Samba share and can create folder but not file

[Coolmar]

Hi,

I have samba running (v. 02.02) on an HPUX 11.11 system. Below you can find my smb.conf. I belong to the correct group to be able to write to the share, and am able to create a folder and create a file within that folder. However, I cannot create a file...I get access denied. Any ideas?

SMB.CONF:
[global]
workgroup = GROUP
netbios name = SERVER
server string = SERVER share
security = DOMAIN
map to guest = Bad User
password server = serverb
syslog = 0
log file = /var/opt/samba/log.%m
max log size = 1000
max smbd processes = 0
wins server = 10.117.10.40
idmap uid = 10000-200000
idmap gid = 10000-200000
winbind separator = +
winbind enum users = No
winbind enum groups = No
short preserve case = No
dos filetime resolution = Yes

[LYRS]
comment = Layers for GIS
path = /lyrs
valid users = DOMAIN+BETA
read only = Yes
force group = beta
write list = DOMAIN+BETA-ADMIN
directory mask = 0775
create mask = 0775
force create mode = 0775
security mask = 0775
max connections = 0

[Jannik · Accepted solution]

Try with this and build from it step by step.

[LYRS]
comment = Layers for GIS
path = /lyrs
read only = No
create mask = 0660
directory mask = 0770
guest ok = Yes

[Steven E. Protter]

Shalom,

I'm assuming this complaint is when domain users properly authenticate and the users domain and beta can not create files.

A few issues.

the write list inluces a user BETA-ADMIN that is not a valid suer for the share LYRS

The max connections=0 seems to indicate that nobody is allowed to connect. I'd comment that out.

I feel the most important issue is that this machine has perhaps either not joined the domain or its trust relationship with the domain has expired.

/opt/samba/bin/net join domain admin password

Also, lets look at the samba.log file and see if anything jumps out at us as for as error messages.

SEP

[Ken Grabowski]

Your LYRS share is set to "read only=Yes". Try changing it to "read only=no".

[Coolmar]

Shalom Steven,

Max connections=0 allows unlimited connections. Then BETA-ADMIN is a valid group that we have setup. We want the BETA users to have read-only and the BETA-ADMIN users to have read/write. This is also not to be "public". Here is what the log.winbindd is saying:

winbindd version 3.0.14a based HP CIFS Server A.02.02 started.
Copyright The Samba Team 2000-2004
[2006/01/30 14:27:33, 1] nsswitch/winbindd_user.c:winbindd_getpwuid(237)
could not convert uid 10473 to SID
[2006/01/30 14:27:33, 1] nsswitch/winbindd_user.c:winbindd_getpwuid(237)
could not convert uid 12968 to SID
[2006/01/30 14:32:30, 1] nsswitch/winbindd_sid.c:winbindd_uid_to_sid(403)
Could not convert uid 12968 to rid
[2006/01/30 14:33:11, 1] nsswitch/winbindd_sid.c:winbindd_uid_to_sid(403)
Could not convert uid 10473 to rid
[2006/01/30 14:33:51, 1] nsswitch/winbindd_sid.c:winbindd_uid_to_sid(403)
Could not convert uid 20000 to rid


I think this might have something to do with the idmap uid settings. I was going to try changing it to 5000-7000 tonight (can't bring down samba during working hours).

[Coolmar]

That being said...I still don't get why I would be able to create a folder but not a file....

[Coolmar]

For the LYRS share I want the BETA group to be able to read-only and I want BETA-ADMIN to be able to write. Is my share setup properly for that? The error that I get is the following:

[2006/01/30 19:08:43, 0] smbd/sec_ctx.c:initialise_groups(203)
Unable to initgroups. Error was Not owner

[Coolmar]

After alot more investigation, it seems that I can write to the shares but cannot rename or delete any files. I get the following error: Access denied ... disk full or write protected. Seems like a bug to me and things may have stopped working when I installed the latest Goldpak patch bundles. I really don't want to remove the entire bundles...is there a way to tell which patches would affect CIFS/Samba...or is there a place to go to find new patches that might fix this. I did upgrade CIFS software to the lastest as well.

[Steven E. Protter]

Shalom Sally,

I stand corrected on the max connections, I read it, but did not check it as we do not use it. I'd recommend this.

1) Look at the permissions in Unix and windows using the right mouse properties. Make sure they match. If not, see if the server is REALLY part of the domain.

2) go with a more basic setup that comments out directory mask create mask force create mode and security mask. Try your test again. Then add these features, if it works right one at a time until you find out which one is causing trouble. Restart samba every time.

SEP

[Coolmar]

Thanks Steven,

How do you check if it is "really part of the domain" ... like what command do I run and what result should I see?

Thanks!

[Coolmar]

Created new thread based on new findings