cheatsheet on Seneca samba setup

• smbclient -L vm2
• smbclient -L vm2
• smbclient -L vm2
• smbclient -L vm2
• smbclient -L vm2
• smbclient -L vm2
• smbclient -L sa

• smbclient -L //sa that expanded to -L//southamerica (I did not specifiy a username, but it automatically inserted my linux username from which I issued the smbclient -L //sa command)
• see detailed section on smbclient below.

Also, from a terminal/ssh on vm2, running testparm will show you info.

zintis@asia ~[159] $ >>> first as a user "zintis"
smbclient -L sa
directory_create_or_exist: mkdir failed on directory /var/lib/samba/lock/msg.lock: Permission denied
Unable to initialize messaging context
Enter SAMBA\zintis's password: 
Anonymous login successful   <<<<<<<<<<<<<<<<<<<  did NOT login as zintis

	Sharename       Type      Comment
	---------       ----      -------
	sarmation       Disk      sarmation
	kaapvaal        Disk      kaapvaal
	gawler          Disk      gawler share
	laurasia        Disk      laurasia
	gondwana        Disk      gondwana share
	home            Disk      zintis-home
	IPC$            IPC       IPC Service (Zintis-Samba-SA)
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available
zintis@asia ~[160] $


zintis@asia ~[161] $  <<<<<<<<<<<<  now as a different user:
smbclient -L sa -U sarmation-zintis
directory_create_or_exist: mkdir failed on directory /var/lib/samba/lock/msg.lock: Permission denied
Unable to initialize messaging context
Enter SAMBA\sarmation-zintis's password: 

	Sharename       Type      Comment
	---------       ----      -------
	sarmation       Disk      sarmation
	kaapvaal        Disk      kaapvaal
	gawler          Disk      gawler share
	laurasia        Disk      laurasia
	gondwana        Disk      gondwana share
	home            Disk      zintis-home
	IPC$            IPC       IPC Service (Zintis-Samba-SA)
	sarmation-zintis Disk      generic homes
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available

for example smbclient -L ftp -I ftp.microsoft.com

• mount -t cifs //vm2/home /tmp/vm2-home -o username=kaapvaal-zintis
• dnf install nfs-utils
• mount -t cifs //vm2/home /tmp/vm2-home -o username=zintis

smbclient command has these common parameters:

• -W workgroup
• -U username

Where workgroup is what is defined in the smb.conf [workgroup] lines.

   smbclient //sa/gawler -U gawler-zintis -W gawler 
   Enter GAWLER\gawler-zintis's password: 
   Try "help" to get a list of possible commands.
   Smb: \> net use
   net: command not found
   smb: \> help
   ?              allinfo        altname        archive        backup         
   blocksize      cancel         case_sensitive cd             chmod          
   chown          close          del            deltree        dir            
   du             echo           exit           get            getfacl        
   geteas         hardlink       help           history        iosize         
   lcd            link           lock           lowercase      ls             
   l              mask           md             mget           mkdir          
   more           mput           newer          notify         open           
   posix          posix_encrypt  posix_open     posix_mkdir    posix_rmdir    
   posix_unlink   posix_whoami   print          prompt         put            
   pwd            q              queue          quit           readlink       
   rd             recurse        reget          rename         reput          
   rm             rmdir          showacls       setea          setmode        
   scopy          stat           symlink        tar            tarmode        
   timeout        translate      unlock         volume         vuid           
   wdel           logon          listconnect    showconnect    tcon           
   tdis           tid            utimes         logoff         ..             
   !              
   smb: \> 
   smb: \> l
     .                                   D        0  Mon Jul 27 23:41:24 2020
     ..                                  D        0  Sun Apr  5 15:14:17 2020
     Assignment2                         D        0  Sat Apr 11 10:25:33 2020
     Gawler-was-here                     N        0  Wed Jul 22 18:22:32 2020
     .DS_Store                          AH     8196  Wed Jul 22 17:01:54 2020
     ._mbp-gawler-zintis.rtf            AH     4096  Wed Jul 22 17:01:43 2020
     ._.DS_Store                        AH     4096  Sat Apr 11 10:58:04 2020
     gawler.txt                          A       15  Mon Jul 27 23:41:24 2020
     mbp-gawler-zintis.rtf               A      422  Wed Jul 22 15:45:16 2020

		3542752 blocks of size 1024. 1338124 blocks available
  smb: \> 
pwd

lists all SELinux boolean values

See: wiki.centos.org for what seboolean variables most Centos systems have.

cat /etc/samba/smb.conf

[global]
workgroup = WORKGROUP
server string = Zintis-Samba-vm2 
encrypt passwords = yes
security = user
passdb backend = tdbsam
unix extensions = no
client use spnego = no    # this should have been yes.

[home]
comment = Zintis-samba-vm2  
path = /home/zintis
public = no
writable = yes
printable = no
create mask = 0765
valid users = zintis

[homes]
comment = automatic home share 
public = no
writable = yes
printable = no
create mask = 0765
browseable = no
hosts allow = 192.168.0.0/16 127.0.0.1

• spnego is "Simple and Protected NEGOtiation from rfc2478.

spnego is helps SAMBA 3.0 to agree upon an authentication method. It enables Kerberos authentication in particular.

client use spnego = yes is the default.

I know this is an old thread, but this might help someone. I solved this by setting the setgid bit to 2 (instead of 0) so the directories / files are created with group write permissions, e.g.

force create mode = 2777
force directory mode = 2777

From the man page: create mask (S)

When a file is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, and the resulting UNIX mode is then bit-wise 'AND'ed with this parameter. This parameter may be thought of as a bit-wise MASK for the UNIX modes of a file. Any bit not set here will be removed from the modes set on a file when it is created.

The default value of this parameter removes the group and other write and execute bits from the UNIX modes.

Following this Samba will bit-wise 'OR' the UNIX mode created from this parameter with the value of the force create mode parameter which is set to 000 by default.

This parameter does not affect directory masks. See the parameter directory mask for details.

Default: create mask = 0744

Example: create mask = 0775

File and directory creation masks are similar to umasks you have probably encountered while working with Unix systems. They are used to help define the permissions that will be assigned to a file or directory at the time it is created. Samba's masks work differently in that the bits that can be set are set in the creation mask, while in Unix umasks, the bits cannot be set are set in the umask. We think you will find Samba's method to be much more intuitive.

Once in a while you might need to convert between a Unix umask and the equivalent Samba mask. It is simple: one is just the bitwise complement of the ' other. For example, an octal umask of 0022 has the same effect as a Samba mask of 0755.

Unix umasks are set on a user-by-user basis, usually while executing the GUI's or command-line shell's startup scripts. When users connect to a Samba share from a network client, these scripts are not executed, so Samba supplies the ability to set the creation masks for files and directories. By default, this is done on a share-by-share basis, although you can use the include parameter in the Samba configuration file (as explained in Chapter 6) to assign masks on a user-by-user basis, thus matching conventional Unix behavior.

To show how Samba's create masks work, suppose we have a Windows user connecting to his Unix home directory through Samba, and Samba is configured with create mask = 777 in the [homes] share. With this value, create mask will not affect the bits that are set on new files. If the user creates a file with Wordpad, it will appear in the Unix filesystem like this:

$ ls -l file.doc
-rwxrw-rw-    1 jay      jay             0 Sep 21 11:02 file.doc
Wordpad created the file with read/write permissions 

(i.e., the MS-DOS read-only attribute was not set), so Samba mapped the MS-DOS attributes to Unix read/write permissions for user, group, and other. The execute bit is set for the owner because by default, the map archive parameter is set to yes. The other execute bits are not set because map system and map hidden are set to no by default. You can customize this behavior as you see fit, and unless you do backups from MS-DOS or Windows systems, you might want to specify map archive = no to avoid Windows files from appearing as executables on the Unix system.

Now suppose we set create mask to have an effect. For example:

[homes]

directory mask (S)

This parameter is the octal modes which are used when converting DOS modes to UNIX modes when creating UNIX directories.

When a directory is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, and the resulting UNIX mode is then bit-wise 'AND'ed with this parameter. This parameter may be thought of as a bit-wise MASK for the UNIX modes of a directory. Any bit not set here will be removed from the modes set on a directory when it is created.

The default value of this parameter removes the 'group' and 'other' write bits from the UNIX mode, allowing only the user who owns the directory to modify it.

Following this Samba will bit-wise 'OR' the UNIX mode created from this parameter with the value of the force directory mode parameter.

This parameter is set to 000 by default (i.e. no extra mode bits are added).

Default: directory mask = 0755

Example: directory mask = 0775

This parameter is the octal modes which are used when converting DOS modes to UNIX modes when creating UNIX directories.

In our case since I created a share with path = /supercontinents/cratons I have to issue the command:

chcon -R -t samba_share_t /windata

See man chcon, but basically, -R (recursively) make everything in /windata have rights as a type (-t) as a samba_sharet type.

chcon is for changing context

From linux-training.be

"Similar to create mask, but different. Where the mask from above was a logical AND, the mode you set here is a logical OR (so it adds permissions). You can use the force create mode and force directory mode to set the minimal required permissions for newly created files and directories."

Each user that will access an smb share on a Samba server has to be defined in smb, using the smbpasswd -a <userid> command.

The userid has to already be defined as a userid on the unix system i.e. in /etc/passwd.

Once a user has been created (using the above smbpasswd -a command) you can change a user's password by dropping the -a For example: smbpasswd userid

Confirm that the user was created using pdbedi -L -v Remember it as "Password Database Edit"

---------------
Unix username:        zintis
NT username:          

Account Flags:        [U          ]
User SID:             S-1-5-21-1353011415-3308762633-1882441262-1000
Primary Group SID:    S-1-5-21-1353011415-3308762633-1882441262-513
Full Name:            zintis
Home Directory:       \\vm2\zintis
HomeDir Drive:        
Logon Script:         
Profile Path:         \\vm2\zintis\profile
Domain:               VM2
Account desc:         
Workstations:         
Munged dial:          
Logon time:           0
Logoff time:          Wed, 06 Feb 2036 10:06:39 EST
Kickoff time:         Wed, 06 Feb 2036 10:06:39 EST
Password last set:    Fri, 06 Mar 2020 18:45:54 EST
Password can change:  Fri, 06 Mar 2020 18:45:54 EST
Password must change: never
Last bad password   : 0
Bad password count  : 0
Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
root@vm2 /etc/samba [309]$ 

From the man page: There are five main ways to use pdbedit:

• adding a user account,
• removing a user account,
• modifying a user account,
• listing user accounts,
• importing users accounts.

To see the current parameters of a Sambsa server, use the testparm command.

testparm
Load smb config files from /etc/samba/smb.conf
WARNING: No path in service home - making it unavailable!
NOTE: Service home is flagged unavailable.
Loaded services file OK.
Server role: ROLE_STANDALONE
---
Press enter to see a dump of your service definitions
---
# Global parameters
[global]
     security = USER
     server string = Zintis-Samba-vm2 encrypt passwords = yes
     idmap config * : backend = tdb


[home]
     available = No
     comment = Zintis-samba-vm2 path = /home/<yourSenecaID>
     create mask = 0765
     read only = No
     valid users = zintis


[homes]
     browseable = No
     comment = automatic home share public = no
     create mask = 0765
     hosts allow = 192.168.111.0/24 127.0.0.1
     read only = No
root@vm2 /etc/samba [308]$ 

This lists the available shares, to a user based on a login:

• smbclient -L vm2 # this is an anonymous connection (no passwd needed)
• smbclient -L southamerica # this is an anonymous connection (no passwd needed)
• smbclient -L //sa # this is an anonymous connection (no passwd needed)a that expanded to -L//southamerica (I did not specifiy a username, but it automatically inserted my linux username from which I issued the smbclient -L //sa command)
• smbclient -L //sa -U kaapvaal-zintis this failed "Unable to connect with SMB1 – no workgroup available" That was because user "kaapvaal-zintis" was not set up as a "valid user" for the share /home, only zintis. ? No it is deeper than that…

zintis@southamerica ~ [159]$
smbclient -L //southamerica
Unable to initialize messaging context
Enter WORKGROUP\zintis's password: 

     Sharename       Type      Comment
     ---------       ----      -------
     pana            Disk      panaeaic
     cratons         Disk      craton
     home            Disk      zintis-home
     IPC$            IPC       IPC Service (Zintis-Samba-SA)
     zintis          Disk      generic homes
Reconnecting with SMB1 for workgroup listing.

     Server               Comment
     ---------            -------

     Workgroup            Master
     ---------            -------
zintis@southamerica ~ [160]$
smbclient -L //southamerica -U gawler-zintis
Unable to initialize messaging context
Enter WORKGROUP\gawler-zintis's password: 

     Sharename       Type      Comment
     ---------       ----      -------
     pana            Disk      panaeaic
     cratons         Disk      craton
     home            Disk      zintis-home
     IPC$            IPC       IPC Service (Zintis-Samba-SA)
     gawler-zintis   Disk      generic homes
Reconnecting with SMB1 for workgroup listing.

     Server               Comment
     ---------            -------

     Workgroup            Master
     ---------            -------
zintis@southamerica ~ [161]$

• smbclient ‘//127.0.0.1/home’ -U zintis
• smbclient vm2/home -U zintis
• smbclient '\\vm2\homes' -U zintis
• smbclient -U zintis -L sa # where sa resolves to southamerica (dns)
• smbclient //localhost/home -U \kaapvaal-zintis

Usually samba servers are referred to or called by name.

• smbclient '\\vm2\home' -U zintis
• smbclient //sa/gawler -U gawler-zintis -W gawler

But if you don't have dns or /etc/hosts defined, you can simply smbclient //sa/gawler -U galwer-zintis -I 172.28.105.5

Also using mount via ip address: mount -t cifs //sa/gawler <mount-point> -o ip=172.28.105.8

Apparently you don't even need the -I so this should work: smbclient //172.28.105.5/home -U zintis

Apprently though, you need to provide a different client max protocol by using the -m tag, like so: =smblcient /172.28.105.8/home -m SMB3 ?

smbclient -d 3 -L //sa -W WORKGROUP -U zintis smbclient -d3 -L //10.5.4.25 -W workgroup -U userid ( i.e. include the workgroup )

root@southamerica ~ [991]$
smbclient -L //sa -U gawler-zintis
Enter WORKGROUP\gawler-zintis's password: 

	Sharename       Type      Comment
	---------       ----      -------
	pana            Disk      panaeaic
	cratons         Disk      craton
	home            Disk      zintis-home
	IPC$            IPC       IPC Service (Zintis-Samba-SA)
	gawler-zintis   Disk      generic homes
Reconnecting with SMB1 for workgroup listing.

	Server               Comment
	---------            -------

	Workgroup            Master
	---------            -------
root@southamerica ~ [992]$
root@southamerica ~ [992]$
smbclient -d 3 -L //sa -U gawler-zintis
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[global]"
Registered MSG_REQ_POOL_USAGE
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[global]"
added interface ens3 ip=172.28.105.8 bcast=172.28.105.8 netmask=255.255.255.255
Client started (version 4.10.4).
Connecting to 172.28.105.8 at port 445
got OID=1.3.6.1.4.1.311.2.2.10
Enter WORKGROUP\gawler-zintis's password: 
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
Got challenge flags:
Got NTLMSSP neg_flags=0x628a8215
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088215

	Sharename       Type      Comment
	---------       ----      -------
	pana            Disk      panaeaic
	cratons         Disk      craton
	home            Disk      zintis-home
	IPC$            IPC       IPC Service (Zintis-Samba-SA)
	gawler-zintis   Disk      generic homes
Reconnecting with SMB1 for workgroup listing.
Connecting to 172.28.105.8 at port 139
got OID=1.3.6.1.4.1.311.2.2.10
Got challenge flags:
Got NTLMSSP neg_flags=0x628a8215
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088215

    Server               Comment
    ---------            -------

    Workgroup            Master
    ---------            -------
root@southamerica ~ [993]$

  root@vm2 /etc/samba [341]$ 
  smbclient //localhost/home -U zintis
  Enter WORKGROUP\zintis's password: 
  Try "help" to get a list of possible commands.
  smb: \> 
  smb: \> help
  ?              allinfo        altname        archive        backup         
  blocksize      cancel         case_sensitive cd             chmod          
  chown          close          del            deltree        dir            
  du             echo           exit           get            getfacl        
  geteas         hardlink       help           history        iosize         
  lcd            link           lock           lowercase      ls             
  l              mask           md             mget           mkdir          
  more           mput           newer          notify         open           
  posix          posix_encrypt  posix_open     posix_mkdir    posix_rmdir    
  posix_unlink   posix_whoami   print          prompt         put            
  pwd            q              queue          quit           readlink       
  rd             recurse        reget          rename         reput          
   rm             rmdir          showacls       setea          setmode        
  scopy          stat           symlink        tar            tarmode        
  timeout        translate      unlock         volume         vuid           
  wdel           logon          listconnect    showconnect    tcon           
  tdis           tid            utimes         logoff         ..             
  !              
  smb: \> 
  smb: \> l
  .                                   D        0  Wed Mar  4 23:12:43 2020
  ..                                  D        0  Fri Mar  6 10:25:42 2020
  .bash_logout                        H       18  Fri May 10 20:16:55 2019
  .bash_profile                       H      141  Fri May 10 20:16:55 2019
  .ssh                               DH        0  Sun Jan 26 23:39:47 2020
  .bash_history                       H    11509  Fri Mar  6 21:13:45 2020
  iptab-original-clean                N     1069  Sun Feb  9 18:47:20 2020
  iptab-vm2-lab2b-needs-work          N     1261  Sun Feb  9 19:16:18 2020
  iptab-vm2-lab2b-clean               N     1406  Mon Feb 10 01:20:38 2020
  dead.letter                         N     1700  Fri Feb 28 11:33:44 2020
  .lesshst                            H       51  Mon Feb 24 13:12:44 2020
  iptables-clean-Mar-2nd              N     1557  Mon Mar  2 20:11:40 2020
  .bashrc                             H     1147  Wed Mar  4 19:20:30 2020
  iptables-clean-lab4b-thunderbird      N     1634  Wed Mar  4 23:12:43 2020

		6486016 blocks of size 1024. 4755716 blocks available
  smb: \> 
--------------------------

mount -t cifs //eu/home /tmp/eu-home -o username=zintis Password for zintis@//eu/home: ** mount error(2): No such file or directory Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

I was able to mount //vm2/home from vm1

To un-mount all cifs mounts.

(remember this is old, and probably obsolete) mkdir /mnt/smb mount -t smbfs -o username=yoursmbusernamehere //remotemachineip/remotesharename /mnt/smb

then you will probably be prompted for a password

add kdebase3-samba package and check that smb protocol is activated in konqueror settings (previews&meta-data)

Shall I install kdebase3-samba ?

Open smb://<outside ip address of c8host/home Where home is a "share" defined in /etc/samba/smb.conf file as a section, [home]

I did this successfully just by going ot the root smb URL and then logging in as one of the three users. Each user would be mounted to the correct corresponding directory. Cool.

Seems like the group for files/directories under var/lib/samba should perhaps be something like samba into which any authorized users could be added and thus be able to create/access files under /var/lib/samba/lock or /var/lib/samba/private. doing this manually eliminates this error message and allows msg.sock & msg.lock to be created (though they are created as the user running smbclient - which would then likely cause problems for another user)

This seems to be related to the lock directory option from smb.conf (https://bugzilla.redhat.com/show_bug.cgi?id=1661959) set to a non writable folder for users.

Here is an example (FROM ROOT) smbclient //sa/gawler -U gawler-zintis -W gawler

root@c8host ~[1008] $
smbclient //sa/gawler -U gawler-zintis -W gawler 

Enter GAWLER\gawler-zintis's password: 
Try "help" to get a list of possible commands.
smb: \> net use
net: command not found
smb: \> help


smb: \> pwd
Current directory is \\sa\gawler\
smb: \> ls
  .                                   D        0  Mon Apr  6 19:59:24 2020
  ..                                  D        0  Sun Apr  5 15:14:17 2020
  three                               N        0  Mon Apr  6 19:59:24 2020
  one                                 N        0  Mon Apr  6 19:59:24 2020
  two                                 N        0  Mon Apr  6 19:59:24 2020

		3542752 blocks of size 1024. 1470436 blocks available
smb: \> 

And now notice the EXACT SAME OUTPUT when I leave off the workgroup. So, who sets the workgroup? the //sa/galwer is just the "share" defined in [gawler] section in /etc/samba/smb.conf I think. - confirm.