Samba Not Accessible by name

[Brian Killeen_4]

Howdy,

We recently moved a HPUX 11i box over to a new domain using set_parms initial. It has CIFS 2.2.8a running on it and was accessible via name. Since the move it is no longer accessible by XP machines in that domain. It is still accessible by machines in the old domain (weird) - I can access it no problem if I use the IP address. The error message I am getting is "The account is not authorised to login from this workstation"

Have tried the usual regkey in windows to allow plaintextpasswords and also have added encryption to it without avail. The fact that I can access it from IP would indicate no security problems... Here is my smb.conf file which I have recreated several times both manaually and through SWAT. Have restarted services everytime I tried a change.

# Samba config file created using SWAT
# from 10.35.4.34 (10.35.4.34)
# Date: 2006/09/12 17:05:35

# Global parameters
[global]
workgroup = MYDOMAIN
netbios name = ICEMAN
server string = HPUX Samba Server
security = SHARE
encrypt passwords = Yes
smb passwd file =
preferred master = No
local master = No
domain master = No
wins server = 10.35.32.60

[QAS]
comment = QAS Share
path = /QAS
guest ok = Yes

[AddressDoctor]
comment = Address Doctor Share
path = /AddressDoctor
guest ok = Yes

[MelissaData]
comment = MelissaData Share
path = /MelissaData
guest ok = Yes


I added the WINS in case that was the problem. Any thoughts on this would be most welcome.

Thanks in advance

Brian

[Steven E. Protter]

Shalom Brian,

If Samba is accessible by ip address and not name it could be as simple as DNS.

Is the server in the local DNS database where it has been moved? Does an nslookup provide a useful answer?

More precisely can nslookup iceman work?

Also, check the samba logs for more information on this. Please post a snippet that you think is relavent?

SEP

[Cesare Salvioni]

hi,
really i don't fully understand the beginning of ur question: what u mean we moved to a new domain with set_parms???
i mean, u talking about WINDOWS domain? i guess not because unix is not aware of WS domain, it could be samba but not unix system. So i guess u used it to change the ip address or the hostname of ur unix box.
Anyway, using SMB resources means basically three things:
1. connect the host through the network
2. be authenticated (user and password) from samba
3. be mapped to a unix valid username

now:
1. ping iceman from WS PC to test hostname resolution and network connection,
then try from the PC, from start/run to open \\iceman to see if ur wins resolve correctly the ux hostname, u should see the shared resources from ux, u can also try on ux the command smbclient -L iceman giving a ENTER when asking the password to set the samba configuration from ux itself (the command is usually in /opt/samba/bin.
2. authentication means PC is sending a username and a password and samba must check and authenticate them. If ur PC are w2k or xp inside a windows domain they are probably sending something like domain/username or username.domain or something like that and a crypted password. Forget regedit, set the preference smb password file (default should be /var/opt/samba/private or something like that, see swat) and use smbpasswd command on ux to set a username and password for ur users, i would suggest to change security to user. A better option if u have microsoft domain is to configure samba to ask the primary domain to authenticate the user, in this case u set security to domain and join with smbpasswd -j the ux box to the MS domain. This means when ur users change their password there is no need to change them on unix: unix is asking PDC.
3. any user must be mapped to a valid unix user, the default is same username, so in passwd must exists a username like th MS username.

After this long (maybe too much description) i think ur problem is only at the second point, i would try smbclient -L iceman and smbclient //iceman/share_name -U username -P password from unix to see what happens and see the log files in /var/opt/samba/log
Also u can modify the debug preference in smb.conf to get more info from the log files


REALLY hope it helps after this long writing :-)))

[Brian Killeen_4]

Thanks for your responses guys

The set_parms was purely to move the machine from iceman.old_domain.com to iceman.new_domain.com - a tidy up exercise.

Regarding using user authentication and passwords etc this is a non-runner as want anonymous access allowed to these shares hence the guest = ok line for each share.

These shares are used for a software build process and no passwords is easier for the developers scripts. There is no critical data on the shares and I will change them to read only so no point in changing security level in samba or authenticating off domains etc. Want to keep this as simple as possible.

The DNS thing might be a wee bit more relevant. At present the machine iceman is in the new_domain DNS and is accessible via nslookup and resolving/responding if I ping the machine. I had though, removed the entry from the old_domain dns. If I add it back into the old_domain dns (it is still live for the moment) then it suddenly becomes available again via the run command

\\iceman.old_domain.com

Note: It would still not be accessible as

\\iceman or

\\iceman.new_domain.com

When I say not accessible I get an error message saying "You do not have authority to log on from this workstation.

Interesting but there may be something weird going on with DNS. I will look into it a little more here but let me know your thoughts.

Thanks again for help

Brian

[Brian Killeen_4]

Pure evil - Have upgraded to CIFS 3.0.14a just in case - Same problem - Some PC's can gain access to the box while others can't even though they are all using DHCP. Will post some logs in case you might see something pertinent.

[Brian Killeen_4]

OK - more diags

If I login as my new user to the new domain then it gives the error "Not authorised to login from this workstation" although I can still access it if I only use the IP address.

If I login to the same machine (same ip configuration) with a user on the old domain then there is no problem using the name or the IP address.

Damn strange.

If it was a permissions thing I would think that I would have no access irrespective of using the name or the IP address.

Also if it was a name resolution issue then it should not let me access using the name when logged in as the old domain user.

Not sure what the hell is going on.

Any thoughts appreciated.

Regards

Brian

[Brian Killeen_4]

OK - more diags

If I login as my new user to the new domain then it gives the error "Not authorised to login from this workstation" although I can still access it if I only use the IP address.

If I login to the same machine (same ip configuration) with a user on the old domain then there is no problem using the name or the IP address.

Damn strange.

If it was a permissions thing I would think that I would have no access irrespective of using the name or the IP address.

Also if it was a name resolution issue then it should not let me access using the name when logged in as the old domain user.

Not sure what the hell is going on.

Also the guest = ok on the shares should give any un-authenticated user access as smbnull and offer at least read only.

Any thoughts appreciated.

Regards

Brian

[PSL Technical]

Hi Brian,

Did you resolve this samba issue. I have a similar problem.

Kind Regards,

John

[Brian Killeen_4]

Still very intermittent - Removing the old Domain and it's DNS appeared to resolve the problem with the particular machine in question so got us off the hook but still seeing issues with some clients....Sorry I can't be of more help