[Samba] NT_STATUS_MEDIA_WRITE_PROTECTED

[Chris Muller]

Greetings, I am having trouble writing to my Samba share
"//ent1/data".  When I connect via smbclient from another machine, I
can navigate and read files, but I can't create a directory or replace
any files; smbclient prints the message:

  "NT_STATUS_MEDIA_WRITE_PROTECTED making remote directory \test"

Incidentally, it *used* to work fine until I upgraded my Ubuntu
Desktop to 8.0.4LTS.

My other server, running Ubuntu 8.0.4 Server Edition, hosts a Samba
server known as "//prod1/private".  I *am* able to write to that
share.

So I tried copying that smb.conf over to my "ent1" box, changing only
the share name.  Unfortunately, same problem.

Each machine has the same exact userid (chris) and password.  Same UID
and GID on each (1000).

Connecting from a Windows client (christ60p), also with the same
userId and password, has the same problem, but at least smbstatus on
the Samba server shows that it knows it is connected "RDONLY".  WHY?!

==========
Samba version 3.0.28a
PID     Username      Group         Machine
-------------------------------------------------------------------
17049   chris         chris         prod1        (192.168.0.3)
17358   chris         chris         christ60p    (192.168.0.2)

Service      pid     machine       Connected at
-------------------------------------------------------
data         17049   prod1         Wed Sep 10 18:02:52 2008
data         17358   christ60p     Wed Sep 10 18:27:16 2008

Locked files:
Pid          Uid        DenyMode   Access      R/W        Oplock
    SharePath   Name   Time
--------------------------------------------------------------------------------------------------
17358        1000       DENY_NONE  0x100001    RDONLY     NONE
    /data   .   Wed Sep 10 18:27:17 2008
17358        1000       DENY_NONE  0x100001    RDONLY     NONE
    /data   music   Wed Sep 10 18:27:27 2008

============

File permissions do not seem to be the issue, I loosened the entire
shared directory tree on "ent1" to 777.  On "prod1" they are 700 and
access works!

Also, smbcacls on each machine ("ent1" and "prod1") both show the
exact same output:

(Run from ent1)

smbcacls //prod1/private / -U chris
Password:
REVISION:1
OWNER:PROD1\chris
GROUP:Unix Group\chris
ACL:PROD1\chris:ALLOWED/0/FULL
ACL:Unix Group\chris:ALLOWED/0/
ACL:\Everyone:ALLOWED/0/

(Run from prod1)

smbcacls //ent1/data / -U chris
Password:
REVISION:1
OWNER:ENT1\chris
GROUP:Unix Group\chris
ACL:PROD1\chris:ALLOWED/0/FULL
ACL:Unix Group\chris:ALLOWED/0/
ACL:\Everyone:ALLOWED/0/

=======

Next I tried cranking up syslog = 3 and on each server and comparing
what I saw in the log files for clues.  I can, of course, see the
"connect to service private initially as user chris (uid=1000,
gid=1000)" message.  BUT, interestingly, on the "prod1" which is
*working* I have what appear to be error messages like:

  auth/auth_util.c:create_builtin_administrators(792)
create_builtin_administrators: Failed to create Administrators

and a similar message user about "Failed to create Users".

Yeow, I don't know whether this failure is opening up the "prod1"
system for write access.  (!)

=======

I also made sure the binaries /usr/sbin/smbd were owned by root and
they are.  HOWEVER, even though each machine is supposed to be running
Samba 3.0.28a, their sizes and timestamps are different!

Sooo, I shutdown samba on ent1, copied the binary from prod1.
Unfortunately, same result.

==========

I've spent five days trying to get this working.  I have no hair left
to pull.  PLEASE, can anyone give me a hint?

Regards,
  Chris Muller

PS - My output from my testparm:

[global]
	workgroup = MULLER
	server string = %h (Samba, Ubuntu)
	map to guest = Bad User
	syslog = 3
	syslog only = Yes
	debug uid = Yes
	socket options = TCP_NODELAY SO_RCVBUF=16384 SO_SNDBUF=16384
	dns proxy = No
	panic action = /usr/share/samba/panic-action %d
	invalid users = root
	hosts allow = 192.168.0., 192.168.1.

[printers]
	comment = All Printers
	path = /var/spool/samba
	create mask = 0700
	printable = Yes
	browseable = No

[print$]
	comment = Printer Drivers
	path = /var/lib/samba/printers

[data]
	comment = private Data
	path = /data
	read only = No
	create mask = 0750
	directory mask = 0750
	guest ok = Yes