SMB share suddenly denies access - need help troubleshooting [SOLVED]

dkd6 · 2019-06-08 14:32:52

Hello,
I've been running Arch for a while, and never had any issues until now.
I am running an SMB share to a Btrfs disk which worked perfectly until now - it suddenly starts asking for a password again, and even after I've provided the correct one it still denies access.
I've tried troubleshooting - opening up permissions, recreating from scratch, accessing from several different computers, but I just can't figure it out.
I could not find anything wrong in the log, and testparm spews no errors - and the only thing I've changed since I had it working was migrating from Cinnamon to KDE - and I don't see how that could have anything to do with it.
I could really use your help resolving this.
Thank you in advance!

Here is my smb.conf file:

#======================= Global Settings =====================================
[global]

follow symlinks = yes
wide links = yes
unix extensions = no
obey pam restrictions = no
# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
   workgroup = WORKGROUP

# server string is the equivalent of the NT Description field
#   server string = Samba Server

# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller".
#
# Most people will want "standalone server" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
#   server role = standalone server

# This option is important for security. It allows you to restrict
# connections to machines which are on your local network. The
# following example restricts access to two C class networks and
# the "loopback" interface. For more examples of the syntax see
# the smb.conf man page
;   hosts allow = 192.168.1. 192.168.2. 127.

# Uncomment this if you want a guest account, you must add this to /etc/passwd
# otherwise the user "nobody" is used
;  guest account = pcguest

# this tells Samba to use a separate log file for each machine
# that connects
   log file = /var/log/samba/%m.log
# Put a capping on the size of the log files (in Kb).
   max log size = 50
# Specifies the Kerberos or Active Directory realm the host is part of
;   realm = MY_REALM

# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
;   passdb backend = tdbsam

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting.
# Note: Consider carefully the location in the configuration file of
#       this line.  The included file is read at that point.
;   include = /usr/local/samba/lib/smb.conf.%m

# Configure Samba to use multiple interfaces
# If you have multiple network interfaces then you must list them
# here. See the man page for details.
;   interfaces = 192.168.12.2/24 192.168.13.2/24

# Where to store roving profiles (only for Win95 and WinNT)
#        %L substitutes for this servers netbios name, %U is username
#        You must uncomment the [Profiles] share below
;   logon path = \\%L\Profiles\%U

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
;   wins support = yes

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
#       Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
;   wins server = w.x.y.z

# WINS Proxy - Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one  WINS Server on the network. The default is NO.
;   wins proxy = yes

# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups. The default is NO.
   dns proxy = no

# These scripts are used on a domain controller or stand-alone
# machine to add or delete corresponding unix accounts
;  add user script = /usr/sbin/useradd %u
;  add group script = /usr/sbin/groupadd %g
;  add machine script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %u
;  delete user script = /usr/sbin/userdel %u
;  delete user from group script = /usr/sbin/deluser %u %g
;  delete group script = /usr/sbin/groupdel %g


#============================ Share Definitions ==============================
 
[Red-Vol]
    path = /Red-Vol
    valid users = @redvol
    writable = yes
    browsable = yes
    create mask = 0754

and my log:

[2019/06/01 13:53:11.875311,  0] ../../source4/smbd/server.c:587(binary_smbd_main)
  samba version 4.10.4 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2019
[2019/06/01 13:53:11.982817,  0] ../../source4/smbd/server.c:743(binary_smbd_main)
  At this time the 'samba' binary should only be used for either:
  'server role = active directory domain controller' or to access the ntvfs file server with 'server services = +smb' or the rpc proxy with 'dcerpc endpoint servers = remote'
  You should start smbd/nmbd/winbindd instead for domain member and standalone file server tasks
[2019/06/01 13:53:11.982886,  0] ../../lib/util/become_daemon.c:122(exit_daemon)
  exit_daemon: daemon failed to start: Samba detected misconfigured 'server role' and exited. Check logs for details, error code 22

Last edited by dkd6 (2019-06-10 16:33:15)

ugjka · 2019-06-08 14:47:16

Provide the testparm dump

dkd6 · 2019-06-08 14:49:08

Sorry, missed it. Here it is:

Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Server role: ROLE_STANDALONE

Press enter to see a dump of your service definitions

# Global parameters
[global]
        dns proxy = No
        log file = /var/log/samba/%m.log
        max log size = 50
        unix extensions = No
        idmap config * : backend = tdb
        wide links = Yes


[homes]
        browseable = No
        comment = Home Directories
        read only = No


[printers]
        browseable = No
        comment = All Printers
        path = /usr/spool/samba
        printable = Yes


[Red-Vol]
        create mask = 0754
        path = /Red-Vol
        read only = No
        valid users = @redvol

I only need the last share. I've also tried messing with the settings quite a bit

Last edited by dkd6 (2019-06-08 19:01:36)

ugjka · 2019-06-08 16:46:16

How are you accessing the share?

dkd6 · 2019-06-08 16:53:40

Hi,
I've tried accessing via Dolphin, smbclient, and a Windows 10 machine - all deny access.
This persists even if I share the same path as a guest share.

ugjka · 2019-06-08 16:58:28

did you try recreating your password with smbpasswd?

dkd6 · 2019-06-08 17:13:27

I have, yes. I've also tried giving another, brand new user access, and reapplying privileges to the directory.

ugjka · 2019-06-08 18:34:38

what does "pdbedit -L -v" say?

dkd6 · 2019-06-08 18:44:39

Here's the output:

Unix username:        shmick
NT username:          
Account Flags:        [U          ]
User SID:             S-1-5-21-4007536995-2570496255-2544878712-1002
Primary Group SID:    S-1-5-21-4007536995-2570496255-2544878712-513
Full Name:            
Home Directory:       \\bit-frigger\shmick
HomeDir Drive:        
Logon Script:         
Profile Path:         \\bit-frigger\shmick\profile
Domain:               BIT-FRIGGER
Account desc:         
Workstations:         
Munged dial:          
Logon time:           0
Logoff time:          Wed, 06 Feb 2036 17:06:39 IST
Kickoff time:         Wed, 06 Feb 2036 17:06:39 IST
Password last set:    Sat, 08 Jun 2019 11:28:40 IDT
Password can change:  Sat, 08 Jun 2019 11:28:40 IDT
Password must change: never
Last bad password   : 0
Bad password count  : 0
Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
---------------
Unix username:        windows
NT username:          
Account Flags:        [U          ]
User SID:             S-1-5-21-4007536995-2570496255-2544878712-1001
Primary Group SID:    S-1-5-21-4007536995-2570496255-2544878712-513
Full Name:            
Home Directory:       \\bit-frigger\windows
HomeDir Drive:        
Logon Script:         
Profile Path:         \\bit-frigger\windows\profile
Domain:               BIT-FRIGGER
Account desc:         
Workstations:         
Munged dial:          
Logon time:           0
Logoff time:          Wed, 06 Feb 2036 17:06:39 IST
Kickoff time:         Wed, 06 Feb 2036 17:06:39 IST
Password last set:    Sat, 01 Jun 2019 13:54:46 IDT
Password can change:  Sat, 01 Jun 2019 13:54:46 IDT
Password must change: never
Last bad password   : 0
Bad password count  : 0
Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF


both users need access and are in a group for it ('redvol' from the smb.conf)

Last edited by dkd6 (2019-06-08 19:00:39)

seth · 2019-06-08 18:56:31

Please edit all your posts and wrap file contest and shell output in "code" tags.

the only thing I've changed since I had it working was migrating from Cinnamon to KDE - and I don't see how that could have anything to do with it.

How do you access the share? cifs or some filebrowser plugin (kio/gvfs)?

[2019/06/01 13:53:11.875311,  0] ../../source4/smbd/server.c:587(binary_smbd_main)
  samba version 4.10.4 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2019
[2019/06/01 13:53:11.982817,  0] ../../source4/smbd/server.c:743(binary_smbd_main)
  At this time the 'samba' binary should only be used for either:
  'server role = active directory domain controller' or to access the ntvfs file server with 'server services = +smb' or the rpc proxy with 'dcerpc endpoint servers = remote'
  You should start smbd/nmbd/winbindd instead for domain member and standalone file server tasks
[2019/06/01 13:53:11.982886,  0] ../../lib/util/become_daemon.c:122(exit_daemon)
  exit_daemon: daemon failed to start: Samba detected misconfigured 'server role' and exited. Check logs for details, error code 22

This usually means you started the wrong service.
https://wiki.archlinux.org/index.php/Sa … g_services

dkd6 · 2019-06-08 19:04:18

Hi, and thanks for the heads up,

I've been accessing the share using gvfs on KDE (I've read the wiki entry and installed the neccesary packages).
I've also tried with smbclient - it spits out 'NT_ACCESS_DENIED'.

I've also read the entry about the services - I've tried starting smb.service on its own or along with nmb.service.
Is there a service I'm missing?
Thank you for your help.

ugjka · 2019-06-08 19:11:47

did you also start samba.service? disable that

seth · 2019-06-08 19:14:18

No, but the log usually means you tried to start samba.service directly.
Edit: cowardishly backstabbed by ugjka!

---

What command exactly produced NT_ACCESS_DENIED? Were you asked for credentials?

How exactly do you use "gvfs on KDE"? Dolphin will use kio, idk whethere there's a kio-gvfs plugin (or how that would act)
Did you try eg. https://wiki.archlinux.org/index.php/Sa … c_mounting (is that an option at all?)

Last edited by seth (2019-06-08 19:15:15)

dkd6 · 2019-06-08 19:24:53

Hi,
I didn't know there was a samba.service. I have not started it and checking now I see it indeed isn't running and disabled.
As for NT_ACCESS_DENIED, it was produced by logging into the share with smbclient (it asks for credentials, and lets me log in) and then using ls.
I was also wrong about KDE - I access SMB shares using the kdenetwork-filesharing packages. Must have gotten it mixed up from my old install. I don't think it's the source of the problem, though, since smbclient and windows clients produce the exact same error (ask for credentials, and then deny access with the correct credentials)
I haven't tried mounting with fstab - up until now, I just enabled smb.service on boot and everything worked. Could that make a difference?

ugjka · 2019-06-08 19:33:47

As for NT_ACCESS_DENIED, it was produced by logging into the share with smbclient (it asks for credentials, and lets me log in) and then using ls.

Hold on a sec, it let's you in but when you list the files it gives that error? Can you elaborate a little more?

seth · 2019-06-08 19:43:14

That happens if you try to access a path element that's not shared, which is why I asked "What command exactly", not for some paraphrase.

However I also misgot the problem. I thought it was about being asked for the PW, not for getting the (presumingly) correct PW denied. Re-reading.

seth · 2019-06-08 19:52:12

Well the obvious contender is

stat /Red-Vol
ps aux | grep smbd
pdbedit -L -v

dkd6 · 2019-06-08 19:52:47

When I try to access with smbclient - it does let me in, but when I try to do anything at all (I've tried simply listing the files - ls) it throws the NT_ACCESS_DENIED. When I try with anything else, however - Dolphin or a Windows 10 machine - I try to login, enter the correct password, and get denied any access whatsoever.

ugjka · 2019-06-08 19:56:11

Something in your /Red-Vol isn't part of redvol group, possibly. You are basically making us guess what the problem is.
I suppose a recursive chown can fix this, if this is the problem
Did you move some files without thinking about permissions?

Last edited by ugjka (2019-06-08 20:01:52)

dkd6 · 2019-06-08 20:14:45

Hi,
I did do a recursive chown - the disk is connected locally, and these same users can access it locally as well - so I am certain local permissions are OK. I use this directory daily for most things and have never stumbled upon any problem - I just can't share it.
I've also tried replacing the permissions to a single user, instead of the redvol group - and the result is the same.

seth · 2019-06-08 20:38:55

As waht user does smbd run and does it have access to those paths? Did you try setting time "ugo+rx"?

ugjka · 2019-06-08 20:42:56

so I am certain local permissions are OK

I need some evidence, so that i can be certain aswell...

ls -lah /Red-Vol | tr -s " " | cut -d " " -f 1-8

The command should remove filenames for privacy

Last edited by ugjka (2019-06-08 20:44:40)

dkd6 · 2019-06-08 21:02:30

Hi,
seth - smd runs as root, and as far as I can tell can access the path. As for setting time, I'm unfamiliar with your suggestion - the system however is time synced with ntp.

ugjka - Here is the output:

total 20K
drwxrwxr-x 1 shmick shmick 126 Jun 8 12:39
drwxr-xr-x 22 root root 4.0K Jun 8 12:15
drwx------ 1 shmick shmick 46 Jun 8 12:41
drwxr-xr-x 1 shmick shmick 144 Jun 3 18:41
drwxr-xr-x 1 shmick shmick 0 Jun 8 12:39
drwxr-xr-x 1 shmick shmick 16 Jun 3 19:01
drwxr-xr-x 1 shmick shmick 34 Jun 8 11:17
drwxr-xr-x 1 shmick shmick 120 Jun 3 20:16
drwxr-xr-x 1 shmick shmick 158 Jun 3 20:47

Thank you both for your suggestions thus far

ugjka · 2019-06-08 21:14:20

Did it stop working yesterday (Jun 8)?

Look at this suspect:

drwx------ 1 shmick shmick 46 Jun 8 12:41

try "chmod 755" it

Last edited by ugjka (2019-06-08 21:17:17)

dkd6 · 2019-06-09 06:20:02

I've just checked it, and that directory is just a shortcut to / (which I didn't place there, but so be it).
The share stopped working about a week ago...
The problem is I can't access the root folder of the share at all (Red Vol), and permissions there seem correct:

drwxrwxr-x 1 shmick shmick 126 Jun 8 12:39 Red-Vol

Any idea on what else can block access?

Arch Linux

#1 2019-06-08 14:32:52

SMB share suddenly denies access - need help troubleshooting [SOLVED]

#2 2019-06-08 14:47:16

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#3 2019-06-08 14:49:08

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#4 2019-06-08 16:46:16

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#5 2019-06-08 16:53:40

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#6 2019-06-08 16:58:28

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#7 2019-06-08 17:13:27

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#8 2019-06-08 18:34:38

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#9 2019-06-08 18:44:39

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#10 2019-06-08 18:56:31

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#11 2019-06-08 19:04:18

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#12 2019-06-08 19:11:47

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#13 2019-06-08 19:14:18

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#14 2019-06-08 19:24:53

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#15 2019-06-08 19:33:47

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#16 2019-06-08 19:43:14

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#17 2019-06-08 19:52:12

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#18 2019-06-08 19:52:47

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#19 2019-06-08 19:56:11

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#20 2019-06-08 20:14:45

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#21 2019-06-08 20:38:55

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#22 2019-06-08 20:42:56

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#23 2019-06-08 21:02:30

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#24 2019-06-08 21:14:20

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

#25 2019-06-09 06:20:02

Re: SMB share suddenly denies access - need help troubleshooting [SOLVED]

Board footer