Problems with Cifs server

[Anders Gullberg]

Hi everybody!
I have some problems with cifs server. When a client should mapping his unix home directory he gets prompted to type loginid and password.
When i do the same , it is no problems att all.
In his logfile i get the following error:
(Look in the attachment file)

in my own logfile is nothing.
In smb.conf security is set to SERVER

Anyone got an idea???

[Rainer von Bongartz]

add the account to the smbpasswd file

smbpasswd -a

Regards
Rainer

[Darren Prior]

Hi,

Are you using a Windows PDC as the password server, or another CIFS server?

If it's another CIFS server, then ensure that you have the client's login id and password in smbpasswd, otherwise ensure that the login id is valid on the PDC.

Is this a problem for every user except you, or just for this one person?

regards,

Darren.

[Anders Gullberg]

Hi Rainer and thanks for your quickly respons!
We dont use smbpasswd at all.
now it works for the client i told about, but i havent changed anything at all.
We have this problem all the time for a numbers of users. Sometimes its work and sometimes not.
I wonder if it is some resource problem of any kind?

//Anders

[Rainer von Bongartz]

Anders,

could you please post your smb.conf ??


Regards
Rainer

[Anders Gullberg]

Hi Darren
We use windows PDC for password server.
The problem is not for a specific user/users
but the logfiles is full of the error mess
for a lot of users.

//Anders

[Darren Prior]

Hi,

It could be resource related - is this a new problem or has it been happening for some time?

I believe CIFS A.01.08 and above are more resource hungry than previous versions.

regards,

Darren.

[Zeev Schultz]

What sort of password server is this - Active Directory on Win2k?And what sort of client is this Win2k/XP or else?

Regards

[Steven E. Protter]

Here is a procedure for integrating a CIFS/9000 samba machine with a Windows NT or Windows 2000 PDC(primary domain controller).

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B8725-90021/B8725-90021_top.html&con=/hpux/onlinedocs/B8725-90021/00/00/34-con.html&toc=/hpux/onlinedocs/B8725-90021/00/00/34-toc.html&searchterms=Active%7cDirectory%7cPDC%7cCIFS&queryid=20030515-092432

I thought the smbpasswd command syntax was for a non PDC environment ...

smbpasswd -a

CIFS uses shared memory resources, make sher shmmax and shmseg and related kernel parameters are generous.

I'm throwing a wide net here because you've not provided enough information about your environment.

If my colleagues posts are of assistance to you ,please give them some deserved points.

This post is probably redundant, made to add just a tiny bit more information.

SEP

[Anders Gullberg]

Hi again all,

Sorry that i havent respond to you earlier, but i had alot of things to do that where more critical.
I attach smb.conf and version of Cifs is A.01.08. kernel parameters is as following:
shmseg 120
shmmax 67108864
I dont know exactly for how long iwe had this problem, but it is for a quite long time.

We run cifs on A180 hpux 11.00 528 MB memory.
Right now we have 40 users connected with cifs.

[Geoff Wild · Accepted solution]

With security = server, and password server is a BDC/PDC, then you need to have:

encrypt passwords = Yes


I used to get failed passwords before as well, did a search on google and found that sometimes the following helps resolve it:

keepalive = 0

"The value of the parameter (an integer) represents the number of seconds between keepalive packets. If this parameter is zero, no keepalive packets will be sent. Keepalive packets, if sent, allow the server to tell whether a client is still present and responding.

Keepalives should, in general, not be needed if the socket being used has the SO_KEEPALIVE attribute set on it (see socket options). Basically you should only use this option if you strike difficulties.

Default: keepalive = 300"


Additionally, I would add:

preferred master = False
domain master = False



Rgds...Geoff

[Rainer von Bongartz]

Set the following in smb.conf:

security = DOMAIN
encrypt passwords = Yes


REgards
Rainer

[Geoff Wild]

Just saw Rainer's post - I wouldn't set security=domain....

"SECURITY = DOMAIN

This mode will only work correctly if smbpasswd(8) has been used to add this machine into a Windows NT Domain. It expects the encrypted passwords parameter to be set to true. In this mode Samba will try to validate the username/password by passing it to a Windows NT Primary or Backup Domain Controller, in exactly the same way that a Windows NT Server would do.

Note that a valid UNIX user must still exist as well as the account on the Domain Controller to allow Samba to have a valid UNIX account to map file access to.

Note that from the client's point of view security = domain is the same as security = user . It only affects how the server deals with the authentication, it does not in any way affect what the client sees.

Note that the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing the server to automatically map unknown users into the guest account. See the map to guest parameter for details on doing this.

BUG: There is currently a bug in the implementation of security = domain with respect to multi-byte character set usernames. The communication with a Domain Controller must be done in UNICODE and Samba currently does not widen multi-byte user names to UNICODE correctly, thus a multi-byte username will not be recognized correctly at the Domain Controller. This issue will be addressed in a future release."

You shouldn't need it - security = server should work for you....

Rgds...Geoff

[Anders Gullberg]

Hi everyone,
Thanks all of you who respond my question.
Specielly Geoff, So far so have my problems disapeared. I guess it helped with "encrypted passwords = yes"

So again, thanks all of you.

//Anders