samba - Apr 2019 - Shared printing between Linux (client) and Windows (server): NT_STATUS_ACCESS_DENIED

Thank you for answer.

Logged in as Guest, then went to Security tab. I see `Everyone', it is 
given all permissions. Then I went to `Current permissions' tab (I have 
localized OS at the moment, so probably it is not correct name) and 
typed in `Everyone' and `Guest' as well: all five permission types are 
checked.

$ smbclient -L 192.168.0.100 -m SMB2

     Sharename       Type      Comment
     ---------       ----      -------
     ADMIN$          Disk      Удаленный Admin
     C$              Disk      Стандартный общий ресурс
     D$              Disk      Стандартный общий ресурс
     F$              Disk      Стандартный общий ресурс
     H$              Disk      Стандартный общий ресурс
     hp1516          Printer   hp1516
     IPC$            IPC       Удаленный IPC
     print$          Disk      Драйверы принтеров
     Public          Disk
     Users           Disk
SMB1 disabled -- no workgroup available
----------------------------------------------------------------
              end of cmd output
----------------------------------------------------------------

Then I edited smb.conf as you instructed and made
$ sudo service smbd restart
$ sudo service nmbd restart
Then again test printing command, access denied.

I noticed a thing: let it be a pseudocode and
     PRINT_CMD = echo -en "pisos\n" | smbclient
"\\\\192.168.0.100\\hp1516" "" -c "print -" -N

If I type
$ PRINT_CMD -U username

then I receive different errors: if username is equal to a Linux local machine
user, ACCESS_DENIED is the case; if username is equal to a windows user
(`Guest', `Admin', etc), then I have
"session setup failed: NT_STATUS_LOGON_FAILURE". But if I specify `-U
LOCAL\windowsusername', it gives ACCESS_DENIED.

I set up an account on both systems with the same credentials: user:password.
Given him necessary print privileges on Windows machine. On Linux system the
user was added to lp group as well. Now I can successfully login onto the
printer! The command is:

$ echo -en "asdfg\n" | smbclient "\\\\192.168.0.100\\hp1516"
"password" -c "print -" -U user
putting file - as stdin-4710 (0,8 kb/s) (average 0,8 kb/s)

Unfortunately, printer does not do anything, just idling.  In Windows logs I can
see successful logon audit followed by an immediate logout.

I tried to give some commands, but no visible result was produced:

$ smbclient "\\\\192.168.0.100\\hp1516" "password" -c
"queue" -U user -m SMB2
smb1cli_req_writev_submit: called for dialect[SMB2_10] server[192.168.0.100]

$ smbclient "\\\\192.168.0.100\\hp1516" "password" -c
"posix_open /home/kotee/file.txt" -U user -m SMB2
smb1cli_req_writev_submit: called for dialect[SMB2_10] server[192.168.0.100]
smb1cli_req_writev_submit: called for dialect[SMB2_10] server[192.168.0.100]
Failed to open file \home\kotee\file.txt. NT_STATUS_REVISION_MISMATCH


Finally, I try to upgrade SAMBA with the repository you provided, but I am
failing.

$ cat /etc/apt/sources.list.d/van-belle.list
# AptVanBelle repo for samba.
deb http://apt.van-belle.nl/ubuntu bionic-samba410 main contrib non-free

$ sudo apt-get upgrade
...
Ошб:10 http://apt.van-belle.nl/ubuntu bionic-samba49 Release
   404  Not Found [IP: 149.210.206.148 80]
...
E: Репозиторий «http://apt.van-belle.nl/ubuntu bionic-samba49 Release» не
содержит файла Release.
N: Обновление из этого репозитория нельзя выполнить безопасным способом, поэтому
по умолчанию он отключён.
N: Информацию о создании репозитория и настройке пользователя смотрите в
справочной странице apt-secure(8).

At least I want to try upgrading and doing the same cmds as earlier to see what
result I would receive, so lets try together to fix my fault with repo,
please...

Hai, 
> $ cat /etc/apt/sources.list.d/van-belle.list
> # AptVanBelle repo for samba.
> deb http://apt.van-belle.nl/ubuntu bionic-samba410 main contrib non-free
Should be : 
deb http://apt.van-belle.nl/debian bionic-samba410 main contrib non-free

On the commands below. 
This : smbclient "\\\\192.168.0.100\\hp1516" "password" -c
"posix_open /home/kotee/file.txt" -U user -m SMB2
And its message is what i was thinking. 

So fix the repo, and upgrade, and post the results again. 

Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> cloun via samba
> Verzonden: donderdag 4 april 2019 11:09
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] Shared printing between Linux (client) and 
> Windows (server): NT_STATUS_ACCESS_DENIED
> 
> Thank you for answer.
> 
> Logged in as Guest, then went to Security tab. I see 
> `Everyone', it is 
> given all permissions. Then I went to `Current permissions' 
> tab (I have 
> localized OS at the moment, so probably it is not correct name) and 
> typed in `Everyone' and `Guest' as well: all five permission 
> types are 
> checked.
> 
> $ smbclient -L 192.168.0.100 -m SMB2
> 
>      Sharename       Type      Comment
>      ---------       ----      -------
>      ADMIN$          Disk      ?????????????????? Admin
>      C$              Disk      ?????????????????????? 
> ?????????? ????????????
>      D$              Disk      ?????????????????????? 
> ?????????? ????????????
>      F$              Disk      ?????????????????????? 
> ?????????? ????????????
>      H$              Disk      ?????????????????????? 
> ?????????? ????????????
>      hp1516          Printer   hp1516
>      IPC$            IPC       ?????????????????? IPC
>      print$          Disk      ???????????????? ??????????????????
>      Public          Disk
>      Users           Disk
> SMB1 disabled -- no workgroup available
> ----------------------------------------------------------------
>               end of cmd output
> ----------------------------------------------------------------
> 
> Then I edited smb.conf as you instructed and made
> $ sudo service smbd restart
> $ sudo service nmbd restart
> Then again test printing command, access denied.
> 
> I noticed a thing: let it be a pseudocode and
>      PRINT_CMD = echo -en "pisos\n" | smbclient 
> "\\\\192.168.0.100\\hp1516" "" -c "print -"
-N
> 
> If I type
> $ PRINT_CMD -U username
> 
> then I receive different errors: if username is equal to a 
> Linux local machine user, ACCESS_DENIED is the case; if 
> username is equal to a windows user (`Guest', `Admin', etc), 
> then I have
> "session setup failed: NT_STATUS_LOGON_FAILURE". But if I 
> specify `-U LOCAL\windowsusername', it gives ACCESS_DENIED.
> 
> I set up an account on both systems with the same 
> credentials: user:password. Given him necessary print 
> privileges on Windows machine. On Linux system the user was 
> added to lp group as well. Now I can successfully login onto 
> the printer! The command is:
> 
> $ echo -en "asdfg\n" | smbclient
"\\\\192.168.0.100\\hp1516"
> "password" -c "print -" -U user
> putting file - as stdin-4710 (0,8 kb/s) (average 0,8 kb/s)
> 
> Unfortunately, printer does not do anything, just idling.  In 
> Windows logs I can see successful logon audit followed by an 
> immediate logout.
> 
> I tried to give some commands, but no visible result was produced:
> 
> $ smbclient "\\\\192.168.0.100\\hp1516" "password" -c
"queue"
> -U user -m SMB2
> smb1cli_req_writev_submit: called for dialect[SMB2_10] 
> server[192.168.0.100]
> 
> $ smbclient "\\\\192.168.0.100\\hp1516" "password" -c 
> "posix_open /home/kotee/file.txt" -U user -m SMB2
> smb1cli_req_writev_submit: called for dialect[SMB2_10] 
> server[192.168.0.100]
> smb1cli_req_writev_submit: called for dialect[SMB2_10] 
> server[192.168.0.100]
> Failed to open file \home\kotee\file.txt. NT_STATUS_REVISION_MISMATCH
> 
> 
> Finally, I try to upgrade SAMBA with the repository you 
> provided, but I am failing.
> 
> $ cat /etc/apt/sources.list.d/van-belle.list
> # AptVanBelle repo for samba.
> deb http://apt.van-belle.nl/ubuntu bionic-samba410 main 
> contrib non-free
> 
> $ sudo apt-get upgrade
> ...
> ??????:10 http://apt.van-belle.nl/ubuntu bionic-samba49 Release
>    404  Not Found [IP: 149.210.206.148 80]
> ...
> E: ?????????????????????? «http://apt.van-belle.nl/ubuntu 
> bionic-samba49 Release» ???? ???????????????? ?????????? Release.
> N: ???????????????????? ???? ?????????? 
> ?????????????????????? ???????????? ?????????????????? 
> ???????????????????? ????????????????, ?????????????? ???? 
> ?????????????????? ???? ????????????????.
> N: ???????????????????? ?? ???????????????? 
> ?????????????????????? ?? ?????????????????? 
> ???????????????????????? ???????????????? ?? 
> ???????????????????? ???????????????? apt-secure(8).
> 
> At least I want to try upgrading and doing the same cmds as 
> earlier to see what result I would receive, so lets try 
> together to fix my fault with repo, please...
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

On Thu, 4 Apr 2019 12:08:58 +0300
cloun via samba <samba at lists.samba.org> wrote:
> Thank you for answer.
> 
> Logged in as Guest, then went to Security tab. I see `Everyone', it
> is given all permissions. Then I went to `Current permissions' tab (I
> have localized OS at the moment, so probably it is not correct name)
> and typed in `Everyone' and `Guest' as well: all five permission
> types are checked
> 
> Then I edited smb.conf as you instructed
I take it you are referring to Louis here.
 
> 
> then I receive different errors: if username is equal to a Linux
> local machine user, ACCESS_DENIED is the case; if username is equal
> to a windows user (`Guest', `Admin', etc), then I have
"session setup
> failed: NT_STATUS_LOGON_FAILURE". But if I specify `-U
> LOCAL\windowsusername', it gives ACCESS_DENIED.
Lets try and explain Samba guest access on a standalone server:

To set guest access, you need to add 'map to guest' to smb.conf, there
are 4 settings for this: Never, Bad User, Bad Password and Bad Uid.

The first one (Never) is the default and doesn't need to be set, this
doesn't allow any guest access.

The last one (Bad Uid) isn't used on a standalone server, so this
leaves us with Bad User and Bad Password.

Bad Password allows access for known users if the wrong password is
used, but the user will become the guest user and will not have the
permissions they think they have.

Bad user rejects users with wrong passwords unless the user is also
unknown, in which case the user gets mapped to guest.

Normally, if you want authenticated users on a Samba standalone
server, you will need to create a Unix user and then also make them a
Samba user with 'smbpassword -a username'. If you only require guest
access, there is no need to do any of that, no Samba users means that
any users that connect will become the guest user, as long as you set
'map to guest = Bad User' in smb.conf and add 'guest ok = yes'
to the
shares.

Rowland