[Pkg-samba-maint] Bug#427986: (forw) Re: Bug#427986: samba: not permitted access to share IPC$

[Christian Perrier]

----- Forwarded message from Gordon Haverland <ghaverla at materialisations.com> -----

From: Gordon Haverland <ghaverla at materialisations.com>
Reply-To: ghaverla at materialisations.com
Organization: Matter Realisations
To: Christian Perrier <bubulle at debian.org>
Subject: Re: [Pkg-samba-maint] Bug#427986: samba: not permitted access to share IPC$
Date: Fri, 8 Jun 2007 07:19:01 -0600
X-CRM114-Status: Good  ( pR: 999.99  )

On June 7, 2007, you wrote:
> Quoting Gordon Haverland (ghaverla at materialisations.com):
> > In searching for answers, I ran across lots of bug reports
> > where this seems to be a symptom, but hadn't run across
> > solutions.  So, there are probably a few different things
> > which create this IPC$ symptom.  I can work with the setup I
> > eventually created, so I don't need a resolution to this.
[ ... ]
> Well, part from the above explanations, could you post your
> smb.conf, explain exactly what problem is happening and
> eventually post level 3 logs (at first attempt....).
>
> Up to now, we're mostly in the dark to understand what your
> problem might be.
>
> I seem to understand you're using "valid users" in the
> [globals] section. If you do so, don't be surprised to get
> unexpected results. "valid users" is a "share" parameters as
> explained in the smb.conf manpage (funnily, it seems to work
> slightly but that may be mor ea kind of side effect than
> anything really intended).

1. When I speak of bug reports involving IPC$, I am speaking of 
Samba globally, not specifically Debian bug reports.  Are you 
familiar with people not being able to establish connections to 
Samba, with error messages involving permissions of IPC$?

In the many threads involving that kind of error I looked down, I 
didn't see any solutions.  It is likely that what caused 
this "problem" here is not what caused it elsewhere.  However, 
this seems to be reproducible.

It isn't a problem here, as I gave up on that approach.  I thought 
sending this in might help in helping to track down this kind of 
error for others.

2. I was using Windows Explorer on XP-Home for testing with Samba.  
In watching the logs, you see an initial contact made from a 
machine in a workgroup, with no user field.  After a bit of 
processing, Samba decides this is a logon by smbguest.  Samba 
wants to do some more stuff, and to do so it needs to use the 
IPC$ share.  This fails, as smbguest isn't on the list of valid 
users, with this error message:

[2007/06/05 15:39:50, 2] smbd/uid.c:change_to_user(193)
  change_to_user: SMB user  (unix user smbguest, vuid 101) not 
permitted access to share IPC$.
[2007/06/05 15:39:50, 0] smbd/service.c:make_connection_snum(928)
  Can't become connected user!
[2007/06/05 15:39:50, 3] smbd/connection.c:yield_connection(69)
  Yielding connection to IPC$
[2007/06/05 15:39:50, 3] smbd/error.c:error_packet_set(106)
  error packet at smbd/reply.c(514) cmd=117 (SMBtconX) 
NT_STATUS_LOGON_FAILURE

3. This is an error on my part, as I don't understand M$/Samba 
interactions.  I wanted to set things up so that only a 
particular user had any kind of contact with Samba.  Hence the 
reason to put the "valid users" in the globals section.  However, 
it seems that the anonymous user (here called smbguest, with no 
password) must be allowed some access to certain shares, just in 
order for things like browsing the network neighbourhood (using 
windows explorer) and logons  to happen.  As I said, I think 
perhaps testparm should look out for this, as it seems to 
indicate a configuration that won't work, or won't work without 
the machine/workgroup mapping set up.

Does this make more sense?

Gord



 ** CRM114 Whitelisted by: bubulle at debian.org **

----- End forwarded message -----

-- 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/pkg-samba-maint/attachments/20070608/a95dad84/attachment.pgp