Samba, permission denied error.

BashTin · 07-14-2008, 07:07 AM

Hello all, again I seem to be calling on you experts to get me out of trouble!

Ok so I have a Win Xpee laptop and a lappy running ubuntu (now don't flame me, I usually run slacky 11 but moments after hosing my system my young neighbour asked me to try ubuntu for him, ok why not. Anyway very pleasantly surprised and think it is great for those coming from Windows and anything that helps move the masses over to Linux is good in my books!), anyway I digress. So all I need to do is share a 'work' dir between the two (incidentally this all worked under Slacky 11 and I am using the same smb.conf from that system).

Problem is when trying to connect from the remote XPee machine to the Ubuntu machine, the Xpee machine is allowed to connect, the user is authenticated but permission is denied to connect to the work dir.....
It is ONLY the Xpee user that is denied access like this, both from logging in locally and remotely from XPee. The local user and owner of the work dir is allowed access.

Some points...
the remote xp user bustybertha was added to the ubuntu system with smbpasswd -a bustybertha
and also bustybertha has a real acc on ubuntu machine too, with same login details.
Both 'mrt' & bustybertha belong to the 'work' group.

Some outputs...

Code:

ls -al /home/mrt/documents/
drwxrwxrwx 16 mrt work   472 2008-07-08 15:09 work

mrt@TUXBOX:~$ smbclient '\\tuxbox\work'
Password: 
Domain=[TUXBOX] OS=[Unix] Server=[Samba 3.0.26a]
smb: \> 


bustybertha@TUXBOX:/home/mrt$ smbclient '\\tuxbox\work'
Password: 
Domain=[TUXBOX] OS=[Unix] Server=[Samba 3.0.26a]
tree connect failed: NT_STATUS_BAD_NETWORK_NAME

cat /var/log/samba.tuxbox
[2008/07/14 19:46:59, 2] auth/auth.c:check_ntlm_password(309)
  check_ntlm_password:  authentication for user [bustybertha] -> [bustybertha] -> [bustybertha] succeeded
[2008/07/14 19:46:59, 2] lib/access.c:check_access(323)
  Allowed connection from  (127.0.0.1)
[2008/07/14 19:46:59, 2] lib/access.c:check_access(323)
  Allowed connection from  (127.0.0.1)
[2008/07/14 19:46:59, 0] smbd/service.c:make_connection_snum(1003)
  '/home/mrt/documents/work' does not exist or permission denied when connecting to [work] Error was Permission denied

root@TUXBOX:~# smbclient -L localhost -U%
Domain=[TUXNET] OS=[Unix] Server=[Samba 3.0.26a]

        Sharename       Type      Comment
        ---------       ----      -------
        IPC$            IPC       IPC Service (TUXBOX)
        work            Disk      
        Deskjet_D2300_series Printer   HP Deskjet D2300 series
Domain=[TUXNET] OS=[Unix] Server=[Samba 3.0.26a]

        Server               Comment
        ---------            -------
        BAOBEI               bustybertha's Laptop
        TUXBOX               TUXBOX

        Workgroup            Master
        ---------            -------
        TUXNET               BAOBEI 
  
root@TUXBOX:~# testparm /etc/samba/smb.conf bustybertha 192.168.1.102
Load smb config files from /etc/samba/smb.conf
Processing section "[printers]"
Processing section "[work]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Allow connection from bustybertha (192.168.1.102) to printers
Allow connection from bustybertha (192.168.1.102) to work

root@TUXBOX:~# testparm /etc/samba/smb.conf
Load smb config files from /etc/samba/smb.conf
Processing section "[printers]"
Processing section "[work]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

[global]
        workgroup = TUXNET
        server string = TUXBOX
        passdb backend = tdbsam:/etc/samba/private/smbpasswd
        log level = 3
        log file = /var/log/samba.%m
        max log size = 50
        printcap name = cups
        os level = 33
        local master = No
        dns proxy = No
        wins support = Yes
        hosts allow = 192.168.1.
        printing = cups
        print command = 
        lpq command = %p
        lprm command = 

[printers]
        comment = All Printers
        path = /var/spool/samba
        printable = Yes
        browseable = No

[work]
        path = /home/mrt/documents/work
        valid users = bustybertha, mrt
        read only = No
        create mask = 0765
        guest ok = Yes

Ok so I don't get it, the work dir has perms of 777, the group for the work dir is set to 'work' and bigbertha is a member of the work group but seems to have no permission to connect to it?!

Sorry about the long post but wanted to try to get as much info in first go.

As always any help is very much appreciated, BashTin, unashamedly on Ubuntu, for a while anyway.

camorri · 07-14-2008, 08:42 AM

Since the directory you want BB to get to is in another home directory, I believe you have to add definitions to smb.conf to allow specific user(s) to the directory. I don't think another user is allowed access to all of a home directory, nor should they be. Here is an example how I share my music directory and my pictures directory, within my /home directory. One is read only, the other allows read and write. Both allow only specific users.

Quote:

[Music]
comment = For any user to browse and listen
path = /home/cliff/Music

[pictures]
comment = Cliffs digcam pics
path = /home/cliff/Pictures
valid users = cliff, corinne, sheena, @cliff
read list = corinne, sheena, peigi
write list = cliff
read only = No

I have tested this, the listed users have access to the two directories. Right now from XP I'm playing .mp3 files from XP as a different user than my own.

Hope this helps.

BashTin · 07-14-2008, 10:23 AM

Hi Cliff,

thanks for the reply.

The way I have it at the moment is that I am only trying to share the dir work, and below, in my home dir.... /home/mrt/documents/work, not the whole of my home dir.

I gave what you suggested a try but still get that permission denied error.

My config file now looks like this

Code:

#======================= Global Settings =======================

[global]
 workgroup = TUXNET
 server string = TUXBOX
 name resolve order = lmhosts host wins bcast

#### Networking ####

 interfaces = eth1/192.168.1.

#### Debugging/Accounting ####

 log file = /var/log/samba/log.%m
 max log size = 1000
 syslog = 0
 panic action = /usr/share/samba/panic-action %d

####### Authentication #######

  security = user
  encrypt passwords = true
  passdb backend = tdbsam:/etc/samba/private/smbpasswd
  obey pam restrictions = yes
  invalid users = root
  passwd program = /usr/bin/passwd %u
  passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *passwd:*password\supdated\ssuccessfully* .

########## Domains ###########


########## Printing ##########

  load printers = yes
  printing = cups
  printcap name = cups

  load printers = yes
  printing = cups
  printcap name = cups

############ Misc ############

   socket options = TCP_NODELAY

#======================= Share Definitions =======================

[work]

   path = /home/mrt/documents/work
   valid users = bustybertha, mrt,@mrt
   read list = bustybertha,mrt
   write list = bustybertha,mrt
   read only = No
   public = yes
   writable = yes
   printable = no
   create mask = 0777

[printers]
   comment = All Printers
   browseable = yes
   path = /var/spool/samba
   printable = yes
   public = no
   writable = no
   create mode = 0700

[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no

Any ideas, anyone??

camorri · 07-14-2008, 11:03 AM

Try adding BB to the group mrt on your Kubuntu system, and try again. It looks to me as if the problem is not samab, but basic system permission. Just a thought...

avatardeviva · 07-14-2008, 01:21 PM

I agree with Cliff - it looks like a permission problem. Make sure you have permissions all the way into that directory (i.e. read permissions for /home/mrt/, /home/mrt/documents/ and /home/mrt/documents/work). From what I understand (correct me if I'm wrong) if you have /test with no read permissions you will not be able to read /test/folder.

camorri · 07-14-2008, 01:32 PM

Quote:

if you have /test with no read permissions you will not be able to read /test/folder.

I believe you are correct...

BashTin · 07-14-2008, 09:52 PM

Thanks guys,

just what I was missing. Gave read perms to the parent directories to the group 'users' and added BB as a member of the 'users' group and all is well.

Just one last question, if I may impose. Last time I did this on my Slack box every time BB created a new file in the work dir the owner was BB, not too sure about the group, can't remember. But how do I get it so any new files created by BB are owned by mrt and work group?

BashTin.

avatardeviva · 07-14-2008, 10:54 PM

I believe it is by using the 'force user' and 'force group' parameters. For example:

force user = username
force group = group

That should (I think) make it so that all file operations are performed as 'username' with the group 'group'. Give that a shot and let me know if it works!

BashTin · 07-15-2008, 03:44 AM

Great, that did the trick, thanks. Job done!

Thankyou camorri & avatardeviva, much appreciated.