samba - Mar 2020 - Errors for shares since 4.12.0

Hi,

I tried samba 4.12.0 on our file server which is a domain member and 
exporting some shares. We're getting some strange errors on some shares 
since the update.

Right after starting or restarting smbd everything is fine. After short 
while (seconds or a few minutes) users are getting errors when trying to 
access the shares, e.q. "Invalid Handle Error", "An unexpected
network
error occurred", "The process cannot access the file because it is
being
used by another process", ... (these are translations of the error 
messages from german, so the original english message can be slightly 
different).

Sometimes the shares are reachable for users after waiting a while but 
sometimes not.

smb.conf:

# Global parameters
[global]
 ??????? bind interfaces only = Yes
 ??????? dedicated keytab file = /etc/krb5.keytab
 ??????? interfaces = lo enp1s0f0
 ??????? kerberos method = secrets and keytab
 ??????? realm = SUBDOM.DOM.EXAMPLE.COM
 ??????? security = ADS
 ??????? server min protocol = SMB3_00
 ??????? template homedir = /home/users/linux/%U
 ??????? template shell = /bin/bash
 ??????? winbind refresh tickets = Yes
 ??????? winbind separator = +
 ??????? workgroup = ILRW
 ??????? idmap config dom : range = 10000-9999999
 ??????? idmap config dom : backend = rid
 ??????? idmap config subdom : range = 3000-9999
 ??????? idmap config subdom : backend = rid
 ??????? idmap config * : range = 2000-2999
 ??????? idmap config * : backend = tdb
 ??????? map acl inherit = Yes
 ??????? vfs objects = acl_xattr

[share1]
 ??????? comment = Share 1
 ??????? create mask = 0740
 ??????? directory mask = 0750
 ??????? force create mode = 0660
 ??????? force directory mode = 0660
 ??????? force group = "SUBDOM+worker"
 ??????? inherit permissions = Yes
 ??????? path = PATHNAME
 ??????? read only = No
 ??????? root preexec = /bin/MK_PAPIERKORB %H "%u" %h %S
 ??????? smb encrypt = desired
 ??????? valid users = +SUBDOM+worker
 ??????? vfs objects = recycle crossrename
 ??????? recycle:exclude_dir = tmp | temp | cache
 ??????? recycle:exclude = *.TMP | *.tmp | ~$*.doc
 ??????? recycle:noversions = *.ini | *.dat
 ??????? recycle:versions = Yes
 ??????? recycle:maxsize = 536870912
 ??????? recycle:touch = Yes
 ??????? recycle:keeptree = Yes
 ??????? recycle:directory_mode = 0700
 ??????? recycle:repository = %H/.Papierkorb/%S

[share2]
 ??????? comment = Share 2
 ??????? inherit acls = Yes
 ??????? path = PATHNAME
 ??????? read only = No
 ??????? smb encrypt = desired
 ??????? valid users = +SUBDOM+worker +SUBDOM+user
 ??????? acl_xattr:ignore system acls = yes

[share3]
 ??????? comment = Share 3
 ??????? create mask = 0660
 ??????? directory mask = 0770
 ??????? force create mode = 0660
 ??????? force directory mode = 0770
 ??????? force group = "SUBDOM+group2"
 ??????? path = PATHNAME
 ??????? read only = No
 ??????? root preexec = /bin/MK_PAPIERKORB %H "%u" %h %S
 ??????? smb encrypt = desired
 ??????? valid users = +SUBDOM+group2
 ??????? vfs objects = recycle crossrename
 ??????? recycle:exclude_dir = tmp | temp | cache
 ??????? recycle:exclude = *.TMP | *.tmp | ~$*.doc
 ??????? recycle:noversions = *.ini | *.dat
 ??????? recycle:versions = Yes
 ??????? recycle:maxsize = 536870912
 ??????? recycle:touch = Yes
 ??????? recycle:keeptree = Yes
 ??????? recycle:directory_mode = 0700
 ??????? recycle:repository = %H/.Papierkorb/%S

[share4]
 ??????? comment = Share 4
 ??????? path = PATHNAME
 ??????? smb encrypt = desired
 ??????? valid users = +SUBDOM+group2 +SUBDOM+group3 +SUBDOM+group4

Regards,
Andreas

> [global]
>         (...)
>        vfs objects = acl_xattr
>
> [share1]
>          (...)
>         vfs objects = recycle crossrename
>
> [share2]
>          comment = Share 2
>          inherit acls = Yes
>          path = PATHNAME
>          read only = No
>          smb encrypt = desired
>          valid users = +SUBDOM+worker +SUBDOM+user
>          acl_xattr:ignore system acls = yes
> [share3]
>          (...)
>          vfs objects = recycle crossrename


I don't know if this will solve your problem, but your smb.conf has some
problems:

In [share 1] and [share 3], by specifying additional vfs modules, you are
overriding the "acl_xattr" in the [global] section and disabling it
for those shares. You must explicitly declare it for the shares using additional
vfs modules, like this:

         vfs objects = recycle crossrename acl_xattr

On 09/03/2020 14:25, Andreas Hauffe via samba wrote:
> [global]
> ??????? dedicated keytab file = /etc/krb5.keytab
> ??????? kerberos method = secrets and keytab
Why the dedicated keytab ?
> workgroup = ILRW
> ??????? idmap config dom : range = 10000-9999999
> ??????? idmap config dom : backend = rid
> ??????? idmap config subdom : range = 3000-9999
> ??????? idmap config subdom : backend = rid
I take it that either 'dom' or subdom' is really 'ILRW', if
not why not ?

Rowland

Hi

Am 09.03.20 um 16:32 schrieb Rowland penny via samba:
> On 09/03/2020 14:25, Andreas Hauffe via samba wrote:
>> [global]
>> ??????? dedicated keytab file = /etc/krb5.keytab
>> ??????? kerberos method = secrets and keytab
> Why the dedicated keytab ?
We have a kerberized NFS4 running on that machine, too.
>
>> workgroup = ILRW
>> ??????? idmap config dom : range = 10000-9999999
>> ??????? idmap config dom : backend = rid
>> ??????? idmap config subdom : range = 3000-9999
>> ??????? idmap config subdom : backend = rid
>
> I take it that either 'dom' or subdom' is really
'ILRW', if not why not ?
This was an error during anonymization of the smb.conf. So "workgroup = 
SUBDOM" is the correct smb.conf entry in this case.
>
> Rowland
>
>
>
Andreas

Thanks for the hint, but this did not solve our problem.

Am 09.03.20 um 16:20 schrieb miguel medalha via samba:
>> [global]
>>          (...)
>>         vfs objects = acl_xattr
>>
>> [share1]
>>           (...)
>>          vfs objects = recycle crossrename
>>
>> [share2]
>>           comment = Share 2
>>           inherit acls = Yes
>>           path = PATHNAME
>>           read only = No
>>           smb encrypt = desired
>>           valid users = +SUBDOM+worker +SUBDOM+user
>>           acl_xattr:ignore system acls = yes
>> [share3]
>>           (...)
>>           vfs objects = recycle crossrename
>
>
> I don't know if this will solve your problem, but your smb.conf has
some problems:
>
> In [share 1] and [share 3], by specifying additional vfs modules, you are
overriding the "acl_xattr" in the [global] section and disabling it
for those shares. You must explicitly declare it for the shares using additional
vfs modules, like this:
>
>           vfs objects = recycle crossrename acl_xattr
>
>
>
Regards,
Andreas