smbtree returns NT_STATUS_ACCESS_DENIED from Windows computers

SwissHeritage · 03-26-2009, 05:15 AM

My Toshiba Satellite is on a router network with my wife's HP Pavilion and my son's Dell Inspiron, both running Vista Home Premium. All the connections are wireless. I have a user account on my wife's Pavilion with all my files, and I use the Satellite as a terminal for that account when she's home.

Most of the time, smbtree returns NT_STATUS_ACCESS_DENIED from both Vista computers, but sometimes it doesn't on one or the other. I've tried changing the firewall settings on the Pavilion a few times, and even disabled it twice to see what would happen, but never on the Inspiron. No matter what I do, I get the error message sometimes, and sometimes not. When smbtree does not return NT_STATUS_ACCESS_DENIED from a computer, then I can access it by name from KNetAttach. Otherwise, I have to use the IP address.

I'm not sure the NT_STATUS_ACCESS_DENIED really means anything. A few times I've seen another message about the computer not being reachable, and I might have seen NT_STATUS_ACCESS_DENIED from a computer when it wasn't even on.

I'd like to try to find out what's going on, out of curiosity, and also hopefully to resolve it so I don't have to verify the IP address every time I connect to the Pavilion. I don't want to give it a static IP address. It's my wife's computer and the less I have to tinker with its configuration the better.

Here's the output of smbtree:

Code:

WORKGROUP
   \\SLACKWARE
      \\SLACKWARE\IPC$    IPC Service (Samba Server)
      \\SLACKWARE\tmp     Temporary file space
   \\PAVILION-DV6700
timeout connecting to 218.83.175.154:445
timeout connecting to 218.83.175.154:139
cli_start_connection: failed to connect to PAVILION-DV6700<20> (0.0.0.0). Error NT_STATUS_ACCESS_DENIED

Code:

I just now tried it again and got this:
WORKGROUP
   \\SLACKWARE
      \\SLACKWARE\IPC$     IPC Service (Samba Server)
      \\SLACKWARE\tmp      Temporary file space
   \\PAVILION-DV6700

with no errors. Then I tried connecting to the Pavilion with KNetAttach, using the computer name, and it worked.

I haven't changed any settings on the the Pavilion for hours, but I did have to restart the wlan connection from the Satellite fifteen or twenty minutes ago.

RESOLUTION (2009-03-31):

I found out I needed to add "wins" on the "hosts" line in /etc/nsswitch.conf, before "dns", like this:

Code:

hosts:  	files wins dns

Without that, the system didn't always resolve the name on the local network, and went looking for it on my ISP's DNS. The "218.83.175.154" address belongs to my ISP.

Alien_Hominid · 03-26-2009, 09:00 AM

Why the PAVILION PC is resolved to external IP address?

SwissHeritage · 03-26-2009, 07:23 PM

Quote:

Originally Posted by Alien_Hominid

Why the PAVILION PC is resolved to external IP address?

You mean 218.83.175.154? Good question. I have no idea. Where could it be getting that address? I looked it up, and that address is in a range of addresses that are reserved for my ISP. Where is Samba getting that address? From the router? From a slackware cache?

Here's what I get from smbtree most of the time, when both computers are on:

----
WORKGROUP

\\SLACKWARE Samba Server
\\SLACKWARE\IPC$ IPC Service (Samba Server)
\\SLACKWARE\tmp Temporary file space

\\PAVILION-DV6700 Pavilion dv6838nr

timeout connecting to 218.83.175.154:445
timeout connecting to 218.83.175.154:139
cli_start_connection: failed to connect to PAVILION-DV6700<20> (0.0.0.0). Error NT_STATUS_ACCESS_DENIED

\\INSPIRON-1420 inspiron 1420

timeout connecting to 218.83.175.154:445
timeout connecting to 218.83.175.154:139
cli_start_connection: failed to connect to INSPIRON-1420<20> (0.0.0.0). Error NT_STATUS_ACCESS_DENIED
----

Just now I'm not getting an error message from either computer, and I can access both of them with KNetAttach, using their names.

I just rebooted both of them a few minutes ago. It might be that when I've been able to access them using their names has been just after they've been rebooted. I'll keep checking, and when I start getting the errors again, I'll try rebooting one of them and see what happens.

Meanwhile, does anyone have any ideas to help me find out how the address 218.83.175.154 is getting associated with those computer names?

SwissHeritage · 03-27-2009, 01:28 AM

Update:

I now have a static IP in slackware on my Satellite, and I put my ISP DNS in resolv.conf. I'm able to connect to the network, and surf the Web. I'm still able to access the Pavilion Vista shares from KNetAttach, using the IP address. I'm still having the same problems trying to access the Vista shares, using the computer name, and smbtree is still thinks the Pavilion is at 218.82.175.154. Sometimes, not all the time. Sometimes it finds the Pavilion, and that's when I can use the computer name in KNetAttach. It seems to be totally random. I went for a long time without rebooting the Pavilion, and it still went back and forth between being accessible by name and not. The Pavilion and the Inspiron can always find each other by name, even when the Satellite can't find either one of them by name.

As I said, 218.82.175.154 is in a range of addresses reserved for my ISP. My current theory is that sometimes, for some reason, when Samba is searching for a computer on the local network by name, instead of giving it the local address, the router tries to find the name on the ISP DNS. The ISP DNS doesn't find it, and forwards the router to an error page, at 218.82.175.154. That's why Samba sees the same IP address for both computers.

Does that sound possible to anyone, and if so, do you have any ideas about what could be happening? Could it be Samba that's asking the router to look on the Internet instead of on the local network? The Vista computers never have any problem finding each other by name.

Alien_Hominid · 03-27-2009, 11:19 AM

Please post your /etc/nsswitch.conf

SwissHeritage · 03-27-2009, 07:39 PM

Quote:

Originally Posted by Alien_Hominid

Please post your /etc/nsswitch.conf

Code:

#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
#      nisplus or nis+         Use NIS+ (NIS version 3)
#      nis or yp               Use NIS (NIS version 2), also called YP
#      dns                     Use DNS (Domain Name Service)
#      files                   Use the local files
#      [NOTFOUND=return]       Stop searching if not found so far
#

# passwd:     files nis
# shadow:     files nis
# group:      files nis

passwd:     compat
group:      compat

hosts:      files dns
networks:       files

services:       files
protocols:      files
rpc:        files
ethers:     files
netmasks:       files
netgroup:       files
bootparams:     files

automount:      files
aliases:        files

I tried accessing the Vista Pavilion from slackware on the Satellite, using telnet. I noticed that if I used a nonexistent computer name, it tried to connect to the same 218.82.175.154 address. Now I'm imagining that it can find the Pavilion by name on the LAN sometimes, and sometimes not, and that it searches on the DNS for any name it can't find on the LAN. As I understand it, slackware does not cache any addresses. What about Samba? If there is no cache on the Satellite, then the problem must be with a cache on the router? Does the router have the address for the Pavilion sometimes, and sometimes not? If so, how could that happen, and why can the two Vista computers find each other by name, even when Samba on the Satellite can't find either of them by name?

I've given up hope on making this work without using a static IP on the Pavilion, but now I'm curious, and I would just like to find out what's going on.

SwissHeritage · 03-27-2009, 10:08 PM

I also have Ubuntu on my Satellite, and smbtree in Ubuntu gives me the same results:

Code:

WORKGROUP
	\\UBUNTU         		ubuntu server (Samba, Ubuntu)
		\\UBUNTU\homes          	Home Directories
		\\UBUNTU\print$         	Printer Drivers
	\\PAVILION-DV6700		Pavilion dv6838nr
timeout connecting to 218.83.175.154:445
timeout connecting to 218.83.175.154:139
cli_start_connection: failed to connect to PAVILION-DV6700<20> (0.0.0.0). Error NT_STATUS_ACCESS_DENIED
	\\INSPIRON-1420  		inspiron 1420
timeout connecting to 218.83.175.154:445
timeout connecting to 218.83.175.154:139
cli_start_connection: failed to connect to INSPIRON-1420<20> (0.0.0.0). Error NT_STATUS_ACCESS_DENIED

In Ubuntu, I can still mount a Vista share on the Pavilion, using the IP address.

Somehow Vista is able get the names resolved to the local address by the router, but Samba can't. Or maybe Vista has its own cache and accesses the other computers on the LAN by IP instead of by name. It seems to me that the router must associate computer names with IPs somehow, or the names would never work. Or can the computers get the LAN IPs directly from the router, and then ask the computers for their names? How does Vista do it, and how does Samba do it?

cor67393 · 03-28-2009, 06:39 AM

What (if any) do you have specified in your smb.conf regarding "name resolve order"? The default is, in order: lmhosts host wins bcast.

To resolve a name to an ip adress, samba will first look in the lmhosts file. You can create this in the same directory as where smb.conf resides and it works the same as /etc/hosts but for netbios (samba server) name to ip mapping. Useful for static ip adress scenarios. The file does not exist by default.

Samba will then look /etc/hosts, nis and dns lookups. This is where your smbtree goes wrong I believe, because dns lookups are done for computers outside your subnet. To circumvent this, you can specify the names of your other pcs in /etc/hosts but this is only useful if they have static ip addresses.

If you do not have wins server no wins queries will be done. I'm guessing you don't have a wins server.

Finally, broadcasts on the local subnet will be done. Ineffecient but on small networks not too bad. You could try to let samba do broadcasts first so your windows pcs can respond to a broadcast of their names by themselves.

Hopefully this last option will help you out, if it doesn't work check all firewalls are open and your vista and samba servers aren't fighting for domain masterships.

For further info, check man smb.conf

Alien_Hominid · 03-28-2009, 03:21 PM

Add wins to nsswitch.conf hosts before dns.
Can you ping host by it's NETBIOS(Computer) name?
Windows computers have netbios services running, which broadcast their name.

SwissHeritage · 03-29-2009, 08:26 AM

Core and Alien, thanks! I haven't had a chance to do any more experiments. I'll let you know what happens when I do.

SwissHeritage · 03-31-2009, 01:40 AM

Quote:

Originally Posted by Alien_Hominid

Add wins to nsswitch.conf hosts before dns.
Can you ping host by it's NETBIOS(Computer) name?
Windows computers have netbios services running, which broadcast their name.

It worked! That's all I was missing.

To answer the question, no, before adding wins to nsswitch.conf, I couldn't ping the Pavilion by its name.

Before that, I tried giving the Vista Pavilion a static IP address, and it didn't change anything. Samba on my Satellite still couldn't find it by name.

Now I've changed both computers back to DHCP, and the Satellite can still find the Pavilion by name. I remember now, why I didn't want to use static addresses: because then I would have to keep track of them! We have three laptops and three handhelds on the network, and I don't want to have to keep track of their addresses if I don't have to.