Hello everybody. Here is my problem. I have two computers, both with fedora workstation 27, both with selinux disabled, both fully updated. Both have the same configuration of samba: [global] workgroup = WORKGROUP security = user
passdb backend = tdbsam
printing = cups printcap name = cups load printers = yes cups options = raw usershare max shares = 5 usershare allow guests = yes guest ok = yes Map to guest = Bad user
[homes] comment = Home Directories valid users = %S, %D%w%S browseable = No read only = No inherit acls = Yes
[printers] comment = All Printers path = /var/tmp printable = Yes create mask = 0600 browseable = No
[print$] comment = Printer Drivers path = /var/lib/samba/drivers write list = @printadmin root force group = @printadmin create mask = 0664 directory mask = 0775
as you can see, everything i changed from default config is this strings: usershare max shares = 5 usershare allow guests = yes guest ok = yes Map to guest = Bad user
Both computers have directories /var/lib/samba/usershares with sticky bit enabled. On both machines i have created usershares this way: net usershare add Share /home/kasak/Share "" Everyone:F guest_ok=y
As you can see this is simple configuration, nothing special. /home/kasak/Share owned by kasak, but have 777 permissions, so user "nobody" can write there. But on one machine everything works just fine, but on another machine i only can create dirs or files in the root of the "Share". For example, if I create directory foo, cd to there, and try to create directory bar, samba sais that I don't have permissions! And on another machine it works just fine! With all the same configs! I even can delete the foo directory, but i can't create files there! The only difference between computers is that on one I have full disk formatted and mounted as root, and on another i have /home partition separately. But they all are formatted to ext4 and have similar mount options (defaults)
Given how open you have this set up I must ask if you have any windows machines on this network that need to communicate with your two systems. If not then some headache reduction may be found in using Linux native file share such as nfs or sshfs. Just a thought.
-- Fred
Hello Fred. Of course i know about nfs and sshfs. I even know about dav, included in gnome settings, but i have some another machines and it is more comfortable to me, to use samba
Why is there no path = statement for [homes]?
Compare the output of 'testparm' from both machines.
After creating the 'foo' directory on both machines, compare the permissions of the two directories 'ls -l'.
Bill
On 2/12/2018 1:16 PM, Илья Коскин wrote:
Hello everybody. Here is my problem. I have two computers, both with fedora workstation 27, both with selinux disabled, both fully updated. Both have the same configuration of samba: [global] workgroup = WORKGROUP security = user
passdb backend = tdbsam
printing = cups printcap name = cups load printers = yes cups options = raw usershare max shares = 5 usershare allow guests = yes guest ok = yes Map to guest = Bad user
[homes] comment = Home Directories valid users = %S, %D%w%S browseable = No read only = No inherit acls = Yes
[printers] comment = All Printers path = /var/tmp printable = Yes create mask = 0600 browseable = No
[print$] comment = Printer Drivers path = /var/lib/samba/drivers write list = @printadmin root force group = @printadmin create mask = 0664 directory mask = 0775
as you can see, everything i changed from default config is this strings: usershare max shares = 5 usershare allow guests = yes guest ok = yes Map to guest = Bad user
Both computers have directories /var/lib/samba/usershares with sticky bit enabled. On both machines i have created usershares this way: net usershare add Share /home/kasak/Share "" Everyone:F guest_ok=y
As you can see this is simple configuration, nothing special. /home/kasak/Share owned by kasak, but have 777 permissions, so user "nobody" can write there. But on one machine everything works just fine, but on another machine i only can create dirs or files in the root of the "Share". For example, if I create directory foo, cd to there, and try to create directory bar, samba sais that I don't have permissions! And on another machine it works just fine! With all the same configs! I even can delete the foo directory, but i can't create files there! The only difference between computers is that on one I have full disk formatted and mounted as root, and on another i have /home partition separately. But they all are formatted to ext4 and have similar mount options (defaults) _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-leave@lists.fedoraproject.org
if that was that simple, I would not write to this list. I have already diff'ed the output of testparm -v and the only difference is "hostname". I don't think that hostname is the problem. Here is magic: [kasak@kasakoff ~]$ smbclient \\kasakoff\Shared Enter SAMBA\kasak's password: Try "help" to get a list of possible commands. smb: > dir . D 0 Tue Feb 13 08:33:45 2018 .. D 0 Tue Feb 13 08:33:45 2018
663126024 blocks of size 1024. 595790936 blocks available smb: > mkdir foo smb: > dir . D 0 Tue Feb 13 08:35:02 2018 .. D 0 Tue Feb 13 08:33:45 2018 foo D 0 Tue Feb 13 08:35:02 2018
663126024 blocks of size 1024. 595790932 blocks available smb: > cd foo\ smb: \foo> mkdir bar NT_STATUS_ACCESS_DENIED making remote directory \foo\bar
And here is ls: [kasak@kasakoff Shared]$ ls -al итого 12 drwxr-xrwx 3 kasak kasak 4096 фев 13 08:35 . drwx-----x 22 kasak kasak 4096 фев 13 08:33 .. drwxr-xr-x 2 nobody nobody 4096 фев 13 08:35 foo
On another machine everything is the same, but it works!
List the [homes] section of testparm. You didn't answer my question about the missing path = statement.
You logged in as kasak but the ownership of the created directory is nobody:nobody. I don't see how that could happen unless you're using a 'force user' and 'force group'.
While still connected with smbclient, in another terminal run 'smbstatus' to see what userid is connected.
Bill
On 2/13/2018 12:41 AM, Илья Коскин wrote:
if that was that simple, I would not write to this list. I have already diff'ed the output of testparm -v and the only difference is "hostname". I don't think that hostname is the problem. Here is magic: [kasak@kasakoff ~]$ smbclient \\kasakoff\Shared Enter SAMBA\kasak's password: Try "help" to get a list of possible commands. smb: > dir . D 0 Tue Feb 13 08:33:45 2018 .. D 0 Tue Feb 13 08:33:45 2018
663126024 blocks of size 1024. 595790936 blocks available
smb: > mkdir foo smb: > dir . D 0 Tue Feb 13 08:35:02 2018 .. D 0 Tue Feb 13 08:33:45 2018 foo D 0 Tue Feb 13 08:35:02 2018
663126024 blocks of size 1024. 595790932 blocks available
smb: > cd foo\ smb: \foo> mkdir bar NT_STATUS_ACCESS_DENIED making remote directory \foo\bar
And here is ls: [kasak@kasakoff Shared]$ ls -al итого 12 drwxr-xrwx 3 kasak kasak 4096 фев 13 08:35 . drwx-----x 22 kasak kasak 4096 фев 13 08:33 .. drwxr-xr-x 2 nobody nobody 4096 фев 13 08:35 foo
On another machine everything is the same, but it works! _______________________________________________ users mailing list --users@lists.fedoraproject.org To unsubscribe send an email tousers-leave@lists.fedoraproject.org
path statement should not be specified in [homes] section, this is samba built in section, to dynamically share user home directories.
I am not logged in as kasak, samba users is not the same as system users. To login as kasak, first I need to add kasak to samba with smbpasswd -a kasak, or samba-tool user add kasak. But I have not added kasak to samba, so when smbclient tries to login as kasak it doesn't find it and falls back to guest (unix nobody) account, because i have option "Map to guest=Bad user" in my config.
Look: [kasak@kasakoff ~]$ smbclient \\kasakoff\Share Enter WORKGROUP\kasak's password: Try "help" to get a list of possible commands. smb: > ^Z [1]+ Остановлен smbclient \\kasakoff\Share <<<<<<< ctrl+z
[kasak@kasakoff ~]$ sudo smbstatus [sudo] пароль для kasak:
Samba version 4.7.5 PID Username Group Machine Protocol Version Encryption Signing ---------------------------------------------------------------------------------------------------------------------------------------- 8027 nobody nobody 192.168.2.87 (ipv4:192.168.2.87:12209) SMB2_10 - - 8001 nobody nobody 192.168.3.251 (ipv4:192.168.3.251:36734) SMB3_11 - - <<< my ip
Service pid Machine Connected at Encryption Signing --------------------------------------------------------------------------------------------- IPC$ 8027 192.168.2.87 Вт фев 13 12:07:01 2018 MSK - - Share 8001 192.168.3.251 Вт фев 13 12:06:46 2018 MSK - -
No locked files
On Tue, 2018-02-13 at 09:08 +0000, Илья Коскин wrote:
path statement should not be specified in [homes] section, this is samba built in section, to dynamically share user home directories.
I am not logged in as kasak, samba users is not the same as system users. To login as kasak, first I need to add kasak to samba with smbpasswd -a kasak, or samba-tool user add kasak. But I have not added kasak to samba, so when smbclient tries to login as kasak it doesn't find it and falls back to guest (unix nobody) account, because i have option "Map to guest=Bad user" in my config.
Look: [kasak@kasakoff ~]$ smbclient \\kasakoff\Share Enter WORKGROUP\kasak's password: Try "help" to get a list of possible commands. smb: > ^Z [1]+ Остановлен smbclient \\kasakoff\Share <<<<<<< ctrl+z
[kasak@kasakoff ~]$ sudo smbstatus [sudo] пароль для kasak:
Samba version 4.7.5 PID Username Group Machine Protocol Version Encryption Signing
8027 nobody nobody 192.168.2.87 (ipv4:192.168.2.87:12209) SMB2_10 - - 8001 nobody nobody 192.168.3.251 (ipv4:192.168.3.251:36734) SMB3_11 - - <<< my ip
Service pid Machine Connected at Encryption Signing
IPC$ 8027 192.168.2.87 Вт фев 13 12:07:01 2018 MSK - - Share 8001 192.168.3.251 Вт фев 13 12:06:46 2018 MSK - -
No locked files _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-leave@lists.fedoraproject.org
Does running smbd in a terminal tell you more? systemctl stop smbd.service smbd -F -S -d 2
Had to do this yesterday - it helped me fix a problem
unfortunately it did not helped :( only show me this:
open_directory: unable to create Новая папка/Новая папка. Error was NT_STATUS_ACCESS_DENIED
d'oh :(
I use a path statement in my [homes] section: [homes] comment = Home Directories path = /home/%u/windows browseable = no valid users = %S writable = yes guest ok = no directory mask = 2770 create mask = 660 Just an FYI.
You created the share with: net usershare add Share /home/kasak/Share "" Everyone:F guest_ok=y and after creating the foo directory, you list as:
And here is ls: [kasak@kasakoff Shared]$ ls -al итого 12 drwxr-xrwx 3 kasak kasak 4096 фев 13 08:35 . drwx-----x 22 kasak kasak 4096 фев 13 08:33 .. drwxr-xr-x 2 nobody nobody 4096 фев 13 08:35 foo
Note "Share" != "Shared". What is the full path to foo?
Bill
On 2/13/2018 4:08 AM, Илья Коскин wrote:
path statement should not be specified in [homes] section, this is samba built in section, to dynamically share user home directories.
I am not logged in as kasak, samba users is not the same as system users. To login as kasak, first I need to add kasak to samba with smbpasswd -a kasak, or samba-tool user add kasak. But I have not added kasak to samba, so when smbclient tries to login as kasak it doesn't find it and falls back to guest (unix nobody) account, because i have option "Map to guest=Bad user" in my config.
Look: [kasak@kasakoff ~]$ smbclient \\kasakoff\Share Enter WORKGROUP\kasak's password: Try "help" to get a list of possible commands. smb: > ^Z [1]+ Остановлен smbclient \\kasakoff\Share <<<<<<< ctrl+z
[kasak@kasakoff ~]$ sudo smbstatus [sudo] пароль для kasak:
Samba version 4.7.5 PID Username Group Machine Protocol Version Encryption Signing
8027 nobody nobody 192.168.2.87 (ipv4:192.168.2.87:12209) SMB2_10 - - 8001 nobody nobody 192.168.3.251 (ipv4:192.168.3.251:36734) SMB3_11 - - <<< my ip
Service pid Machine Connected at Encryption Signing
IPC$ 8027 192.168.2.87 Вт фев 13 12:07:01 2018 MSK - - Share 8001 192.168.3.251 Вт фев 13 12:06:46 2018 MSK - -
No locked files _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-leave@lists.fedoraproject.org
i'm not just standing on one point, writing to lists, i already tried to create new shares with another names, tried another directories, even tryed to create not usershare, but smb.conf share: [Shared] path = /home/kasak/Shared guest ok = yes guest only = yes writable = yes
so this is not a typo, this is another my attempt to fix anything, and it just doesn't work.
On 13 February 2018 07:16:02 CET, Bill Shirley bshirley@memphis.apirx.biz wrote:
List the [homes] section of testparm. You didn't answer my question about the missing path = statement.
I wouldn't expect to see a paths section For [homes] it would map to the home directory of the unix user logging in to samba. -- Junk
On Mon, Feb 12, 2018 at 10:16 AM, Илья Коскин kasakoff87@gmail.com wrote:
Hello everybody. Here is my problem. I have two computers, both with fedora workstation 27, both with selinux disabled, both fully updated. Both have the same configuration of samba: [global] usershare max shares = 5 usershare allow guests = yes
The "net" man page indicates that "usershare path" should be set here.
Both computers have directories /var/lib/samba/usershares with sticky bit enabled.
Please include the output of "getfacl /var/lib/samba/usershares"
But on one machine everything works just fine, but on another machine i only can create dirs or files in the root of the "Share". For example, if I create directory foo, cd to there, and try to create directory bar, samba sais that I don't have permissions! And on another machine it works just fine!
Please include the output of "getfacl /home/kasak/Share/foo"
This is unbelievable! For I coundn't create usershare as i needed, I made a share through smb.conf, that was "guest only" and "force user", and it worked. And after I saw your message, I decided to try again and check all the permissions and acls. I have created new usershare and it is working! I created another and again it is working!!! I have not changed anything! What was that??? Unbelievable!!!
Anyway, sorry for the noise. Maybe that was bad moon phase or some poltergeist, i'm happy that finally it works.