CIFS Client and Server on one ande the same UNIX box

[Van Poelvoorde]

Hi,

I have three problems with my CIFS/9000 server and CIFS/9000 client installation.
First let me document my configuration:

I have samba server and samba cifsclientd running on one and the same system named SAP(HP-UX system). So this means, my system called sap is at the same time playing the role of CIFS server and CIFS client.

The samba server is configured in security level:domain. The samba server was added to an NT domain named PSOEWSBE with PDC named NTACTION. This was done successfully after adding SAP with Server Manager to the NT domain on the PDC and executing the smbpasswd -j PSOEWSBE -r NTACTION command.
I configure PAM (/etc/pam.conf) in order to authenticate first on the PDC (ntlm) and as second try (fallback) on unix (/etc/passwd).

Now I have following problems and questions:
1. It seems that only users who are existing in the PDC SAM have access to the shares. In other words if I log in directly on SAP system with an account that is only known in the local /etc/passwd of that system, that person has no access to any CIFS mounted shares.
IS THIS NORMAL?

2. If I mount a CIFS share, I use following command:
mount -F cifs sap:shares /cifs/home

This works perfect. However when I want to mount a second share:
mount -F cifs sap:prod /cifs/prod
I receive a messag that I'm already logged in as user -->administrator<-- and he does not mount anything.
I can only do the mount after I did a cifslogout:

cifslogout sap

IS THIS NORMAL BEHAVIOUR, OR AM I JUST NOT UNDERSTANDING THE CIFS SERVER/CLIENT MECHANISM?

3. Th e biggest problem however is that I have problems with symbolic links. Both parameter wide links and follow symlinks in my smb.conf are configured "yes".
I have two cifs mounts:

sap:\\sap\shares on /cifs/home
sap:\\sap\prod on /cifs/prod

(\\sap\shares is in fact the dir /tmp_data/wim)
(\\sap\prod is in fact the dir /tmp_data/prod)

I create a link /cifsmnt to /cifs/home
/cifsmnt -> /cifs/home
When I do cd /cifsmnt, I have no problems.
When I create a link in /tmp_data/wim pointed to anywhere outside the share /tmp e.g., I have no trouble in seeing and accessing that link.
When I create however a link pointing to a file/directory in the same share or to another share on the same samba server, I receive NFS errors when I trie to access the share:

NFS lookup failed for server sap: RPC: Timed out
./prod not found
NFS getattr failed for server sap: RPC: Timed out

Is there anyone who can help me with those three problems, I would appreciate this very much.


Thanks in advace,
Wim Van Poelvoorde

[Bill Thorsteinson]

1. CIFS aka Samba uses Windows mechanisms to
handle passwords. These do not use the
UNIS password file. CIFS users must have
or be mapped to a valid UNIX userid. UNIX
users without a Windows id (in your case
an account on the PCD) will have only
guest access to windows shares. In CIFS
you can deny guest access.

The UNIX user can supply both a user id
and password to the tools used to access
CIFS mounts. Any valid userid and password
can be used.

2. It looks like administrator does not have
access to the second share. Check to see
if you can provide a user and password to
the mount command. If so, see if that works.

3. Windows' concept of links is different
than that used by UNIX. Windows and your
shares have no knowledge of how to access
files outside the shares. Your links into
the share work because you are moving within
the UNIX file system. Links within the
shares should be using Windows semantics.

I expect your NFS problem is a result of
your changing names before you mount the
directory. From the location of the
link the subdirectory 'prod' does not exist.
NFS then timeout waiting for it to be created.

Try not to have links within your CIFS shares.

You may achieve what you want by putting the
share on your UNIX server, and mounting
it using NFS for UNIX access and CIFS for
Windows acces.

[Van Poelvoorde]

Bill,

Thank you for your quick response.
For your remark on my first problem, I can agree. Only users with a Windows (PDC) account can have access since I'm using Domain (Windows NT) authentication.

For the second problem, I'm don't agree. I can mount the second share as root, but only after executin a "cifslogout sap" command. The question is not how to be able to mount the second share, but more why do I have to do a cifslogout first before I can do the second mount. For more details please read my first problem report at the beginning of this subject again.

For the third proble, I want to stress that I AM using UNIX shares. I have in fact a UNIX system that is running a CIFS server and as CIFS client at the same time (smbd, nmbd and cifsclientd daemons are active). The links in my UNIX CIFS share only work when the links are pointing outside the share. If the links are pointing to the same share or to other UNIX shares (of the same CIFS server), I have problems. For more details please read the first problem report again.

Thank you very much, but I'm still wrestling with those two CIFS problems.


kind regards,
Wim

[Van Poelvoorde]

Hi,

I recently added another UNIX system on the same network as my CIFS Server/Client UNIX system and configured it as a CIFS client (only cifsclientd active).
I also configured there PAM for the same NT domain.
From there I can mount the CIFS shares and the links are working without problems, so the problem only exists on the system that is running CIFS Server and Client at THE SAME TIME.

Can anyone help me please, cause this is a very important problem for me.

Thanks in advance and kind regards,
Wim Van Poelvoorde