samba - Apr 2019 - Samba 4 write lock problem with MS Word

I'm getting "access denied" with one particular samba 4 home
directory NFS
share. But only with Microsoft Word, Excel and PowerPoint. If I edit an
RTF file in wordpad or notepad and save it back to the samba home share it
works. But I get "access denied" if I'm using Word. Also, no
problems with
WordPerfect.

On the same NFS mount point I have several Samba shares. Lets call them
1. Share1
2. Public1
3. Home1

This mount point is on my Samba DC. And Samba resends the shares to the
Windows clients.

For Share1 and Public1, I can successfully edit a word file and save it
back to the share without problem. But on Home1, if I try and edit a word
doc and save it back, I get access denied. But as I mentioned above, if I
edit an RTF with wordpad or notepad I can edit it and save it back to
Home1 without getting access denied. The problem only exists with MS
Office apps.

The NFS mount is coming from a Debian server. It happens to be a proxmox
5.1-46 64 bit distribution. But the NFS mount comes from the underlying
debian layer and not a proxmox VM nor a container.

The Samba DC mounting the debian NFS share is a 64 bit CentOs 6.5
(2.6.32-431.3.1.el6.x86_64). The Samba DC resides on this CentOS 6.5
server.

Note that the NFS share used to be served up by an even older CentOS 5 
NFS server. I moved the entire terabyte share from the old CentOS 5 server
to the newer proxmox 5 (debian) server. And this is when the problem
started happening that I can no longer write to the Home1 directory.

I did see discussion on lists about trying "oplocks=no" and
"posix locking=no" in my smb.conf but that didn't help.

Here is part of my smb.conf file:

[global]
workgroup = ABC
realm = ABC.ORG
netbios name = SAMBA1
server role = active directory domain controller
dns forwarder = 192.168.14.254
guest ok = yes
security = user
logon drive = H:
log file = /var/log/samba/%m.log
printcap name = /etc/printcap

[home]
comment = Home Directories
path = /usr/data/Users
writeable = yes
use sendfile = no
#oplocks = no
#posix locking = no

[public1]
comment = All Users
path = /usr/data/public
writeable = yes
#guest ok = yes
admin users = @users
force group = users
create mask = 0660
directory mask = 0771
browseable = yes
use sendfile = yes

[Share1]
comment = Common Users
path = /usr/data/private/Shared1Files
writeable = yes
admin users = deang
valid users = deang
create mask = 0660
directory mask = 0771

My mount points for the old CentOS 5 server and my newer proxmox 5 server
are  both in the CentOS 6 Samba server fstab:

#centos5server:/usr/data /usr/data nfs
user,rw,auto,exec,retrans=2,rsize=32768,wsize=32768

proxmox5server:/prox2pool01/USERDATA/data /usr/data nfs
rsize=32768,wsize=32768,noatime,auto,rw,exec,nfsvers=3 0 0

What other information would be helpful to add?

Here is thread from 2013. It sounds exactly like the problem I have, but I
tried the suggested fixes and they aren't working for me.

https://www.linuxquestions.org/questions/linux-software-2/samba-4-write-lock-problem-with-ms-word-4175652349/

thanks -- Dean

On Thu, 25 Apr 2019 15:05:36 -0700 (PDT)
Dean Guenther via samba <samba at lists.samba.org> wrote:
> I'm getting "access denied" with one particular samba 4 home
> directory NFS share. But only with Microsoft Word, Excel and
> PowerPoint. If I edit an RTF file in wordpad or notepad and save it
> back to the samba home share it works. But I get "access denied"
if
> I'm using Word. Also, no problems with WordPerfect.
Share an NFS share via Samba has never worked reliably.
> This mount point is on my Samba DC. And Samba resends the shares to
> the Windows clients.
I take it you missed all the warnings about not using a Samba DC as a
fileserver.
> [global]
> workgroup = ABC
> realm = ABC.ORG
> netbios name = SAMBA1
> server role = active directory domain controller
> dns forwarder = 192.168.14.254
> guest ok = yes
Guest access on a DC ?
> security = user
You should remove the line above.
> logon drive = H:
> log file = /var/log/samba/%m.log
> printcap name = /etc/printcap
> 
> [home]
> comment = Home Directories
> path = /usr/data/Users
> writeable = yes
> use sendfile = no
> #oplocks = no
> #posix locking = no
> 
> [public1]
> comment = All Users
> path = /usr/data/public
> writeable = yes
> #guest ok = yes
> admin users = @users
> force group = users
> create mask = 0660
> directory mask = 0771
> browseable = yes
> use sendfile = yes
You shouldn't attempt to use a share on a DC as if it was a share on a
Samba Unix domain member, see here:

https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs

You must follow that for any chance of getting things working correctly.

Rowland