
>> or DC.
>>
>> Having said this, it shouldn't crash Explorer on Windows, but it
does,
>> tested on win7 and win10
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>
>

Am 01.10.18 um 12:39 schrieb Kacper via samba:
> Ok, we identified that this is a Windows bug. Is there any way to know
> if and when a Windows fix will be available from Microsoft?
in case an application *crahes* it's *always* the fault of that application

I dont agree, its not always the application. 

Unstable powersupply can make applications crash or unstable graphics card or
fault ram or unstable motherboard, bad hdd.
..
And 1 google to provide proof for above statement, Google "Windows has
blocked access to the graphics cards" that one applies for all the above
options,,  so it's not always the application.
I've been reminded on that, by having a pc that, random crashes with random
applications and all hardware tests show no problems..

I could not find the problem in this case, everybody was saying its software, im
telling its hardware. (in above statements)
And.. After 9 months trying to get this fix, i've dropped the pc at a shop
to test all hardware with special test devices.
Im waiting for the results in this case..   ( i suspect here unstable power in
PSU/Mainboard/PCI-E . )

So faulty hardware, can make it crash also but that is probely not the case
here.

In the case of explorer crashed, on secrurity tab, i have seen something like
that.
If i install my Zarafa schema AND my Kopano schema on my win pc and start
ADUC,then it crashed,  removing one of these 2 fixed it for me.

Are you using extra pluging or have in integrated some sofware in the explorer? 


Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Reindl Harald via samba
> Verzonden: maandag 1 oktober 2018 15:02
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] explorer.exe crashes on security tab access
> 
> 
> Am 01.10.18 um 12:39 schrieb Kacper via samba:
> > Ok, we identified that this is a Windows bug. Is there any 
> way to know
> > if and when a Windows fix will be available from Microsoft?
> 
> in case an application *crahes* it's *always* the fault of 
> that application
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>