As of this morning, I can't reach the Samba share on my server. Both from my Windows PC and from my Ubuntu laptop I get an "access denied" message. This share has been working for years without a single modification in the smb.conf file.

I notice that the Samba package has been auto-updated this morning (I use unattended updates on the server). Is anyone else having this problem, or something similar? The current version is 4.1.6+dfsg-1ubuntu2.14.04.11.

These are the relevant lines from smb.conf (yes it is outdated and pretty insecure for production purposes, but the network is well secured from the outside, and I trust my users). I doublechecked but the file is identical to the one in the backup:

[global]
   workgroup = NLDOM
   server string = %h server (Samba, Ubuntu)
   dns proxy = no
   log file = /var/log/samba/log.%m
   log level = 3
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
  security = SHARE
  client lanman auth = yes
   passdb backend = tdbsam
   obey pam restrictions = yes
   guest account = root
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   map to guest = bad user
   load printers = yes
   printing = bsd
   printcap name = /etc/printcap
   socket options = TCP_NODELAY
   usershare allow guests = yes
[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   guest ok = no
   read only = yes
   create mask = 0700
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no
[Hallway]
    path = /
    read only=No
    guest only =Yes
    guest ok = Yes
    available = yes
    browsable = yes
    public = yes
    writable = yes 

Note: The mount command succeeds with no problems (nothing in dmesg), but subsequently opening the share in Nautilus, through the cd command, or in an smbclient session, always fails (NT_STATUS_ACCESS_DENIED).

  • So / is the share accessible and writable by anyone. Why? Is it not a major sharing overkill? – mikewhatever Apr 21 '16 at 14:53
up vote 5 down vote accepted

I found this issue after updating Samba this morning, and I found an answer that worked here:

http://ubuntuforums.org/showthread.php?t=1600541&p=9995179#post9995179

Samba has changed the ability to follow symlinks because of a security issue:

http://www.samba.org/samba/news/symlink_attack.html

To circumvent the change you could try this:

Add the following lines to the [global] section of smb.conf:

follow symlinks = yes  
wide links = yes  
unix extensions = no  

Then restart the samba service:

sudo service smbd restart
  • This worked, thanks! – Jos Jan 6 '16 at 18:03

A similar thing happened to me after an update this morning : smbd version 4.1.6-Ubuntu

I can see the files and folders in the root directory but I can't traverse folders or even edit a file I own in the root directory.

Error is: Acces Denied

For now I have made new shares to my most frequently used subfolders and everything works fine regardless of owner/permission/location

Looks like this only affects the root

smb.conf was not changed and always used to work:

[c$]
   path = /
   valid users = matthew
   read only = no
   guest ok = no
   browseable = yes
  • 1
    Exactly, I should have added that I can see the folders in the share root, but can't navigate any deeper. Considering reporting this as a bug. – Jos Jan 6 '16 at 15:17

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.