[Samba] Windows 10 spawning thousands of child processes on Samba 4.3.11 server
Asbjorn Taugbol
asbjornt at gmail.com
Fri May 26 08:56:53 UTC 2017
Summary:
WIN10 clients opening .exe files on the share starts 5-10 nobody/nogroup
processes on the server that are not killed when application is closed.
This accumulates in the tens of thousands after some hours on a busy server.
I have been using different "max protocol" values in smb.conf global
section and found that only when using NT1 (which WIN10 calls dialect 1.5)
Samba recognises the username as demoUser insted of nobody and no excessive
processes are accumulated. Here are the results:
max protocol = SMB3
Client using SMBv311:
PID Username Group Machine Protocol Version
------------------------------------------------------------------------------
18299 nobody nogroup 10.10.1.71 (ipv4:10.10.1.71:56243)
Unknown (0x0311)
--> SMB 311 is not a recognised protocol version (Unknown (0x311))!!
max protocol = SMB2
Client using SMBv210:
PID Username Group Machine Protocol Version
------------------------------------------------------------------------------
8259 nobody nogroup 10.10.1.42 (ipv4:10.10.1.42:55938)
SMB2_10
--> Recognised protocol but not the username and processes are still
accumulated.
smb.conf: max protocol = NT1
Client using SMBv1:
PID Username Group Machine Protocol Version
------------------------------------------------------------------------------
8219 demoUser demoUser 10.10.1.71 (ipv4:10.10.1.71:57687)
NT1
--> Success! Username recognised! Spawned processes are dropped when not
needed.
Conclusion:
Problem solved with smb.conf global setting: max protocol = NT1
Question:
Microsoft strongly recommends disabling SMBv1 (NT1) for security reasons.
What does the Samba community recommend?
Thank you.
On Thu, May 25, 2017 at 11:16 AM, Asbjorn Taugbol <asbjornt at gmail.com>
wrote:
> I am thankful for all support received so far and I feel I'm getting
> closer to a solution.
>
> To get back to basics and a more transparent setup I have made a clean
> Ubuntu 16.04 installation and followed this guide https://wiki.samba.org/
> index.php/Setting_up_Samba_as_a_Standalone_Server
> Windows clients users are logged in with username Admin (local account,
> administrator).
> The samba share is mounted from "Map network drive..." as
> "\\10.10.1.206\demo" user credentials: demoUser/passw0rd. Access granted,
> read/write ok.
>
> BUT after a while processes are piling up and not released. Read/write
> files is ok. Running .exe-files on the share is not ok. I have been testing
> numerous .exe-files and they all result in a bunch of "nobody"-processes
> that are not terminated after closing the .exe-application. The smbstatus
> output below is shown after starting the putty.exe application.
>
> Samba log file for windows client that covers the event of starting
> putty.exe on the shared drive:
> https://gist.github.com/anonymous/21321cdd410a9cc38b35765144959db6
>
> Any ideas on how to proceed?
>
> Thank you.
>
> -Asbjorn
>
> #####################################
>
>
> root at ubuntuTest:/srv# testparm
> # Global parameters
> [global]
> server string = %h server (Samba, Ubuntu) server role =
> standalone server
> obey pam restrictions = Yes
> pam password change = Yes
> passwd program = /usr/bin/passwd %u
> passwd chat = *Enter\snew\s*\spassword:* %n\n
> *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
> username map = /usr/local/samba/lib/users.map
> unix password sync = Yes
> log file = /var/log/samba/log.%m
> max log size = 1000
> dns proxy = No
> panic action = /usr/share/samba/panic-action %d
> idmap config * : backend = tdb
>
>
> [demo]
> path = /srv/samba/demo/
> read only = No
>
> #####################################
>
> root at ubuntuTest:/srv# smbstatus
>
> Samba version 4.3.11-Ubuntu
> PID Username Group Machine Protocol Version
> ------------------------------------------------------------
> ------------------
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 demoUser demoUser 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
> 2981 nobody nogroup 10.10.1.70 (ipv4:10.10.1.70:50058)
> Unknown (0x0311)
>
> Service pid machine Connected at
> -------------------------------------------------------
> demo 2981 10.10.1.70 Wed May 24 15:29:34 2017
>
> Locked files:
> Pid Uid DenyMode Access R/W Oplock
> SharePath Name Time
> ------------------------------------------------------------
> --------------------------------------
> 2981 1003 DENY_WRITE 0x1000a1 RDONLY LEVEL_II
> /srv/samba/demo putty.exe Wed May 24 15:30:21 2017
> 2981 1003 DENY_NONE 0x100081 RDONLY NONE
> /srv/samba/demo . Wed May 24 15:30:13 2017
> 2981 1003 DENY_NONE 0x100081 RDONLY NONE
> /srv/samba/demo . Wed May 24 15:30:13 2017
>
> On Tue, May 23, 2017 at 4:54 PM, Rowland Penny <rpenny at samba.org> wrote:
>
>> On Tue, 23 May 2017 16:34:29 +0200
>> Asbjorn Taugbol via samba <samba at lists.samba.org> wrote:
>>
>>
>> > Yes, the users exist as both Linux and Samba users. My question was
>> > if the Windows client user "Admin" also needs to be Linux and Samba
>> > user.
>> >
>>
>> There is no windows user called 'Admin', there is one called
>> 'Administrator', if it is the later, then it is automatically mapped to
>> 'root' on a DC, but, on anything else, you need to map it in smb.conf
>> with a user.map setting.
>> If it is a separate user called 'Admin', then this is treated as just
>> another user and must exist in Samba and Unix on a standalone server.
>>
>> > Could be. This was not a problem in the old Samba 3.4. It all started
>> > after switching to new Samba 4.3.11-Ubuntu.
>>
>> Quite a lot has changed between 3.4 and now.
>>
>> Rowland
>>
>>
>>
>
More information about the samba
mailing list