Samba frustration root cant mount regular user gets wrong permissions

[John DeSoi, Ph.D. · Accepted solution]

I just spent an inordinate amount of time trying to get a read/write mount without root-only write permissions (RH8 to SMB on OS X). Any permissions passed to smbmount with the uid and gid options are ignored. This page:

http://www.lula.org/pipermail/lula/2003-May/000077.html

led me to try using mount -t smbfs in place of smbmount, and it magically works.

Hope this helps,

John DeSoi, Ph.D.
http://pgedit.com/
Power Tools for PostgreSQL

[Dave Falloon]

What output do you get on the server side when a client connects if you increase the debug level for smbd?

smbcontrol smbd debug 2

Then tail the /var/log/samba/log.smbd ( thats what it is on my debian box could be different on your FC2 box ) and reconnect, it should tell you what user name is connecting, also check the auth log to see what pam is saying.

I'm currently digging through samba docs will have more in a bit.

--Dave

[Steven E. Protter]

I encourage your efforts and thank you very much.

A week from today, I'm flying to Israel. I will have Internet access for most of the trip and will be able to continue running tests and follow up on this issue.

I will try and make some time and run this test and post output the next day or so.

SEP

[Steven E. Protter]

https://bugzilla.samba.org/show_bug.cgi?id=2223


"edited" changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |WONTFIX




------- Additional Comments From jerry@samba.org 2005-02-09 06:03 -------
Try the cifs fs for the 2.6 kernel.

http://www.samba.org/samba/Linux_CIFS_client.html


or look more into the unix extensions. We do not
maintain the smbfs kernel module. Sorry.

Its not a bug, its a feature.

Looks like they're telling me to mount differently.

SEP

[Fred Ruffet]

Hi SEP,

Always with my old config : RedHat 7.2, Samba 2.2.1. Mounting server on itself with "mount -f smbfs" and "smbmount" results in the same all_is_owned_by_root problem. But maybe my conf is too old. I can not even test the patch you mentionned due to this. I don't have another server here, but I'll try at home if I find time (but old versions too. I don't have time to upgrade, and it works so well).

Regards,

Fred

[Steven E. Protter]

Samba says the issue is we're using the smbfs toolset.

They want us to use cifs tools. That filesysetm is not built into my kernel.

SEP

[Fred Ruffet]

It's something I don't understand : I felt like CIFS was a project based on samba, and a bit like a concurent. Now, if the samba team is asking you to use cifs instead of their own product...

Regards,

Fred

[Steven E. Protter]

Interesting isn't it.

The tone of the message is that smbfs and smbmount is obsolete and they don't maintain it any more.

Interesting because Red Hat shipped the ES 3 OS with smbfs support and NOT CIFS support.

Though in many posts I've told users on the HP-UX side CIFS=Samba, that seems in practice not to be the case.

CIFS is something Oracle delivers with its suite and is independent.

The question now is how to put CIFS into an OS that does not have it. I imagine I'll need to download and install the software that Jerry links in the Bugzilla report.

Quite a PITA, if you ask me.

Seem to be right though, because windows which uses a CIFS based client and HP-UX which also uses a CIFS based client both mount properly and see correct permissions.

Solution level pointage for a fix.

SEP

[Bruce Copeland]

My guess is that the switch from smbfs emphasis to cifs emphasis is largely a result of divergence between the 2.4 and 2.6 kernels. Ever since switching some of our machines to FC2 or FC3 from FC1, I've been seeing a LOT of very poor performance and locking problems with smbfs mounts, and LOTS of other people report equivalent problems with smbfs running under 2.6 kernels. These don't occur on the FC1 machines (and never occurred with RH8 or RH9 before that). Cifs seems to resolve these problems, although it introduces new problems for some people because cifs doesn't support 'users' as a fstab option. That means only root can do a cifs mount (unless the mount tools are setuid root). This is OK in my situation, but I suspect it will produce major headaches for others.

Personally, I think this whole fiasco is part of a broader problem with inappropriate focus on the part of distros and kernel developers. The emphasis in the 2.6 kernels seems to be kernel reorganization and offering new esoteric features. Meanwhile more important stuff seems to lanquish. I've had to ditch the previous two major FC2/FC3 kernel package releases because of stupid bugs that break critical things (major ACPI screwups and broken parport). I am very much in favor of progress, and we Linux developers HAVE made huge progress in the past. But I think it's time to slow down a little and make sure we know what's really important.

Bruce

[Fred Ruffet]

Actually, I use samba on Linux (and I've done for long) and CIFS on HP-UX. I didn't installed those HP machines, and I had problems with them. So I was thinking I would go for samba when I have time. With what I heard here, I don't know anymore...

One thing is that I can't really compare, as I use samba as a server (mainly) and CIFS as a client (always). Samba is a very good server I even use as a PDC.

Problems I had with CIFS as client, is that it was built on the same stack as NFS. So I had the same problems : A windows server crashed and I was unable to umount the shares. I don't know if this kind of things happen with samba.

Regards,

Fred

[Steven E. Protter]

Fred,

Try soft versus hard mount on the cifs/nfs thing.

Yes, I was very displeased when I discovered the hard way cifs was built on the NFS stack.

Right now, I'm using NFS to provide access. I'd rather go pure samba/cifs, because the pitfalls that exist with NFS don't exist.

Well, we've clearly defined the problem. Now, what are we going to do about it? I'm personally going to ignore it for a few weeks while I travel to Israel. I may have some time an attempt a CIFS install on a client box, just for grins to see how it goes.

SEP

[Dave Falloon]

I may have a suggestion, I didn't see any admin users defined in the conf but this is right out of the samba docs under "File Operations done as ROOT even with force user set" :

When you have a user in admin users, Samba will always do file operations for this user as root, even if force user has been set.

(http://us4.samba.org/samba/docs/man/Samba-HOWTO-Collection/AccessControls.html)

That could be why all the files end up owned as root, if any admin users connects to a share the files are ALWAYS owned by root.

--Dave

[Dave Falloon]

This is just a post to keep this topic up so SEP see's it. no points

[Steven E. Protter]

The key issue appears still to be the need to build cifs into the kernel, since in an atrocious omission, RH did not bother to do so.

Until then I am forced to live with NFS.

SEP

[Steve_160]

I'm not all that sharp, but it seems to me that the basic problem is that the Windows filesystem, at least the versions I work with, simply don't support any kind of file ownership. Thus you have to tell Linux what permissions to use when you do a Samba mount, and it will use those permissions for all files.For "options" in fstab I use:rw,umask=000All files and directories are still owned by root, but everyone has read/write access to them.

[Dave Falloon]

Steve,

Samba supports a seamless conversion from windows file acl's to posix acls as long as the filesystem/kernel support posix acl's.

Acl's have been supported for years in most distros, to turn them on for your filesystem run this command as root:

mount -o remount,acl

And don't forget to add acl to the list of options in the fstab.

--Dave

[Dave Falloon]

Forgot to add, windows acl's are controlled through the security tab in the properties of a file.

the list will show all people with access to the file. To do the same in linux use the getfacl command to see all the permissions on a file:

getfacl filename

The syntax for setting file access control lists is a little tougher to get used to:

to give the group "windows" full access to the file /tmp/foo you would use the command:

bofh:/tmp# setfacl -m g:windows:rwx foo

you can then check the permissions like so:

bofh:/tmp# getfacl foo
# file: foo
# owner: root
# group: root
user::rw-
group::r--
group:windows:rwx
mask::rwx
other::r--

Using samba's link when you modify the security tab of a file on a samba share the acl's are added to the file in linux exactly as they are seen in windows.

--Dave

--Dave

[Dave Falloon]

SEP,

I forgot to ask if you had mapped the root user to an smbuser, ie. root is in the smbpasswd file?

Since samba takes care of initial authentication when it looks in smbpasswd for the user root it will come up with nothing. Turn on debugging output with smbcontrol smbd debug 3 and watch the samba log with root connects, you should see a line like this:

Plain-text authentication for user root returned NT_STATUS_NO_SUCH_USER.

Unless smbd knows the user, ie. you ran the mksmbpasswd.sh that comes with the package to dump your local /etc/passwd > sambas smbpasswd, the user cannot log in through samba. I agree with you're assessment that HP's cifsclient probably sits on top of nfs, though. Add root to the smbpasswd and see if you can mount the drive.

The other problem where the user creates files as root regardless of the force user settings I'm almost 100% positive thats because of an admin user = user setting someplace.

--Dave

[Steven E. Protter]

As noted earlier it seems we have a problem with Red Hat's implementation not including cifs. Perhaps they changed that with ES 4.0, but I kind of doubt it.

I will do the upgrade if possible and report results. The 2.6 kernel alone probably makes it worthwhile.

SEP

[Ben_192]

I'm adding this comment because I stumbled across this forum while wrestling with this same problem and would like others to be able to google for it in the future...

When a *nix machine mounts a remote samba share a CIF unix extension maps the remote share's file permissions to the local mount. This overrides and uid or gid settings in the mount command.

To disable the unix extension to CIFs add 'unix extensions = no' to your smb.conf on the server and restart samba. You should now be able to mount the share and specify the local uid/gid ownership in the mount command normally:

mount -t smbfs //fileserver/share /mnt/point -o credentials=credentials.file,uid=localuid,gid=localgid

- Ben

[Steven E. Protter]

You have to be kidding? That easy?

I will give it a try and hit you with 10 points if it works.

SEP

[Steven E. Protter]

Did not seem to work.

What distribution did you use? Can you link in some docs?

SEP

[Dave Falloon]

Hmm, so whilst drudging through a small samba issue of my own I stumbled across this post to the samba lists:

http://lists.samba.org/archive/samba/2004-October/094405.html

The guy basically says he has a patch for a bug where the server ignores the uid, gid, etc from a client, perhaps it was missed later down the line causing the bug to crop back up?

--Dave

[Steven E. Protter]

Interesting Dave,

This appears to be a kernel patch.

My Samba server is 2.6.5.1 Kernel.

My usual practice is to wait for RedHat to release an updated kernel and then install it.

On the RHEL side I'd have to upgrade the whole operation to RHEL 4.

I will test that on a sandbox server and see how it goes.

SEP

[Steven E. Protter]

Preliminary tests show that Red Hat ES 4 seems to solve this problem.

Since with your help this problem was found to be a kernel issue, as in CIFS was not integrated into the RH kernel, it would seem the engineers at Red Hat or Linus Torvold fixed the issue.

I will report back when the server farm I run is fully converted to CIFS/Samba and NFS has been eliminated.

SEP