samba - May 2020 - Intermittent permission denied when accessing share

> You missed that using a DC as a fileserver isn't recommended.
It was between the lines of "I followed all the guidelines for doing things
correctly in this specific situation" :)
> From reading the samba log, it looks like Samba logons are not working,
> but ldap connections are.
This means Win clients are logging in via LDAP?
Can this be related to the inaccessible shares problem?
>> [homes]
>>          path = /home/CONDIVISI/personali
> No, you do not use 'path =' with '[homes]', change
'[homes]' to '[home]'
How will it work then? I cannot find a documentation page on the wiki about
[home].
thanks
> You say that you ran a workgroup, did your clients leave the workgroup
> before joining the domain ?
I was mistaken, it was a NT4 domain.
But yes we moved the clients from the old to the new domain using Forensit
Migration Tool


While doing other maintenance I found krb5-kdc system service being in error.
Trying to start throws:
Cannot open DB2 database '/etc/krb5kdc/principal': No such file or
directory - while initializing database for realm WDC.MYDOMAIN.IT

Is this a problem? During installation I don't recall any reference to this
service, and /etc/krb5.conf doesn't mention this path.

thanks
-- 
Lorenzo Milesi - lorenzo.milesi at yetopen.it

YetOpen S.r.l. - https://www.yetopen.it/
Via Salerno 18 - 23900 Lecco - ITALY -
Tel +39 0341 220 205 - Fax +39 178 6070 222

Think green - Non stampare questa e-mail se non necessario / Don't print
this email unless necessary

-------- D.Lgs. 196/2003 e GDPR 679/2016 --------
Tutte le informazioni contenute in questo messaggio sono riservate ed a uso
esclusivo del destinatario.
Tutte le informazioni ivi contenute, compresi eventuali allegati, sono da
ritenere confidenziali e riservate secondo i termini
del vigente D.Lgs. 196/2003 in materia di privacy e del Regolamento europeo
679/2016 - GDPR - e quindi ne e' proibita l'utilizzazione ulteriore non
autorizzata.
Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad
eliminarlo senza copiarlo, stamparlo, a non inoltrarlo a terzi e ad avvertirci
non appena possibile.
Grazie.

Confidentiality notice: this email message including any attachment is for the
sole use of the intended recipient and may contain confidential and privileged
information;
pursuant to Legislative Decree 196/2003 and the European General Data Protection
Regulation 679/2016 - GDPR - any unauthorized review, use, disclosure or
distribution
is prohibited. If you are not the intended recepient please delete this message
without copying, printing or forwarding it to others, and alert us as soon as
possible.
Thank you.

On 18/05/2020 14:42, Lorenzo Milesi wrote:
> This means Win clients are logging in via LDAP?
> Can this be related to the inaccessible shares problem?
Not sure, but that is the way it looks, just a thought, are you using 
sssd ?
>>> [homes]
>>>           path = /home/CONDIVISI/personali
>> No, you do not use 'path =' with '[homes]', change
'[homes]' to '[home]'
> How will it work then? I cannot find a documentation page on the wiki about
[home].
> thanks
Just like a normal share, '[homes]' is a special share that doesn't
use
'path. There used to be something on the wiki about using '[home]'
on a
DC, I didn't know it had gone until you mentioned it
;-)
> I was mistaken, it was a NT4 domain.
> But yes we moved the clients from the old to the new domain using Forensit
Migration Tool
How did you create the domain ?
> While doing other maintenance I found krb5-kdc system service being in
error. Trying to start throws:
> Cannot open DB2 database '/etc/krb5kdc/principal': No such file or
directory - while initializing database for realm WDC.MYDOMAIN.IT
Oh Dear, you seem to have a kerberos server running on your Samba AD DC, 
no sorry, make that two kerberos servers.

That is unless your OS is Fedora and you are using the distro packages 
and you missed the 'experimental' warning.
> Is this a problem?
Oh yes
>   During installation I don't recall any reference to this service, and
/etc/krb5.conf doesn't mention this path.
It wont.

Rowland

> Not sure, but that is the way it looks, just a thought, are you using
> sssd ?
no, not even installed
> Just like a normal share, '[homes]' is a special share that
doesn't use
> 'path. There used to be something on the wiki about using
'[home]' on a
> DC, I didn't know it had gone until you mentioned it ;-)
So if I use [home] it would be a normal share, to limit access to single
user's "home" I have to follow this [1].
> How did you create the domain ?
Following the guide [2]
samba-tool domain provision --server-role=dc --use-rfc2307
--dns-backend=BIND9_DLZ --realm=WDC.MYDOMAIN.IT --domain=WDC --adminpass=passwor
> Oh Dear, you seem to have a kerberos server running on your Samba AD DC,
> no sorry, make that two kerberos servers.
Well, it's NOT running.
Anyway I didn't install it on purpose, if it's there it came as a
dependency of something else (Ubuntu.
> That is unless your OS is Fedora and you are using the distro packages
> and you missed the 'experimental' warning.
Which warning are you referring to? This [3]?
Any hint on how to recover?


As it's becoming urgent, what could be the most probable culprit of the
inaccessible shares problem?
Thanks again


[1]?https://wiki.samba.org/index.php/User_Home_Folders#Using_Active_Directory_Users_and_Computers
[2]
https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller#Provisioning_a_Samba_Active_Directory
[3]?https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller#Introduction

-- 
Lorenzo Milesi - lorenzo.milesi at yetopen.it

YetOpen S.r.l. - https://www.yetopen.it/
Via Salerno 18 - 23900 Lecco - ITALY -
Tel +39 0341 220 205 - Fax +39 178 6070 222

Think green - Non stampare questa e-mail se non necessario / Don't print
this email unless necessary

-------- D.Lgs. 196/2003 e GDPR 679/2016 --------
Tutte le informazioni contenute in questo messaggio sono riservate ed a uso
esclusivo del destinatario.
Tutte le informazioni ivi contenute, compresi eventuali allegati, sono da
ritenere confidenziali e riservate secondo i termini
del vigente D.Lgs. 196/2003 in materia di privacy e del Regolamento europeo
679/2016 - GDPR - e quindi ne e' proibita l'utilizzazione ulteriore non
autorizzata.
Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad
eliminarlo senza copiarlo, stamparlo, a non inoltrarlo a terzi e ad avvertirci
non appena possibile.
Grazie.

Confidentiality notice: this email message including any attachment is for the
sole use of the intended recipient and may contain confidential and privileged
information;
pursuant to Legislative Decree 196/2003 and the European General Data Protection
Regulation 679/2016 - GDPR - any unauthorized review, use, disclosure or
distribution
is prohibited. If you are not the intended recepient please delete this message
without copying, printing or forwarding it to others, and alert us as soon as
possible.
Thank you.