Peter Varkoly
2023-Jan-10 19:02 UTC
[Samba] Multi instance samba problem after updating from 4.15.5 to 4.17.4
Hi,
I have 3 samba instances running on one server: samba AD file and a
printserver instance.
After updating to 4.17.4 I have the problem, that connecting the one
instance with smbclient or from a windows client sometimes the shares of
the other instance will be listed.
The behavior is such that this behavior remains stable for a while, then
changes and the correct shares are delivered again. This is about 1
minunte.
In the logfiles of the instances it is evident that the instances have
read the correct configuration.
Bad state:
# smbclient -L fileserver -U register%XXXXXXXXXX
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
n013-kyocera Printer
n108-lexmark Printer
p001-kyocera Printer
w105-hp Printer
zb-brother Printer
lehrer-ta Printer
IPC$ IPC IPC Service (Samba 4.17.4)
Right state:
# smbclient -L fileserver -U register%XXXXXXXXXX
Sharename Type Comment
--------- ---- -------
groups Disk Shared directories of groups you are
member in.
users Disk All users
all Disk Folder for all
allteachers Disk Folder for all teacher
software Disk Folder for software
IPC$ IPC IPC Service (Samba 4.17.4)
register Disk Home Directories
SMB1 disabled -- no workgroup available
Connecting a specific instance works fine even if the bad shares was
delivered immediately before.
The dns resolution works correct.
Do you have any idea?
Configfile samba-ad instance:
----------------
[global]
netbios name = admin
realm = <DOMAIN.DE>
workgroup = <DOMAIN>
dns forwarder = 172.16.0.5
server role = active directory domain controller
idmap_ldb:use rfc2307 = Yes
check password script =
/usr/share/cranix/tools/check_password_complexity.sh
bind interfaces only = yes
interfaces = 127.0.0.1, 172.16.0.2
ntlm auth = yes
template shell = /bin/bash
ldap server require strong auth = no
hosts deny = 172.16.1.0/24
load printers = no
printcap name = /dev/null
disable spoolss = yes
[sysvol]
path = /var/lib/samba/sysvol
read only = No
browseable = No
[netlogon]
comment = Network logon
path = /var/lib/samba/sysvol/gy-ho.de/scripts
root preexec = /usr/share/cranix/plugins/share_plugin_handler.sh
netlogon open %U %I %a %m gy-ho.de
read only = No
Config file samba file server:
--------------------
[global]
workgroup = <DOMAIN>
realm = <DOMAIN.DE>
netbios name = fileserver
security = ADS
bind interfaces only = yes
interfaces = 172.16.0.1
pid directory = /run/sambafileserver
cache directory = /var/lib/fileserver
lock directory = /var/lib/fileserver/lock
state directory = /var/lib/fileserver
private directory = /var/lib/fileserver/private
log level = 5
wide links = Yes
unix extensions = No
load printers = no
printcap name = /dev/null
disable spoolss = yes
min domain uid = 0
vfs objects = acl_xattr
map acl inherit = yes
store dos attributes = yes
[itool]
comment = Imaging Tool
path = /srv/itool
root preexec = /usr/share/cranix/plugins/share_plugin_handler.sh itool
open %u %I %a %m
inherit permissions = Yes
#valid users = @teachers, @sysadmins, @workstations, root,
Administrator, ossreader
#force group = sysadmins
browseable = no
guest ok = no
writable = yes
strict locking = no
[profiles]
comment = Network profiles
path = /home/profiles/
root preexec = /usr/share/cranix/plugins/share_plugin_handler.sh
profiles open %U %I %a %m gy-ho.de
browseable = No
read only = No
force create mode = 0600
force directory mode = 0700
csc policy = disable
store dos attributes = yes
vfs objects = acl_xattr
[homes]
comment = Home Directories
root preexec = /usr/share/cranix/plugins/share_plugin_handler.sh homes
open %U %I %a %m gy-ho.de
root postexec = /usr/share/cranix/plugins/share_plugin_handler.sh homes
close %U %I %a %m gy-ho.de
veto files = /GROUPS/ALL/
inherit permissions = Yes
browseable = No
printable = No
read only = No
guest ok = No
valid users = %S
[groups]
comment = Shared directories of groups you are member in.
path = /home/groups/LINKED/%U
root preexec = /usr/share/cranix/plugins/share_plugin_handler.sh groups
open %U %I %a %m gy-ho.de
root postexec = /usr/share/cranix/plugins/share_plugin_handler.sh groups
close %U %I %a %m gy-ho.de
veto files = /TEACHERS/
inherit permissions = Yes
browseable = Yes
guest ok = No
printable = No
read only = No
[users]
comment = All users
path = /home
inherit permissions = Yes
browseable = Yes
guest ok = No
printable = No
read only = No
[all]
comment = Folder for all
path = /home/all
inherit permissions = Yes
browseable = Yes
guest ok = No
writable = Yes
[allteachers]
comment = Folder for all teacher
path = /home/groups/TEACHERS
inherit permissions = Yes
browseable = Yes
guest ok = No
writable = Yes
[alladmins]
comment = Folder for administration personal
path = /home/groups/ADMINISTRATION
inherit permissions = Yes
browseable = No
guest ok = No
writable = Yes
[software]
comment = Folder for software
path = /home/software
inherit permissions = Yes
browseable = yes
guest ok = no
writable = yes
[salt-repo]
comment = Folder for Salt Packages
path = /srv/salt/win/repo-ng
inherit permissions = Yes
browseable = no
guest ok = no
writable = yes
#valid users = @sysadmins
Config file samba printserver
-------------------------------------
[global]
workgroup = <DOMAIN>
realm = <DOMAIN.DE>
netbios name = printserver
printing = CUPS
security = ADS
bind interfaces only = yes
interfaces = 172.16.0.4
load printers = no
min domain uid = 0
pid directory = /run/sambaprintserver
cache directory = /var/lib/printserver
lock directory = /var/lib/printserver/lock
state directory = /var/lib/printserver
private directory = /var/lib/printserver/private
rpc_server:spoolss = external
rpc_daemon:spoolssd = fork
vfs objects = acl_xattr
map acl inherit = yes
store dos attributes = yes
log level = 5
[print$]
comment = Printer Drivers
path = /var/lib/printserver/drivers
read only = No
[n013-kyocera]
path = /var/tmp/
printable = yes
printer name = n013-kyocera
hosts allow = 172.16.0.0/24 172.16.3.0/25
[n108-lexmark]
path = /var/tmp/
printable = yes
printer name = n108-lexmark
hosts allow = 172.16.0.0/24 172.16.14.0/26
[p001-kyocera]
path = /var/tmp/
printable = yes
printer name = p001-kyocera
hosts allow = 172.16.0.0/24 172.16.2.128/25
[w105-hp]
path = /var/tmp/
printable = yes
printer name = w105-hp
hosts allow = 172.16.0.0/24 172.16.15.64/26
[zb-brother]
path = /var/tmp/
printable = yes
printer name = zb-brother
hosts allow = 172.16.0.0/24 172.16.2.64/26
[lehrer-ta]
path = /var/tmp/
printable = yes
printer name = lehrer-ta
hosts allow = 172.16.0.0/24 172.16.8.0/22 172.16.3.192/27
Thanks a lot!
Michael Tokarev
2023-Jan-10 20:07 UTC
[Samba] Multi instance samba problem after updating from 4.15.5 to 4.17.4
10.01.2023 22:02, Peter Varkoly via samba wrote:> Hi, > > I have 3 samba instances running on one server: samba AD file and a printserver instance. > After updating to 4.17.4 I have the problem, that connecting the one instance with smbclient or from a windows client sometimes the shares of the > other instance will be listed.I tried running several instances like this, - had to fight with multiple issues, and finally decided to run samba in containers instead. This is possible to do off the same root filesystem (by mounting different /etc/samba/, /var/lib/samba/, /var/cache/samba/ and /var/log/samba/ for each instance). I abused systemd-nspawn for this, but had to fight with it too, as it has quite some checks in place which prevents it from running a container off system root. Apparently it should be possible to do it in one system with multiple IP addresses and a lot of configuration, - it *should* work. Provided nothing wants to use localhost directly (like samba-tool or smbpasswd).> The behavior is such that this behavior remains stable for a while, then changes and the correct shares are delivered again. This is about 1 minunte. > In the logfiles of the instances it is evident that the instances have read the correct configuration.This smells like some cache - which is most often in /run/samba/ - is being used by multiple instances. Or something else is cross-using stuff. If it were me, I'd move regular samba dirs - which are the ones I listed above - into subdirs each for each instance, so there's nothing in there "by default", - any file appearing directly in any of these dirs indicates a misconfiguration. Your AD DC config does not have all the *directory set up, so any misconfig in other instances means that instance will use files by AD DC instance. Plus, a less radical, do an lsof for all the processes running and see if there are some files open which should not be. Thanks, /mjt
Michael Tokarev
2023-Jan-10 20:08 UTC
[Samba] Multi instance samba problem after updating from 4.15.5 to 4.17.4
10.01.2023 22:02, Peter Varkoly via samba wrote:> Hi, > > I have 3 samba instances running on one server: samba AD file and a printserver instance. > After updating to 4.17.4 I have the problem, that connecting the one instance with smbclient or from a windows client sometimes the shares of the > other instance will be listed.BTW, there's no need to run separate instances for print and file services. Only AD-DC needs to be separate, file+print always worked together. /mjt
Michael Tokarev
2023-Jan-10 20:10 UTC
[Samba] Multi instance samba problem after updating from 4.15.5 to 4.17.4
That's a nice reply from the OP mailserver..
<peter at varkoly.de>: host mail.varkoly.de[5.252.225.115] said: 554 5.7.1
<mjt at tls.msk.ru>: Sender address rejected: Go away! (in reply to
RCPT TO command)
Thank you very much :)
/mjt