[Samba] Unable to browse system shares of a newly migrated AD DC

Mon Mar 30 03:06:49 MDT 2015

I think this wont work since the user connectig isnt known in the AD,
since the user connecting is mapped to user nobody. 

auth_check_password_send: Checking password for unmapped user []\[]@[]
auth_check_password_send: mapped user is: [CCENTER]\[]@[]
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode = true'
connect to service IPC$ initially as user NT AUTHORITY\ANONYMOUS LOGON (uid=65534, gid=3000009)
and 'force unknown acl user = true' for service IPC$

cat /etc/passwd | grep nobody
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

and by default "Guest" (nobody) is disabled in the AD. 

Greetz, 

Louis

>-----Oorspronkelijk bericht-----
>Van: rowlandpenny at googlemail.com 
>[mailto:samba-bounces at lists.samba.org] Namens Rowland Penny
>Verzonden: maandag 30 maart 2015 10:49
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] Unable to browse system shares of a 
>newly migrated AD DC
>
>On 30/03/15 00:01, Andrey Repin wrote:
>> Greetings, Rowland Penny!
>>
>>> [2015/03/30 01:05:38.096168,  3, effective(0, 0), real(0, 0)]
>>> ../source4/auth/ntlm/auth.c:270(auth_check_password_send)
>>>    auth_check_password_send: Checking password for unmapped 
>user []\[]@[]
>>>    auth_check_password_send: mapped user is: [CCENTER]\[]@[]
>>> [2015/03/30 01:05:38.125440,  2, effective(0, 0), real(0, 0)]
>>> ../source3/modules/vfs_acl_xattr.c:193(connect_acl_xattr)
>>>    connect_acl_xattr: setting 'inherit acls = true' 'dos 
>filemode = true'
>>> and 'force unknown acl user = true' for service IPC$
>>> [2015/03/30 01:05:38.127532,  3, effective(0, 0), real(0, 0)]
>>> ../source3/smbd/service.c:856(make_connection_snum)
>>>    127.0.0.1 (ipv4:127.0.0.1:45066) connect to service IPC$ 
>initially as
>>> user NT AUTHORITY\ANONYMOUS LOGON (uid=65534, gid=3000009) (pid 882)
>>> [2015/03/30 01:05:38.127627,  3, effective(0, 0), real(0, 0)]
>>> ../source3/smbd/reply.c:1024(reply_tcon_and_X)
>>>    tconX service=IPC$
>>> [2015/03/30 01:05:38.128477,  3, effective(0, 0), real(0, 0)]
>>> ../source3/smbd/process.c:1802(process_smb)
>>>    Transaction 3 of length 106 (0 toread)
>>> [2015/03/30 01:05:38.128537,  3, effective(0, 0), real(0, 0)]
>>> ../source3/smbd/process.c:1405(switch_message)
>>>    switch message SMBntcreateX (pid 882) conn 0xb893b588
>>> [2015/03/29 22:05:38.128622,  3, effective(65534, 3000009), 
>real(65534, 0)]
>> By the way, what the group 3000009 is supposed to be? Domain 
>Users? Domain
>> Admins?
>>
>>> ../source3/smbd/service.c:197(set_current_service)
>>>    chdir (/tmp) failed, reason: Permission denied
>>> [2015/03/29 22:05:38.128674,  3, effective(65534, 3000009), 
>real(65534, 0)]
>>> ../source3/smbd/error.c:82(error_packet_set)
>>>    NT error packet at ../source3/smbd/process.c(1524) 
>cmd=162 (SMBntcreateX) NT_STATUS_ACCESS_DENIED
>>> [2015/03/29 22:05:38.138398,  3, effective(65534, 3000009), 
>real(65534, 0)]
>>> ../source3/smbd/process.c:1802(process_smb)
>>>    Transaction 4 of length 118 (0 toread)
>>> [2015/03/29 22:05:38.138453,  3, effective(65534, 3000009), 
>real(65534, 0)]
>>> ../source3/smbd/process.c:1405(switch_message)
>>>    switch message SMBtrans (pid 882) conn 0xb893b588
>>> [2015/03/29 22:05:38.138494,  3, effective(65534, 3000009), 
>real(65534, 0)]
>>> ../source3/smbd/service.c:197(set_current_service)
>>>    chdir (/tmp) failed, reason: Permission denied
>>> [2015/03/29 22:05:38.138529,  3, effective(65534, 3000009), 
>real(65534, 0)]
>>> ../source3/smbd/error.c:82(error_packet_set)
>>>    NT error packet at ../source3/smbd/process.c(1524) 
>cmd=37 (SMBtrans) NT_STATUS_ACCESS_DENIED
>>> [2015/03/29 22:05:38.139702,  3, effective(65534, 3000009), 
>real(65534, 0)]
>>> ../source3/smbd/process.c:1802(process_smb)
>>>    Transaction 5 of length 39 (0 toread)
>>> [2015/03/29 22:05:38.139771,  3, effective(65534, 3000009), 
>real(65534, 0)]
>>> ../source3/smbd/process.c:1405(switch_message)
>>>    switch message SMBtdis (pid 882) conn 0xb893b588
>>> [2015/03/30 01:05:38.139897,  3, effective(0, 0), real(0, 0)]
>>> ../source3/smbd/service.c:1130(close_cnum)
>>>    127.0.0.1 (ipv4:127.0.0.1:45066) closed connection to 
>service IPC$
>>> [2015/03/30 01:05:38.141264,  3, effective(0, 0), real(0, 0)]
>>> ../source3/smbd/server_exit.c:221(exit_server_common)
>>>    Server exit (failed to receive smb request)
>>
>> --
>> WBR,
>> Andrey Repin, 30.03.2015, <01:54>
>>
>> Sorry for my terrible english...
>>
>
>OK, It would seem that you possibly have a problem with your /tmp 
>directory, it should be readable and writeable by anybody i.e. on my DC
>ls -la / shows:
>
>drwxrwxrwt  14 root     root      4096 Mar 30 09:17 tmp
>
>As for who '3000009' is, you can find out this by running (on the DC) 
>'ldbedit -e nano -H /var/lib/samba/private/idmap.ldb' and 
>searching for 
>'3000009', on my DC this results in this:
>
>dn: CN=S-1-5-32-545
>cn: S-1-5-32-545
>objectClass: sidMap
>objectSid: S-1-5-32-545
>type: ID_TYPE_BOTH
>xidNumber: 3000009
>distinguishedName: CN=S-1-5-32-545
>
>So '3000009' has the SID 'S-1-5-32-545'
>To find out who this is go here: 
>http://support.microsoft.com/en-us/kb/243330
>
>This reveals that this is the SID of the 'Users' group
>
>This is probably true for your DC, but I would check your DC, 
>as you can 
>have differences between DCs.
>
>Rowland
>
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>