Author Topic: SAMBA Network access denied  (Read 1218 times)

Doug Clark

  • Full Member
  • ***
  • Thank You
  • -Given: 1
  • -Receive: 20
  • Posts: 209
  • Karma: +0/-0
    • View Profile
SAMBA Network access denied
« on: September 30, 2020, 11:21:30 pm »
I am trying to set up samba 3.3.16 and when attempting to execute Samba Users and Groups I get the message

Sys0065: Network access is denied.

For some reason I also have KLIBC User Management - I think it was for the Drop Box plugin
Any thoughts on how to fix this.

Doug Bissett

  • Hero Member
  • *****
  • Thank You
  • -Given: 1
  • -Receive: 60
  • Posts: 1383
  • Karma: +0/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #1 on: October 01, 2020, 05:44:42 am »
Quote
Sys0065: Network access is denied.

SAMBA server is still at the 3.3.16 version, while the client in ArcaOS (5.5 and 5.6) is at version 4. There is a bit of a mismatch in the way they handle security. There is also a mismatch between using "KLIBC User Management" and "Samba Users and Groups". I suggest that nobody should use KLIBC User Management, unless they know exactly why they are using it (I have no idea what that would be used for).

There is also a problem, caused by having "root" in the "wheel" group (don't ask), in the file %UNIXROOT%\etc\group. Open the file in the text editor, and remove "root" from beside where it says "wheel" (or, remove the whole line).

Then, the version 4 client defaults to using authentication that the server won't use. The new ArcaMapper (in ArcaOS 5.0.5 and 5.0.6) will ask when it is first opened, reply YES, or it won't be able to talk to the older server. If you reply "Later" it will probably work okay, but it will (should) ask again. If you reply NO, it won't work, and it won't ask again. Go to Global Settings-> page 2, and turn off the check mark beside "client min protocol". It should then show NT1 in the box. Click apply, and it should restart the client. Then it should work. Variations on this will be needed, if you are still trying to use NETBIOS over TCP/IP (which I haven't tried).

Hopefully, I didn't forget something. It has been promised that this will get a whole lot easier, when SAMBA server v4 is available.

Paul Smedley

  • Hero Member
  • *****
  • Thank You
  • -Given: 27
  • -Receive: 93
  • Posts: 693
  • Karma: +24/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #2 on: October 01, 2020, 11:35:30 am »
Most of what Doug has written is completely incorrect - I don't have the strength to unpick/correct it.

Doug Clark

  • Full Member
  • ***
  • Thank You
  • -Given: 1
  • -Receive: 20
  • Posts: 209
  • Karma: +0/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #3 on: October 01, 2020, 03:24:55 pm »
I am sorry - I should have given more information.

The system is AOS 5.01

I installed the Net drive plugin for Dropbox which requires kLIBC, and if memory serves me, also kLIBC user manager, which I seem to remember was required for authentication at Dropbox.  That was months ago.

I installed Samba server 3.3.16 on the machine using the WPI package - in order to exchange files with Windows NT on vbox, since vbox doesn't implement shared folders for Windows NT.  I believe the install process prompted me for a password for root, which I entered.

Now when I try to add the Samba Users or Groups I am prompted for a password for root, and no password I enter works - they all come back with network access is denied.

I  deleted  pwd.db, master.passwd, spwd.db and because I was brave and desperate, master.passwd.bak and spwd.db.bak  all in unixroot\etc, and ran the Samba reload configuration which went through part of the setup, including prompting me for a password for root, but I have the same issue.

When I start kLIBC user management I now get a dialog that says "Samba user management found. Continue?"  The title of the dialog says: WarpIN: netlabs.org\Samba\SmbUsers\1\0\1\804

I have no idea why WarpIN would be involved at this point, it is not running.  I cannot find any documentation on kLIBC user management.  kLIBC user management has a button for edit user, but clicking that on root brings up a dialog that doesn't allow any changes to root.  kLIBC user management, when in debug mode, shows a password for root but that password still does not work when trying to add or modify users in Samba.

I know this Samba version and install package (*WPI) works because I have it installed on my server (eComStation machine) and I used that same package to install on AOS which is where I am having problems.

So do I need to delete everything in UNIXROOT (and the Samba tentacles elsewhere) and start re-installing or is there a less nuclear option?




Neil Waldhauer

  • Hero Member
  • *****
  • Thank You
  • -Given: 11
  • -Receive: 50
  • Posts: 630
  • Karma: +1/-0
    • View Profile
    • Blonde Guy
Re: SAMBA Network access denied
« Reply #4 on: October 01, 2020, 03:50:48 pm »
I'm planning to extend my notes for other eCS and ArcaOS versions, but for now, look at my Samba page here:

http://www.blondeguy.com/SambaforOS2.html

Yes, the user situation is a mess. The documentation currently consists of a few notes from the developers "Some documentation would be nice."

I use Samba all the time. My clients are eCS, ArcaOS, Mac, Windows, iOS and iPadOS. Once you get through the users problem and the protocol problems, things work pretty well. Our implementation of SAMBA still does not respect OS/2 notions of "Last Write Date" which kind if sucks for developers who want to use the make utility.
Expert consulting for ArcaOS, OS/2 and eComStation
http://www.blondeguy.com

Doug Bissett

  • Hero Member
  • *****
  • Thank You
  • -Given: 1
  • -Receive: 60
  • Posts: 1383
  • Karma: +0/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #5 on: October 01, 2020, 08:37:58 pm »
Quote
Most of what Doug has written is completely incorrect - I don't have the strength to unpick/correct it.

Most of what I wrote, is exactly what I have had to do to make later versions of SAMBA work. Since Doug is, apparently, using an older version of ArcaOS, it may be working in reverse. I do know, that the samba-client package (installed by RPM/YUM) must match the samba plugin, which is installed with WarpIn, or you get silly problems as Doug describes. When you INSTALL the server, it gives you the tools to configure it. When you configure it, one of the steps is to have RPM/YUM install, or update, some packages. If that manages to get out of step (there is no mechanism to keep it matched, yet), you have problems.

Paul Smedley

  • Hero Member
  • *****
  • Thank You
  • -Given: 27
  • -Receive: 93
  • Posts: 693
  • Karma: +24/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #6 on: October 02, 2020, 05:24:28 am »
Quote
Sys0065: Network access is denied.

SAMBA server is still at the 3.3.16 version, while the client in ArcaOS (5.5 and 5.6) is at version 4. There is a bit of a mismatch in the way they handle security. There is also a mismatch between using "KLIBC User Management" and "Samba Users and Groups". I suggest that nobody should use KLIBC User Management, unless they know exactly why they are using it (I have no idea what that would be used for).

For running the server - the klibc user manager is mandatory - unless you want to manually edit master.passwd and generate the required DB files yourself. Users in Samba need to exist at the OS level - aka klibc user manager; *and* in Samba aka Samba Users and groups.

Referring to the client in ArcaOS as 'version 4' is fraught with danger, and extremely simplistic. Samba "4" started as 4.0 and the latest major release is 4.13.0 - that's 14 releases at approximately 6 month intervals or 7 years of development. It is only since Samba 4.11 that changes were made to disable SMB1 by default; noting that Windows made this change some years ago for security reasons.

Then, the version 4 client defaults to using authentication that the server won't use. The new ArcaMapper (in ArcaOS 5.0.5 and 5.0.6) will ask when it is first opened, reply YES, or it won't be able to talk to the older server. If you reply "Later" it will probably work okay, but it will (should) ask again. If you reply NO, it won't work, and it won't ask again. Go to Global Settings-> page 2, and turn off the check mark beside "client min protocol". It should then show NT1 in the box. Click apply, and it should restart the client. Then it should work. Variations on this will be needed, if you are still trying to use NETBIOS over TCP/IP (which I haven't tried).

Again - this change only occurred in Samba 4.11 - which IIRC shipped in ArcaOS 5.05 or 5.06. And actually, it's nothing to do with authentication - it's the network protocol that's used to communicate. Authentication methods are a whole another story.

Hopefully, I didn't forget something. It has been promised that this will get a whole lot easier, when SAMBA server v4 is available.
There will never be a SAMBA server v4 - Samba v4 was released in December 2012 and is obsolete. Ports of Samba Server based on 4.11 are already available, and have been for some time - at least a few months.

Paul.

Paul Smedley

  • Hero Member
  • *****
  • Thank You
  • -Given: 27
  • -Receive: 93
  • Posts: 693
  • Karma: +24/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #7 on: October 02, 2020, 05:28:34 am »
Hey Neil,

Our implementation of SAMBA still does not respect OS/2 notions of "Last Write Date" which kind if sucks for developers who want to use the make utility.

When you say this, as you talking about the client or server? There were definitely some issues with the mapping of file create/modify/access times which I think are fixed in the latest 4.11.x plugin.

Cheers,

Paul.

Doug Bissett

  • Hero Member
  • *****
  • Thank You
  • -Given: 1
  • -Receive: 60
  • Posts: 1383
  • Karma: +0/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #8 on: October 02, 2020, 06:50:33 am »
Quote
For running the server - the klibc user manager is mandatory - unless you want to manually edit master.passwd and generate the required DB files yourself. Users in Samba need to exist at the OS level - aka klibc user manager; *and* in Samba aka Samba Users and groups.

That may be true for SAMBA 4. It is certainly NOT true for SAMBA 3 (which is what the OP is trying to install, and use).  The only safe way to do that is by using SAMBA users and groups. using KLIBC user manager will cause problems.

FWIW, I suspect that the SAMBA configuration has installed a newer version of the samba-client package, which doesn't match the underlying support (SAMBA plugin) that is installed with older versions of ArcaOS. There is a WarpIn package that updates that, and it must match the samba-client package installed by RPM/YUM. Sorry, I don't know where you can get the SAMBA plugin package, so you probably need to down level the samba client to match the plugin. AFAIK, none of this is documented, so you need to experiment to find a working combination. I am guessing that samba-client 4.10.9 is probably needed. It *may* be in netlabs-exp (which could be what got you in trouble, if you left it enabled).

Paul Smedley

  • Hero Member
  • *****
  • Thank You
  • -Given: 27
  • -Receive: 93
  • Posts: 693
  • Karma: +24/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #9 on: October 02, 2020, 11:05:52 am »
Quote
For running the server - the klibc user manager is mandatory - unless you want to manually edit master.passwd and generate the required DB files yourself. Users in Samba need to exist at the OS level - aka klibc user manager; *and* in Samba aka Samba Users and groups.

That may be true for SAMBA 4. It is certainly NOT true for SAMBA 3 (which is what the OP is trying to install, and use).  The only safe way to do that is by using SAMBA users and groups. using KLIBC user manager will cause problems.

Nope - wrong again.  All The Samba user/group manager is doing is creating a klibc user; then running smbpasswd to add the user to Samba.

Paul Smedley

  • Hero Member
  • *****
  • Thank You
  • -Given: 27
  • -Receive: 93
  • Posts: 693
  • Karma: +24/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #10 on: October 02, 2020, 11:14:58 am »
Hi Doug,


I  deleted  pwd.db, master.passwd, spwd.db and because I was brave and desperate, master.passwd.bak and spwd.db.bak  all in unixroot\etc, and ran the Samba reload configuration which went through part of the setup, including prompting me for a password for root, but I have the same issue.
<snip>
So do I need to delete everything in UNIXROOT (and the Samba tentacles elsewhere) and start re-installing or is there a less nuclear option?

I would try re-instating pwd.db, master.passwd & spwd.db with the contents from ftp://ftp.netlabs.org/pub/libc/alpha/baselayout.zip and try again to create the users....

Cheers,


Paul

Neil Waldhauer

  • Hero Member
  • *****
  • Thank You
  • -Given: 11
  • -Receive: 50
  • Posts: 630
  • Karma: +1/-0
    • View Profile
    • Blonde Guy
Re: SAMBA Network access denied
« Reply #11 on: October 02, 2020, 03:56:41 pm »
Hey Neil,

Our implementation of SAMBA still does not respect OS/2 notions of "Last Write Date" which kind if sucks for developers who want to use the make utility.

When you say this, as you talking about the client or server? There were definitely some issues with the mapping of file create/modify/access times which I think are fixed in the latest 4.11.x plugin.

I'm sorry to pollute this thread with other Samba Server issues, but here goes.

My use case is that a client running ArcaOS 5.0.6 (and some earlier versions too) will read a bunch of .cmd files residing on the server. All of the OS/2 file dates are changed to the current time. I asked around and decided that this will be an issue to take up when we are ready to test the new Samba server, as fixing the old code is a lower priority. For now, I keep the real write date as a text string in the cmd file.

I have other issues with the server and fast machines, but those also are on hold waiting for an ArcaOS beta with the new server installed. It's worth it to me to test these. Samba server is nearly as strategic as the new browser for my use of ArcaOS.

When a new beta with the latest Samba client appears, and I will test the file date bug. Arca Noae works so hard to make these beta distributions, I favor testing that. Otherwise, I'm mostly testing my own client or server installation, which hasn't been so productive.
Expert consulting for ArcaOS, OS/2 and eComStation
http://www.blondeguy.com

Doug Clark

  • Full Member
  • ***
  • Thank You
  • -Given: 1
  • -Receive: 20
  • Posts: 209
  • Karma: +0/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #12 on: October 02, 2020, 08:59:52 pm »
Thank you all for your responses - especially you Neil for you excellent documentation.  I finally got it to work and I conclude my problems where mostly stupid user errors on my part plus some mysterious issues I don't understand.

And thanks Paul for explaining the relationship between klibc user management and samba users/groups/

For anyone else that may have similar problems.

I was accidently installing samba-1-3-0-122.wpi instead of samba-1-1-4-804.wpi Stupid mistake on my part.  What is labeled samba-1-1-4-804.wpi actually installs samba server version 3.3.16  What is labeled samba-1-3-0-1022 installs a later version of Samba server.  I was finally able to get past the root user login in order to create Samba users with the later version (perhaps because I changed to a password to at least 8 characters long?) and get the server running, but I could not see the server from ArcaMapper or connect from WInNT.

Suggest to the Samba gurus - could you please make the version number of the install packages match the version number of the server that is being installed?

When I uninstalled the later version and installed Samba version 3.3.16 I could see everything from ArcaMapper and from WinNT in vbox and make connections.  So all is good.

I am probably a bad person for using the earlier version, but it works.  And I can connect from Macs, various windows versions and ecs/AOS.

Thanks again for all the responses.  The discussion on the later versions of Samba has been interesting.


Paul Smedley

  • Hero Member
  • *****
  • Thank You
  • -Given: 27
  • -Receive: 93
  • Posts: 693
  • Karma: +24/-0
    • View Profile
Re: SAMBA Network access denied
« Reply #13 on: October 05, 2020, 10:01:26 am »
Hey Neil,

Our implementation of SAMBA still does not respect OS/2 notions of "Last Write Date" which kind if sucks for developers who want to use the make utility.

When you say this, as you talking about the client or server? There were definitely some issues with the mapping of file create/modify/access times which I think are fixed in the latest 4.11.x plugin.
When a new beta with the latest Samba client appears, and I will test the file date bug. Arca Noae works so hard to make these beta distributions, I favor testing that. Otherwise, I'm mostly testing my own client or server installation, which hasn't been so productive.

FWIW - the changes in the client to try and fix the create/modify/access times were a while back now - all builds on Samba 4.11.x at least have the fix. Having said that, I now recall that in implementing that fix,  I broken some things on SMB1 connections - this was the trigger for the recent update to ndpsmb.dll (3.7.1 as I recall), Assuming you're on a recent ArcaOS build, check to see ndpsmb.dll has a 2020 date on it or not. bldlevel should also show 3.7.1

Cheers,

Paul

Neil Waldhauer

  • Hero Member
  • *****
  • Thank You
  • -Given: 11
  • -Receive: 50
  • Posts: 630
  • Karma: +1/-0
    • View Profile
    • Blonde Guy
Re: SAMBA Network access denied
« Reply #14 on: October 05, 2020, 05:49:31 pm »
I can verify that ndpsmb.dll 3.7.1 dated July 28, 2020 is in ArcaOS 5.0.6. I'm seeing the dates messed up, but the exact cause is unknown. I'll edit this message if I find the cause.
Expert consulting for ArcaOS, OS/2 and eComStation
http://www.blondeguy.com