OS2 World Community Forum
OS/2, eCS & ArcaOS - Technical => Networking => Topic started by: Neil Waldhauer on October 17, 2023, 04:51:49 am
-
I'm running Samba server for OS/2 on ArcaOS 5.1. I am trying to understand how Users and Groups work, and also how the kLibc User Manager works along with Samba.
When ArcaOS 5.1 installs Samba, it makes a user named User, and password is Password. It also makes a password for the user I named during the install, Warp30. I don't know the password for this user, either.
The first time running Simple Samba Configuration Center (SSCC), the icon has the parameter /install. After that, the parameter is changed to /config. I'm not sure what actions /install takes. It takes a root password at that time.
It would be nice to be able to snapshot the users and groups, so that I could preserve a working set. It's too easy to make Samba stop functioning.
Ironically, I made a presentation on Samba at Warpstock 2015. I'm not sure how to get good information on the topic. I've somehow preserved my one working set of users since then, but I don't really understand in depth how to maintain users and groups.
http://www.warpstock.org/filemgmt_data/files/Samba%20Warpstock%202015.pdf (http://www.warpstock.org/filemgmt_data/files/Samba%20Warpstock%202015.pdf)
-
When I install samba, it makes some beeping noises. I now believe these noises signify the creation of exceptq Trap files. If I run smbpasswd.exe, it frequenly traps. Occasionally it works. I believe this is why it is difficult to get a set of working users and groups, which Samba needs to do its work.
-
Need the libcx debug package and if available, the smpassw debug package, or debug build. Wild guess, an OOM (out of memory) issue triggering the sigtrap. Could be there to crash when a mal-formed password file is present or similar for security purposes.
-
I generally ignore exceptq reports generated without proper symbolics. The exceptq documentation explains clearly what is required.
Also, by now it should be well known that when libcx0 traps it's common sense to look in %UNIXROOT/var/log/libcx in
case a libcx log was generated.
However, this libcx trap location is well known and the exceptq report happened to include a somewhat readable version of part of the log:
0062F160 : 1E061F79 00000085 1E0625FC 1E061F8C : y........%......
0062F170 : 0062F1CD 1E061F8C 00000000 0062F1EC : ..b...........b.
0062F180 : 30303030 33616664 20313020 74727341 : 0000dfa3 01 Asrt
0062F190 : 72777020 2E657469 33313A63 72703A33 : pwrite.c:133:pr
0062F1A0 : 5F646165 69727770 203A6574 65737341 : ead_pwrite: Asse
0062F1B0 : 6F697472 6166206E 64656C69 7261203A : rtion failed: ar
0062F1C0 : 3D3D2063 5F4F4E20 4F525245 36282052 : c == NO_ERROR (6
0062F1D0 : 3D0A0A29 3D3D3D3D 42494C20 72207843 : )..===== LIBCx r
For some, as yet unknown reason, the mutex that serializes pread/pwrite operations has gone bad.
This smbpasswd.exe is a tad antique. I recommend replacing it with one of Paul's new builds and see if this is sufficient to make the exception go away.
-
by now it should be well known that when libcx0 traps it's common sense to look in %UNIXROOT/var/log/libcx in case a libcx log was generated.
"Common sense"? "well known"? Oh really... I guess you live in a different cave than I do because I have never once heard of this nor do I have a '%UNIXROOT/var/log/libcx' directory. Well, now I know. Thanks for sharing.
BTW... common sense has been shown to be a fallacy. It's what people who already know the answer say to those who don't. Stripped of their a priori knowledge, those who cite "common sense" usually prove every bit as clueless as the rest of us.
-
Sorry if I ruffled any feathers.
For those that might be curious, assuming you are running an updated system, there is
%UNIXROOT%\usr\share\doc\libcx-0.7.3\CHANGELOG.md
%UNIXROOT%\usr\share\doc\libcx-0.7.3\README.md
and for libc, there is
%UNIXROOT%\usr\share\doc\libc-0.1.12\CHANGELOG.md
%UNIXROOT%\usr\share\doc\libc-0.1.12\README.md
I will return to my cave.
-
Hi Steven
It has been a long time. I am glad to see you read and respond to this forum. It's always best never to assume anything. Your and Rich are like the Guru's of the ArcaOS community. Hope you are doing well.
-
I tried to run smbpasswd.exe from Paul's build named samba-4.18.9-os2-20231226.zip
It wants GNUTLS30.DLL, but can't find it.
yum provides GNUTLS30.DLL didn't lead to a pot of gold.
-
I tried to run smbpasswd.exe from Paul's build named samba-4.18.9-os2-20231226.zip
It wants GNUTLS30.DLL, but can't find it.
yum provides GNUTLS30.DLL didn't lead to a pot of gold.
There's a link to https://smedley.id.au/tmp/gnutls30.zip in the current Samba thread :)
-
Thanks. The smbpasswd.exe from Paul's build referenced above does not crash. The resulting password is used correctly by samba.
I have a mostly working Samba 3 installation using the files from ArcaOS 5.1. Can I upgrade that using Paul's build?
Is it as simple as copying the new files over the old samba directory?
-
Neil,
That's what I've been doing for testing - stop the server, then just unzip over the old files, then restart the server. Keep a zipped backup of the old so you can easily unzip that over the new one if needed.
Regards,
-
That's what I've been doing for testing - stop the server, then just unzip over the old files, then restart the server. Keep a zipped backup of the old so you can easily unzip that over the new one if needed.
There are no reports of data loss with even the latest 4.18/4.19 "Alpha, or Beta" code - just some things that may not work as expected :) The only way things are gonna get fixed is if people test things and report issues. I don't *need* a Samba Server for personal use - I already have an Ubuntu Server on my LAN - I'm working on this as I still care about the future of ArcaOS / OS/2 - even though my daily driver is a laptop running Ubuntu 23.10.
-
Thanks Paul, for making the samba port. I'm looking forward to updating my samba here.
I copied the 4.18 files over my mostly working Samba Server Version 3.6.25 for OS/2 based systems 1.3.0 (Refresh) The smb.conf file is unchanged.
When I access a share with my ArcaOS 5.1 SMB client, I get two exceptq trap files from SMBD.EXE.
-
Thanks Paul, for making the samba port. I'm looking forward to updating my samba here.
I copied the 4.18 files over my mostly working Samba Server Version 3.6.25 for OS/2 based systems 1.3.0 (Refresh) The smb.conf file is unchanged.
When I access a share with my ArcaOS 5.1 SMB client, I get two exceptq trap files from SMBD.EXE.
Well that's a new one! Server logs should probably be the best way to see what's happening. Actually, can you try first with https://smedley.id.au/tmp/samba-4.19.4-os2-20240110.zip ? the TRP is a SIGABRT - possibly a failed Assertion that was fixed after the initial 4.18.x build.
-
I tried the 4.19 build you suggest, and the traps are gone, but there is no response for client or browsing. I can't authenticate with "Samba Users and Groups".
Looking at logs, most are 0 length, but two are not. I'm not sure what the logs are trying to tell me.
-
Try adding your users with smbpasswd
-
I created the users with smbpasswd.exe, and now the server generates traps on startup. I zipped all the log files and trap files.
-
The Traps all look the same, a failed assertion in pwrite in lunch... Weird... I'm assuming libcx is up to date?
-
libcx is up to date as far as netlabs-rel is concerned. 0.7.3-1 is the version number.
-
libcx is up to date as far as netlabs-rel is concerned. 0.7.3-1 is the version number.
How are you starting smbd? Using the WPS objects from Samba 3.x?
If so, what if you start smbd.exe from the command line? Can you connect then?
If LIBPATHSTRICT or anything like that being set anywhere?
-
I'm starting the servers with the following command line:
smb.cmd start
I have not set libpathstrict. I'm attaching a testlog to this post in case that helps.
I started samba to check things on this post, and it did not generate any traps, but it also did not allow any client to connect. Browsing doesn't work, either. Samba creates logs in response to these actions, but the logs are zero length.
-
I'm starting the servers with the following command line:
smb.cmd start
I have not set libpathstrict. I'm attaching a testlog to this post in case that helps.
I started samba to check things on this post, and it did not generate any traps, but it also did not allow any client to connect. Browsing doesn't work, either. Samba creates logs in response to these actions, but the logs are zero length.
The default loglevel is low :) so doesn't produce many entries.
Can you try starting with:
smbd -d 8
then try to connect, then close smbd - and send me a copy of \var\log\log.smbd*
Thanks,
Paul
-
These are the logs from smbd -d 8, but they were in \mptn\etc\samba\log\smbd*
-
A few things of note from the logs:
[2024/01/22 18:46:52.954000, 2] ../../libcli/auth/ntlm_check.c:480(ntlm_password_check)
ntlm_password_check: NTLMv1 passwords NOT PERMITTED for user Warp30
[2024/01/22 18:46:52.954000, 3] ../../libcli/auth/ntlm_check.c:487(ntlm_password_check)
ntlm_password_check: NEITHER LanMan nor NT password supplied for user Warp30
[2024/01/22 18:46:52.958000, 5] ../../source3/auth/auth.c:265(auth_check_ntlm_password)
auth_check_ntlm_password: sam_ignoredomain authentication for user [Warp30] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1
[2024/01/22 18:46:52.958000, 2] ../../source3/auth/auth.c:353(auth_check_ntlm_password)
check_ntlm_password: Authentication for user [Warp30] -> [Warp30] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1
So seems to be some kind of password mismatch. Try resetting password with smbpasswd
-
While I have found how to get users and groups to work for Samba3, I noted that smbpasswd.exe was broken.
In Samba4, I'm getting some messages, but at least it does not crash.
{0}[f:\programs\samba] smbpasswd -a Warp40
Unknown parameter encountered: "display charset"
Ignoring unknown parameter "display charset"
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated
New SMB password:
Retype new SMB password:
sh.exe: 1: F:Programssambausermod.cmd: not found
Failed to add entry for user Warp40.
Perhaps something in smb.conf is interpreted differently than in Samba3?
-
I don't understand how:
sh.exe: 1: F:Programssambausermod.cmd: not found
is being called if my smbpasswd is being used?
You are running smbpasswd.exe directly from a command line, or via the WPS objects from AOS?
-
In my smb.conf, which was generated by SSCC from Samba3, there are several instances of F:\Programs\samba\usermod.cmd
I'm calling from command line. The WPS objects don't currently function well. Command line is easier for me to post.
And it's worth saying -- thanks for looking at this.
-
Can you try changing the \ to a /
ie F:/Programs/samba/usermod.cmd
-
With the various command files changed to forward slashes "/" in smb.conf, smbpasawd is now running once, then after that trapping.
After a few times trapping, smbpasswd ran without trapping, but smb, nmb and winbind all crash when started.
-
Can you try removing ALL old tdb and lock files before trying to restart things?
-
I think my old tdb files may have been one problem solved. Now smbpasswd behaves better, but with a few messages. I'm still having some problems connecting, though.
These are the results of smbpasswd test after deleting the private directory
{0}[f:\programs\samba] smbpasswd -a root
Unknown parameter encountered: "display charset"
Ignoring unknown parameter "display charset"
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated
New SMB password:
Retype new SMB password:
tdbsam_open: Converting version 0.0 database to version 4.0.
tdbsam_convert_backup: updated F:\MPTN\ETC/samba/private/passdb.tdb file.
tdb(F:\MPTN\ETC/samba/lock/winbindd_idmap.tdb): tdb_open_ex: could not open file
F:\MPTN\ETC/samba/lock/winbindd_idmap.tdb: No such file or directory
Added user root.
{0}[f:\programs\samba] smbpasswd -a Warp30
Unknown parameter encountered: "display charset"
Ignoring unknown parameter "display charset"
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated
New SMB password:
Retype new SMB password:
Added user Warp30.
{0}[f:\programs\samba] smbpasswd -a User
Unknown parameter encountered: "display charset"
Ignoring unknown parameter "display charset"
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated
New SMB password:
Retype new SMB password:
Added user User.
{0}[f:\programs\samba] smbpasswd -a zonker
Unknown parameter encountered: "display charset"
Ignoring unknown parameter "display charset"
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated
New SMB password:
Retype new SMB password:
Added user zonker.
{0}[f:\programs\samba] smbpasswd -a -n guest
Unknown parameter encountered: "display charset"
Ignoring unknown parameter "display charset"
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated
Added user guest.
I started the servers, and no errors. I can't quite browswe from my other computer with arcamapper. A domain icon appears with my hostname, but no machines or shares.
If I try to connect, I get the following added to log\log.smbd..192.168.46.22
[2024/01/28 07:28:54.985000, 2] ../../libcli/auth/ntlm_check.c:480(ntlm_password_check)
ntlm_password_check: NTLMv1 passwords NOT PERMITTED for user Warp30
[2024/01/28 07:28:54.989000, 2] ../../source3/auth/auth.c:353(auth_check_ntlm_password)
check_ntlm_password: Authentication for user [Warp30] -> [Warp30] FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1
[2024/01/28 07:28:54.989000, 2] ../../auth/auth_log.c:858(log_authentication_event_human_readable)
Auth: [SMB2,(NULL)] user [BEACH2]\[Warp30] at [Sun, 28 Jan 2024 07:28:54.989000 PST] with [NTLMv1] status [NT_STATUS_WRONG_PASSWORD] workstation [GARBOPEEP] remote host [ipv4:192.168.46.22:59146] mapped to [BEACH2]\[Warp30]. local host [ipv4:192.168.46.80:445]
{"timestamp": "2024-01-28T07:28:54.989000", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 3}, "eventId": 4625, "logonId": "0", "logonType": 3, "status": "NT_STATUS_WRONG_PASSWORD", "localAddress": "ipv4:192.168.46.80:445", "remoteAddress": "ipv4:192.168.46.22:59146", "serviceDescription": "SMB2", "authDescription": null, "clientDomain": "BEACH2", "clientAccount": "Warp30", "workstation": "GARBOPEEP", "becameAccount": null, "becameDomain": null, "becameSid": null, "mappedAccount": "Warp30", "mappedDomain": "BEACH2", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "NTLMv1", "clientPolicyAccessCheck": null, "serverPolicyAccessCheck": null, "duration": 500000}}
There must be something I can add to smb.conf to permit less secure connections...
-
Hi Neil,
You could try adding 'ntlm auth = Yes' to your server smb.conf. That should enable NTLMv1 authentication (which is off by default I believe). You may also need 'server min protocol = NT1' as well...
https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html is a good reference for all the smb.conf parameters.
Regards,
-
With those two changes, I am now able to see files on the Samba Server v 4.19 from ArcaMapper on an ArcaOS 5.1 machine. I didn't do any stress or capability test yet. Thanks David, and thanks, Paul.
server min protocol = NT1
ntlm auth = Yes
Curiously, I cannot see those same shares in the ArcaMapper Network Browser. I added Workgroup to my smb.conf, and now I can see the machine, but not the shares. When I try to refresh the list of shares in the Network browser, the following lines appear in smb.log..192.168.46.22
[2024/01/28 20:07:43.792000, 2] ../../source3/param/loadparm.c:2951(lp_do_section)
Processing section "[HOMES]"
[2024/01/28 20:07:43.792000, 2] ../../source3/param/loadparm.c:2951(lp_do_section)
Processing section "[D]"
[2024/01/28 20:07:43.792000, 2] ../../source3/param/loadparm.c:2951(lp_do_section)
Processing section "[E]"
[2024/01/28 20:07:43.792000, 2] ../../source3/param/loadparm.c:2951(lp_do_section)
Processing section "[F]"
[2024/01/28 20:07:43.792000, 2] ../../source3/param/loadparm.c:2951(lp_do_section)
Processing section "[H]"
[2024/01/28 20:07:43.792000, 2] ../../source3/param/loadparm.c:2951(lp_do_section)
Processing section "[M]"
[2024/01/28 20:07:43.792000, 2] ../../source3/param/loadparm.c:2951(lp_do_section)
Processing section "[P]"
[2024/01/28 20:07:43.792000, 2] ../../source3/param/loadparm.c:2951(lp_do_section)
Processing section "[S]"
[2024/01/28 20:07:43.792000, 2] ../../source3/param/loadparm.c:2951(lp_do_section)
Processing section "[Y]"
-
Neil,
I also cannot see anything with the ArcaMapper Network Browser when running SAMBA 4.19. Not sure why - haven't spent any time troubleshooting it yet...
Regards,