Unable to connect to MacOSx samba share from arch

keiichiiownsu12 · 2019-10-01 04:06:16

Hello,

I work in a lab that stores most of its data files on mac servers. I am trying to connect to these over samba, however I unable either to mount shared drives via mount -t cfs or look up smb shares via smbtree or smbclient. I have checked all servers, each said they are able to share via smb://*. Each Mac is able to connect to the other's shared drive through either SMB or AFP. I.e. samba should be properly configured/working/running server side.

When I try to connect via mount -t -cfs, with or without the "nounix" or "sec=ntlmssp" options, I am simply returned with the error:

mount error(2): 
# mount -t cifs //xxx.xxx.xxx.xx/${share} /mnt/${share} -o username=<user>,password=<pass>,nounix,sec=ntlmssp,iocharset=utf
No such file or directory
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

smbclient and smbtree are unable to look up the shared drives:

smbclient -L <remote_host> -U%                                                                                                             
Unable to initialize messaging context
do_connect: Connection to <remote_host> failed (Error NT_STATUS_HOST_UNREACHABLE)

Smbtree and smbclient are able to show the "local" shares on localhost though:

smbtree -b -N        
Unable to initialize messaging context
WORKGROUP
	\\hostname    		Samba 4.10.8
	     \\hostname\IPC$           	IPC Service (Samba 4.10.8)

output of nmap reveals ports 139 and 445 are filtered for each:

Host is up (0.0025s latency).
Not shown: 988 closed ports
PORT     STATE    SERVICE
22/tcp   open     ssh
42/tcp   filtered nameserver
53/tcp   filtered domain
135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
161/tcp  filtered snmp
445/tcp  filtered microsoft-ds
548/tcp  open     afp

Funny that afp and ssh are open. I can connect via sshfs/ssh/afp seemlessly, however both are egregiously slow on load and file-lookup times (5-10 second latency), which is why I'm hoping samba's performance might be a bit. . .better.

I have setup winbind.service, smb.service, and nmbd.service. For winbind.service, I edited the /etc/nssswtich.conf and smb.config as suggested in the arch wiki. Speaking of config, here is my smb.conf file:

[Global]
domain master = auto
name resolve order = lmhosts bcast host wins

I have the default one the wiki links to saved as a backup. The options added here were to make it work with KDE/dolphin. Testparm returns no errors:

$testparm
Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Server role: ROLE_STANDALONE

Press enter to see a dump of your service definitions

# Global parameters
[global]
	name resolve order = lmhosts bcast host wins
	idmap config * : backend = tdb

So, I am curious, from what I have shown, will it be possible for me to mount shared drives via Samba from my lab's Mac OS (mojave) servers? Or do I need to contact my system admin to either open up the ports or configure samba correctly server-side? Thank you for any help/clarification!

V1del · 2019-10-01 07:16:42

Does dmesg show error messages regarding the negotiated protocol? Try adding vers=2.0 or vers=1.0 to your cifs mount options to make it use earlier standards. FWIW the smbclient error message just sounds like you might've incorrectly escaped the path, ensure to single quote the URL so that $ and similar characters aren't parsed by the shell.

Trilby · 2019-10-01 12:46:06

I second experimenting with the 'vers' option. Unfortunately the mount.cifs error messages seem not to be very informative as this is the exact message I was getting when I needed to specify 'vers'.

keiichiiownsu12 · 2019-10-01 21:59:57

dmesg output, with mount.cfs ver=2.0

[ 2469.270365] CIFS: Attempting to mount //xxx.xxx.xxx.xx/theforce
[ 2479.465278] CIFS VFS: Error connecting to socket. Aborting operation.
[ 2479.465298] CIFS VFS: cifs_mount failed w/return code = -2

with vers=1.0

[ 2616.582960] CIFS: Attempting to mount //xxx.xxx.xxx.xx/theforce
[ 2626.868487] CIFS VFS: Error connecting to socket. Aborting operation.
[ 2626.868509] CIFS VFS: cifs_mount failed w/return code = -2

Both were using nounix,sec=ntlmssp (also tried krb5), and iocharset=utf8. I am also able to ping the servers just fine. Note this was with winbind.service enabled. Should I try with it off?

V1del · 2019-10-01 22:02:36

What happens if you just omit the nounix and sec=ntlmssp options? winbind.service is for when you intend your own computer to be a server and should be irrelevant for client access.

keiichiiownsu12 · 2019-10-01 22:12:40

Omitting nounix and sec=ntlmssp returns the same error message, for vers=1.0, 2.0, and 3.0:

[ 3349.447392] CIFS: Attempting to mount //xxx.xxx.xxx.xx/theforce
[ 3359.652530] CIFS VFS: Error connecting to socket. Aborting operation.
[ 3359.652548] CIFS VFS: cifs_mount failed w/return code = -2

command being:

mount -t cifs //xxx.xxx.xxx.xx/theforce /Volumes/theforce -o username=<User>,password=<Pass>,iocharset=utf8,vers=<1,2,or 3>.0

seth · 2019-10-02 07:44:46

What kind of portscan was that (exact nmap command)?
The 98% (totally made up number) answer is a firewall, did you enable the macOS firewall?
Otherwise: are the mac systems and the arch system in the same subnet?
Did you ensure the macs can still share files if you disable AFP everywhere?

keiichiiownsu12 · 2019-10-03 17:58:51

Port scan was

nmap -sT "xxx.xxx.xxx.*"

I didn't post the full output, only ports I thought were maybe relevant (i.e. ports 139 and 445 being main samba ports). I do not have admin access to the macs, but I assume a firewall is running.

seth wrote:

Did you ensure the macs can still share files if you disable AFP everywhere?

I am not sure how I could check that. I checked the folder sharing options gui, which seemed to show both samba and afp were enabled. Macs could share via both smb and afp between each other. I do not think I have sufficient access to determine other details.

We are not on the same subnet. Macs are on a 24-bit while I am on a 16-bit subnet.

seth · 2019-10-03 18:47:35

We are not on the same subnet. Macs are on a 24-bit while I am on a 16-bit subnet.

This is most likely going to be the cause for the filter (because access is typically limited to hosts allow xxx.xxx.xxx.0/24 - you don't even need a firewall for this)

I do not have admin access to the macs

Contac the admins on their configuration. Ask them to extend the subnet or, if you've a static IP, that one.

Arch Linux

#1 2019-10-01 04:06:16

Unable to connect to MacOSx samba share from arch

#2 2019-10-01 07:16:42

Re: Unable to connect to MacOSx samba share from arch

#3 2019-10-01 12:46:06

Re: Unable to connect to MacOSx samba share from arch

#4 2019-10-01 21:59:57

Re: Unable to connect to MacOSx samba share from arch

#5 2019-10-01 22:02:36

Re: Unable to connect to MacOSx samba share from arch

#6 2019-10-01 22:12:40

Re: Unable to connect to MacOSx samba share from arch

#7 2019-10-02 07:44:46

Re: Unable to connect to MacOSx samba share from arch

#8 2019-10-03 17:58:51

Re: Unable to connect to MacOSx samba share from arch

#9 2019-10-03 18:47:35

Re: Unable to connect to MacOSx samba share from arch

Board footer