Intermittent Samba issue

[Matt Hearn]

Hi all! We're running Samba v2.2.8a on some HP-UX 11i servers, all L3000s. We have an intermittent issue that pops up every few months in which certain users are unable to connect, but others can. It was never a big deal before because it would eventually resolve itself somehow, but right now it's going on in the production environment, and it's been happening for four days. The customer is getting anxious, and I don't have any answers!

I can connect to the share using smbclient on the box, and the customer can connect from their Citrix servers. However, certain users need to be able to connect directly from their lab computers, which are running Windows 98 or 2000, and right now they are getting the following error:

"The mapped network drive could not be created because the following error has occurred:
An extended error has occurred"

This must be the all purpose "windows can't find the share" error, since I've been Googling it and it seems to indicate any one of a thousand problems.

I thought it might be a password issue, but the users are saying they never even get a prompt for a password.

I've stopped and started Samba, to no avail, and I don't see anything in the smbd.log or nmbd.log that indicates a problem.

Any ideas? Thanks!!!

[Mel Burslan]

Sounds like a network/firewall issue to me. I am under the impression that, these lab windows machines can telnet/ssh into the server. Is that right ? If so, is there a firewall or filtering routers in between the server and these machines. If yes, make sure the rules are not getting modified by a careless security admin jsut to test his/her new ruleset.

[Matt Hearn]

Thanks for the reply! I did consider a firewall change, and in fact did just do a test in which the customer was able to telnet from an affected system to port 139 on the UNIX server. I'm assuming if he can telnet to it, and it doesn't immediately hang the connection, then there's no firewall, right?

I'm not mistaken about Samba using just port 139, am I?

[Geoff Wild]

I believe you need 137, 138 and 139.

Rgds...Geoff

[Matt Hearn]

Yes, but only 139 should actually respond to telnet, right? I thought 139 was the only "session" port, meaning it was the only one that would hold a telnet connection.

[Mel Burslan]

I am not sure about the samba ports but in order to establish and hold a connection, they should all be open firewall-wise. And do not trust the telnet/port combination. I have seen nasty firewalls blocking traffic on unidentified protocol packets as well. Best way is the old fashined way of picking up the phone and talking to the fw admins and sweet talking them to re-check the configuration. Because, in my particular case, every part of the network is always perfectly functional. This is the default answer my network people are programmed to give. After triple checking the rulesets, they usually find a fat-fingered netmask or a hasty lockdown on a port range etc.

[Anand Sreenivasan · Accepted solution]

Matt,
I have seen this exact same error on my Unix servers which was running the same Samba Version. The issue was , There was a security patch updates on Windows side and all the users PC had those patches and this affected SMB protocol which is used by SAMBA. We went to microsoft and they say either remove the patches or upgrade SAmba. We decided to upgrade SAMBA as removing patches would mean a security hole on the users PC. Hope this helps you out.

[Steven E. Protter]

The windows firewall updates as part of XP SP2 sometimes(almost always) block networking which is exactly what Samba and windows to windows networking use.

Also, I was wondering just in case its a HP-UX issue if there is any notation in the log file defined in smb.conf

SEP

[Alzhy]

Watch your /var/opt/samba Log.* files. there may be clues in there. A samba client always creates a log.pcname in said directory.

Also, are you using WINS in your organisation? Is your SAMBA service a member of a Windows domain (ADP or DOMAIN?) (SECURITY = ? setting in your /etc/opt/samba/smb.conf).

If clueless, I'd suggest you upgrade to SAMBA 3.X:

B8725AA A.02.01.02 HP CIFS Server

Is the version we're running.. based on SAMBA 3.07 AND officially supported by HP.