1

I have problems with a newly migrated BDC (2:4.1.6+dfsg-1ubuntu2.14.04.9) with POSIX ACL based permissions. I am unable to get it to work as the PDC, which fortunately still has a slightly older version (2:4.1.6+dfsg-1ubuntu2.14.04.7).

PDC work flawlessly with the following set of permissions. The scheme is very basic but allows user of the group "Accounting" in the examples to share files and folders...

 # file: accounting
 # owner: root
 # group: root
 user::rwx
 group::r-x
 group:Accounting:rwx
 mask::rwx
 other::---
 default:user::rwx
 default:group::---
 default:group:Accounting:rwx
 default:mask::rwx
 default:other::---

Anything that I may be missing? The only way I could get user allowed to create directory in the share is by exposing "other" permissions, which obviously is not desired. I am in the process of trying Windows ACL using acl_xattr, but so far I have not been able to achieve the same as with POSIX ACL.

Both smb.conf on PDC and BDC are identical, except for server role of course and WINS server on PDC. Share definitions are as per below.

[accounting]
   path = /srv/samba/accounting
   writable = yes
   nt acl support = yes

What is really really crazy is that after a fresh setup of such share for testing and a service restart or reboot, everything seems to work with access via \\BDC\share. However, after a while it breaks and no more access to folder is allowed (Win7, Win10 and WinXP). Under WinXP access is possible with \\bdc.domain.tld\share for one instance and then stops. Under WinXP too it is subsequently allowed to access via \\<BDC_IP_ADDRESS>\share...

Error log follows below for a test share.

Many thanks in advance for any hint.

--

  [2015/10/03 17:38:21.624058,  3] ../source3/smbd/process.c:1795(process_smb)
    Transaction 255 of length 90 (0 toread)
  [2015/10/03 17:38:21.624238,  3] ../source3/smbd/process.c:1398(switch_message)
    switch message SMBntcreateX (pid 19932) conn 0x7fb256620060
  [2015/10/03 17:38:21.624382,  3] ../source3/smbd/service.c:197(set_current_service)
    chdir (/srv/samba/posix_acl) failed, reason: Permission denied
  [2015/10/03 17:38:21.624469,  3] ../source3/smbd/error.c:82(error_packet_set)
    NT error packet at ../source3/smbd/process.c(1517) cmd=162 (SMBntcreateX) NT_STATUS_ACCESS_DENIED
  [2015/10/03 17:38:25.186401,  3] ../source3/smbd/process.c:1795(process_smb)
    Transaction 256 of length 80 (0 toread)
  [2015/10/03 17:38:25.186586,  3] ../source3/smbd/process.c:1398(switch_message)
    switch message SMBtrans2 (pid 19932) conn 0x7fb256620060
  [2015/10/03 17:38:25.186679,  3] ../source3/smbd/service.c:197(set_current_service)
    chdir (/srv/samba/posix_acl) failed, reason: Permission denied
  [2015/10/03 17:38:25.186758,  3] ../source3/smbd/error.c:82(error_packet_set)
    NT error packet at ../source3/smbd/process.c(1517) cmd=50 (SMBtrans2) NT_STATUS_ACCESS_DENIED
  [2015/10/03 17:38:25.277631,  3] ../source3/smbd/process.c:1795(process_smb)
    Transaction 257 of length 114 (0 toread)
  [2015/10/03 17:38:25.277782,  3] ../source3/smbd/process.c:1398(switch_message)
    switch message SMBntcreateX (pid 19932) conn 0x7fb256620060
  [2015/10/03 17:38:25.277911,  3] ../source3/smbd/service.c:197(set_current_service)
    chdir (/srv/samba/posix_acl) failed, reason: Permission denied
  [2015/10/03 17:38:25.277989,  3] ../source3/smbd/error.c:82(error_packet_set)
    NT error packet at ../source3/smbd/process.c(1517) cmd=162 (SMBntcreateX) NT_STATUS_ACCESS_DENIED
  [2015/10/03 17:38:25.278256,  3] ../source3/smbd/process.c:1795(process_smb)
    Transaction 258 of length 80 (0 toread)
  [2015/10/03 17:38:25.278356,  3] ../source3/smbd/process.c:1398(switch_message)
    switch message SMBtrans2 (pid 19932) conn 0x7fb256620060
  [2015/10/03 17:38:25.278436,  3] ../source3/smbd/service.c:197(set_current_service)
    chdir (/srv/samba/posix_acl) failed, reason: Permission denied
  [2015/10/03 17:38:25.278507,  3] ../source3/smbd/error.c:82(error_packet_set)
    NT error packet at ../source3/smbd/process.c(1517) cmd=50 (SMBtrans2) NT_STATUS_ACCESS_DENIED
  [2015/10/03 17:38:25.282395,  3] ../source3/smbd/process.c:1795(process_smb)
    Transaction 259 of length 114 (0 toread)
  [2015/10/03 17:38:25.282526,  3] ../source3/smbd/process.c:1398(switch_message)
    switch message SMBntcreateX (pid 19932) conn 0x7fb256620060
  [2015/10/03 17:38:25.282610,  3] ../source3/smbd/service.c:197(set_current_service)
    chdir (/srv/samba/posix_acl) failed, reason: Permission denied
  [2015/10/03 17:38:25.282683,  3] ../source3/smbd/error.c:82(error_packet_set)
    NT error packet at ../source3/smbd/process.c(1517) cmd=162 (SMBntcreateX) NT_STATUS_ACCESS_DENIED
  [2015/10/03 17:38:25.284720,  3] ../source3/smbd/process.c:1795(process_smb)
    Transaction 260 of length 90 (0 toread)
  [2015/10/03 17:38:25.284848,  3] ../source3/smbd/process.c:1398(switch_message)
   switch message SMBntcreateX (pid 19932) conn 0x7fb256620060
  [2015/10/03 17:38:25.284932,  3] ../source3/smbd/service.c:197(set_current_service)
   chdir (/srv/samba/posix_acl) failed, reason: Permission denied
  [2015/10/03 17:38:25.285005,  3] ../source3/smbd/error.c:82(error_packet_set)
   NT error packet at ../source3/smbd/process.c(1517) cmd=162 (SMBntcreateX) NT_STATUS_ACCESS_DENIED
  [2015/10/03 17:38:25.288082,  3] ../source3/smbd/process.c:1795(process_smb)
   Transaction 261 of length 90 (0 toread)
  [2015/10/03 17:38:25.288233,  3] ../source3/smbd/process.c:1398(switch_message)
   switch message SMBntcreateX (pid 19932) conn 0x7fb256620060
  [2015/10/03 17:38:25.288386,  3] ../source3/smbd/service.c:197(set_current_service)
   chdir (/srv/samba/posix_acl) failed, reason: Permission denied
  [2015/10/03 17:38:25.288468,  3] ../source3/smbd/error.c:82(error_packet_set)
   NT error packet at ../source3/smbd/process.c(1517) cmd=162 (SMBntcreateX) NT_STATUS_ACCESS_DENIED
  [2015/10/03 17:38:25.290447,  3] ../source3/smbd/process.c:1795(process_smb)
   Transaction 262 of length 80 (0 toread)
  [2015/10/03 17:38:25.290578,  3] ../source3/smbd/process.c:1398(switch_message)
   switch message SMBtrans2 (pid 19932) conn 0x7fb256620060
  [2015/10/03 17:38:25.290663,  3] ../source3/smbd/service.c:197(set_current_service)
   chdir (/srv/samba/posix_acl) failed, reason: Permission denied
  [2015/10/03 17:38:25.290736,  3] ../source3/smbd/error.c:82(error_packet_set)
   NT error packet at ../source3/smbd/process.c(1517) cmd=50 (SMBtrans2) NT_STATUS_ACCESS_DENIED
0

I found the solution to the problem...

Looking at the logs in /var/log/samba I could see a winbind log, which should not be there. Checking I could see wbinfo -u was returning a user list and further checking, I could see active winbind processes. Stopping the winbind service restored the situation to normal.

So removing the package with sudo apt-get remove winbind and rebooting was the final solution.

For information, the test share with Windows ACL seems to work too with the sam type of permissions set on the share. So both Posix ACL and Windows ACL work.

For information below the config used for the latter (not sure the second part of Windows ACL are needed to have the basics but seem to work in my case, I will further investigate when I have time).

[windows_acl]
   path = /srv/samba/windows_acl
   read only = no

   ; Windows ACL
   vfs objects = acl_xattr
   map acl inherit = yes
   store dos attributes = yes

   inherit acls = yes
   inherit permissions = yes
   acl group control = yes
   acl map full control = true
   nt acl support = yes
   ea support = yes

I hope this can help anybody confronted with similar situation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.