| Rev | Author | # | Line |
|---|---|---|---|
| 24 | MichaelBordignon | 1 | As Samba is such a huge concept and will have so many entries, ranging from [PDC]s with DomainLogons, to [LDAP] integration, [SSL], and error diagnostics, not to mention differences between each version of Samba currently |
| 2 | available - 2.2, 3.0alpha, and samba-tng, we'll use this is a main page and link to other pages whenever they get enough content or are conceptually large enough to support a new page. | ||
| 3 | |||
| 4 | I'll start off by adding a SambaErrorMessages wiki, although other notes should probably appear in this page for now. | ||
| 5 | |||
| 6 | !!Samba related concepts | ||
| 7 | |||
| 8 | * [SambaAsPDC] | ||
| 9 | * SambaErrorMessages | ||
| 10 | * RequireSignOrSeal, one of our most popular pages on the wiki | ||
| 11 | * SambaPrinting | ||
| 12 | * [Samba3LDAP] | ||
| 13 | * [ActiveDirectorySamba] | ||
| 14 | * [SambaAsFileServer] | ||
| 25 | DanielLawson | 15 | * MacSambaNotes |
| 29 | CraigBox | 16 | * SambaShadowCopyHowto |
| 24 | MichaelBordignon | 17 | |
| 18 | !! Firewalling SMB/CIFS | ||
| 19 | |||
| 20 | If you wish to firewall out all smb/cifs traffic (from either samba or windows pc's) you will need to firewall the following ports: | ||
| 21 | |||
| 27 | CraigBox | 22 | <pre> |
| 24 | MichaelBordignon | 23 | UDP/137 - used by nmbd |
| 24 | UDP/138 - used by nmbd | ||
| 25 | TCP/139 - used by smbd | ||
| 26 | TCP/445 - used by smbd | ||
| 27 | CraigBox | 27 | </pre> |
| 24 | MichaelBordignon | 28 | |
| 29 | The last one is important as many older firewall setups may not be aware of it, given that this port was only added to the protocol in recent years. | ||
| 30 | |||
| 31 | For more information on the use of port 445, go to http://www.petri.co.il/what_is_port_445_in_w2kxp.htm | ||
| 33 | BenStaz | 32 | |
| 33 | !!Allowing an entire group to access a samba share. | ||
| 34 | Under the appropriate share in /etc/samba/smb.conf do: | ||
| 35 | *valid users = @<group> | ||
| 36 | |||
| 24 | MichaelBordignon | 37 | |
| 38 | !!!Samba Strangeness (or "How do I fix this?") | ||
| 39 | |||
| 40 | !!Printing jobs from windows clients leaves a "ghost" job in the queue. | ||
| 41 | This is not actually a problem with samba, but rather a way in which lpd and the windows spooler communicate. | ||
| 42 | In newer lpd versions, there is a parameter (done_jobs) which is set to 1 by default - it stores old completed jobs for "reference". Unfortunately, windows retains these jobs in the spooler. This is not usually desirable behaviour. | ||
| 43 | Set "done_jobs=0" in lpd.conf and restart lpd. | ||
| 44 | |||
| 45 | !!Unable to login to samba - logs show "nobody" being auth'd instead of user. | ||
| 27 | CraigBox | 46 | This is probably a symptom of having usernames with mixed case. If this is so, you need to modify the ~[global] section of smb.conf with the parameter <tt>username level = 3</tt>. |
| 47 | |||
| 48 | You may need more, depending on your pattern of usernames. This parameter tells samba to try at least $username_level initial caps in the supplied name. For example, I had a site where the username pattern matched Y~[0-2]name. In this case, I needed to set username level to 1, to catch the initial uppercase character. Needless to say this would not be necessary if Windows clients would behave and send the username exactly as provided... | ||
| 34 | BenStaz | 49 | |
| 50 | !!Rules to Remember Regarding Permissions. | ||
| 35 | BenStaz | 51 | For a user in group 'leech' for example, if he wants to access a samba share, then to browse and access files, all parent directories must have their group permissions set as read and execute and either him or one of the groups he is in should own them. If not, then a samba client will not be able to access the share. |
| 52 | |||
| 53 | Read permission ("r") means that you can list the directory- for example, use "ls" on it. But that's all it means. If you only have read permission on a directory you can't cd to that directory, you can't copy files to that directory etc. | ||
| 54 | |||
| 55 | You need execute permission ("x") if you want to read files in that directory, copy it elsewhere, or delete it. | ||
| 56 | |||
| 57 | If the group permissions are set to execute only, then the user will not be be able to browse the share but they will be able to directly access files. ie : supply a full path. | ||
| 24 | MichaelBordignon | 58 | |
| 59 | !!Print Queue in Windows 2000/XP shows "Access denied, unable to connect". | ||
| 60 | |||
| 61 | This drove me insane. I now have the answer: | ||
| 62 | |||
| 27 | CraigBox | 63 | 1. Edit smb.conf. Ensure you add in the global section <tt>use client driver = yes</tt>. |
| 24 | MichaelBordignon | 64 | |
| 65 | 2. On the printers share definition, ensure the following rights are granted: | ||
| 27 | CraigBox | 66 | <pre> |
| 24 | MichaelBordignon | 67 | printer = raw |
| 68 | browseable = yes | ||
| 69 | public = yes | ||
| 70 | guest ok = yes | ||
| 71 | writable = yes | ||
| 72 | printable = yes | ||
| 27 | CraigBox | 73 | </pre> |
| 24 | MichaelBordignon | 74 | |
| 75 | 3. Restart Samba. | ||
| 76 | |||
| 77 | !!Storing profiles on a Samba 2.2.x server fails after applying either Win XP SP1 or Win 2k SP4 on the client | ||
| 78 | |||
| 79 | Microsoft changed things and it broke samba versions older than 2.2.6. 2.2.6 added a new config option (profile acls (S)) to allow a work around for this. Check the smb.conf man page from version 2.2.6 or higher. | ||
| 80 | |||
| 27 | CraigBox | 81 | Debian woody only ships version 2.2.3a with back-ported patches for security updates so needs to be updated for this to work. Use [Debian backported 2.2.9 packages|http://people.debian.org/~peloy/samba/]. Add =deb http://people.debian.org/~peloy/samba stable main= to your apt sources.list. |
| 24 | MichaelBordignon | 82 | |
| 83 | !!Offline files fails | ||
| 84 | |||
| 85 | If you have a file share with multiple users using it regularly, and one of the users tries to synchronize the files using Windows's "Offline Files" feature, you might find that random files fail. The user will have read/write access through their group, but the file will be owned by someone else. | ||
| 86 | |||
| 87 | !Why this is happening | ||
| 88 | |||
| 89 | From Jeremy Allison, Samba developer: ''"Windows does a sync by creating a new file with a temporary name, then sets an ACL on it that matches the current one (but seems to add write access for the current user, not just the owner). This must succeed else the sync will fail. Then it sets the DOS attributes, again this must succeed or the sync will fail. Under POSIX we encode the attributes in the file permissions and these can only be changed by the owner, unless the "dos filemode" parameter is set."'' | ||
| 90 | |||
| 91 | !How to fix it | ||
| 92 | Upgrade to at least Samba 3.0.0. Ensure that smbd is compiled with ACL support (the Debian packages work fine out of the box), and running on a filesystem with [POSIX] AccessControlLists. Then you also need to set the parameter "dos filemode = yes" for the share. You don't need the acl package installed, but you probably need libacl. | ||
| 30 | JohnMcPherson | 93 | |
| 94 | |||
| 95 | !!File copies fail with "<tt>smb_proc_readX_data: offset is larger than SMB_READX_MAX_PAD or negative!</tt>" | ||
| 96 | When coping a file from a windows server's share that is locally mounted with <tt>smbmount</tt> the copy fails with an I/O error and the following is in syslog: | ||
| 97 | <verbatim> | ||
| 98 | smb_proc_readX_data: offset is larger than SMB_READX_MAX_PAD or negative! | ||
| 99 | smb_proc_readX_data: -59 > 64 || -59 < 0 | ||
| 100 | </verbatim> | ||
| 101 | This only seems to happen with the <tt>kernel-image-2.6.8</tt> package in [Debian] Sarge. The error doesn't occur if you: | ||
| 102 | * use __smbclient__ interactively; | ||
| 103 | * mount the remote share as type <tt>cifs</tt> instead of type <tt>smbfs</tt>; or | ||
| 104 | * use a vanilla kernel or a backport of a later kernel that is packaged for debian. | ||
| 105 | |||
| 106 | There is a [debian bug report|http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289690] on this. | ||
| 31 | CraigBox | 107 | |
| 32 | AristotlePagaltzis | 108 | !! <tt>wbinfo -t</tt> fails with "<tt>error code was NT_STATUS_PIPE_NOT_AVAILABLE (0xc00000ac)</tt>" %%% <tt>wbinfo -r</tt> fails with "<tt>could not get groups for user <domain\username></tt>" |
| 31 | CraigBox | 109 | |
| 32 | AristotlePagaltzis | 110 | Set <tt>client schannel = no</tt> in your <tt>smb.conf</tt>. |
| 36 | IanMcDonald | 111 | |
| 112 | !! Getting Microsoft Vista and Samba to work together. | ||
| 113 | |||
| 114 | See http://www.builderau.com.au/blogs/codemonkeybusiness/viewblogpost.htm?p=339270746 | ||
| 26 | CraigBox | 115 | |
| 24 | MichaelBordignon | 116 | ---- |
| 117 | CategoryInteroperability |
lib/blame.php:177: Warning: Invalid argument supplied for foreach() (...repeated 2 times)