HOWTO: Setup Samba peer-to-peer with Windows

[ledj0]

Hello and thanks for your efforts in helping everybody.

My problem is the following: I have a server (GATEWAY) that runs Ubuntu 6.06 and that, as it's name implies, is used as a gateway to a public network. Samba runs on this server and the firewall is configured to let Netbios and Samba ports traffic allowed from private interface. Also, I have setup all Windows workstation to use WINS over TCP using to the Gateway server IP address.

My smbpasswd user list is synchonized with my Windows user names and password for all workstations and the smbpasswd users are enabled.

I have 1 laptop that runs Win2K pro, 1 workstation that runs WinXp pro and 1 workstation that runs WinXP-home. Everything works fine from my win2K workstation. Using Windows explorer, I can navigate through the workgroup to the public share on the Gateway server. When using the WinXp ones, I simply cannot get to the shares. Here is what happens:

I open Windows Explorer and navigate to my server. When I click on Gateway, I am asked by Wndows to enter a name and a password. I enter a valid name and password (ex: jacques and mysecret where they are both entered and enabled in the smbpasswd). The password screen is then redrawn asking for a name and password this time, the user field is populated with "GATEWAY\jacques". I enter again the password but no can do. The system remains in this loop forever.

I tried the net test from the XP workstations and it worked OK (net use z: \\192.168.1.1\public mysecret /user:jacques /persistent:no and the drive is mapped correctly with the correct access rights) so it seems that it is at the password exchange level that ther is a problem.

I also get that nasty password screen when I try to install a public printer on the XP workstation while I have no problen installing on the Win2K equipment.

Here is my configuration:

 
[global]

    workgroup = HOMELEDX
    netbios name = GATEWAY
    server string = 
    interfaces = eth1 lo
    bind interfaces only = yes

    announce version = 5.0
    socket options = TCP_NODELAY IPTOS_LOWDELAY SO_KEEPALIVE SO_RCVBUF=8192 SO_SNDBUF=8192
    passdb backend = tdbsam
    security = user
    null passwords = true
    username map = /etc/samba/usermap
    name resolve order = hosts wins bcast
    wins support = yes

    encrypt passwords = yes
   
    printing = cups
    printcap name = cups

[public]
    path = /exports/samba/public
    read only = yes
    browseable = yes
    guest ok = no
    force user = ledxadmin
    force group = users

[printers]
    comment = All printers
    path = /var/spool/samba
    guest ok = no
    printable = yes
    use client driver = yes
    browsable = no

Thanks in advance for your help.

ledj0

[Stormbringer]

I open Windows Explorer and navigate to my server. When I click on Gateway, I am asked by Wndows to enter a name and a password. I enter a valid name and password (ex: jacques and mysecret where they are both entered and enabled in the smbpasswd). The password screen is then redrawn asking for a name and password this time, the user field is populated with "GATEWAY\jacques". I enter again the password but no can do. The system remains in this loop forever.

You're not the only one who reported this odd behaviour in this thread - and I tried hard to reproduce the problem inside a VMware environment (Ubuntu 6.06 Server with all patches applied, Windows XP Home Edition / Professional with SP2 and all hotfixes applied) but failed so far.

To be honest ... I have no idea what the problem might be as I cannot reproduce the behaviour at all. It always works out for me (not only in the peer-to-peer setup but in a full PDC setup as well).

I tried the net test from the XP workstations and it worked OK (net use z: \\192.168.1.1\public mysecret /user:jacques /persistent:no and the drive is mapped correctly with the correct access rights) so it seems that it is at the password exchange level that ther is a problem.

That's what I think too ... something's different in the authentication; seems as Windows Explorer handles things slight different than "net" does.

I also get that nasty password screen when I try to install a public printer on the XP workstation while I have no problen installing on the Win2K equipment.

Ah ha ... so it's related to XP only ... well ... if that's the case then Server 2003 and/or XP x64 should have a similar problem as they share the same code-base (at least that's what M$ tells).

Here is my configuration:
<snip>

Looks fine to me ... no typos and no misconfiguration.

However, as you seem to run this setup on a multi-homed firewalling server ...

Mind to post the firewall-rules of iptables you configured (just clean out any public IP with xxx.xxx.xxx.xxx)?

Does the output of "smbclient -L localhost -U%" look fine or does it show any errors?

-Storm

[ledj0]

There might have been different problems: after I posted that message, I reviewed all parameters that might influence this setup in and out Samba. I realized that I did not have Wins registration (tcp-139) and SMB/CIFS udp-445 opened. Also, I have made a change in my [public] share's force user and force group. Finally, I removed the "username map" entry as the map file did not contain anything.

I never used a Wins server in my network so this is why I overlooked the first one and the second is probably due to misreading or plain fatigue .

I cannot tell exactly which of these change solved the problem. I will certainly try to isolate this some time but here's what I think:

- I don't think the firewall ports have caused that specific problem since things were working fine in 2k. I tend to think that it might have influenced the browsing speed. Also, I doubt very very much that the password exchange routine varry that much at the interfacing level from 2k to XP but hey...we never know with Bill's baby.

- As you made it clear in this thread, the "force user" and "force group" parameters have nothing to do with login but deals with file ownership. This means that this parameter should not have made difference in this situation.

- This leaves the "username map" parameter. In my first post, I did not go into all details as did not want to write a novell. I said that my user configuration was checked, etc. Here are the details:

- the login name from the 2k workstation was exactly reproduced in the linux box with the exact same case (ex: abc - abc). There was a direct match from win to samba password.

-the login name from XP was the same name exept for the first character which was uppercase in win (ex Def - def). It is mentionned in some Samba books as well as in this thread that username case is converted to lowercase so I did not bother since this was exactly the case.

However the match was not perfect and there is a "username map" parameter so (from this point, this is only speculation from my part as I did not go through Samba's sources ) Samba goes in resolution mode. It looks at "username map" parameter and if it does not find a map there, it simply returns as if you sent an invalid name. In my opinion, removing this parameter is the key as from there, Samba will follow it's standard internal resolution algorithm.

In any case, things are (finally) working fine now. I will try to isolate exactly what fixed this and post back to this thread (after a short vacation8) ).

Big thanks again for your time and efforts, you are a champ.

ledj0

[dkaplowitz]

Great guide, Stormbringer, thanks! For some reason it was looking for a non-existent file /etc/smb/smbusers. I touched that file and it solved that error. And aside from not realizing that the workgroup name was case sensitive (I assumed it wasn't), it was a breeze to set up.

Cheers!

Dave

[HAL98 SE]

Thanks so much for this HOWTO. It worked first time. Now i can start to see how Samba works!

[spot101]

Questions about printers in Samba.

First off thanks for the great How to. By the look of this thread it's being apprecated by lots of people.

I'd like to print using windows native drivers. (Better feature support and sometimes better quality printing)

I've done a bit of reading but I am still not clear what is required.

What changes do I need to make to smb.conf and CUPS to make this work?

I don't need to auto install drivers across the network as I have read else were. Just the bacics are needed.


Much thanks,
Spot.

[Stormbringer]

Questions about printers in Samba.

First off thanks for the great How to. By the look of this thread it's being apprecated by lots of people.

I'd like to print using windows native drivers. (Better feature support and sometimes better quality printing)

I've done a bit of reading but I am still not clear what is required.

What changes do I need to make to smb.conf and CUPS to make this work?

I don't need to auto install drivers across the network as I have read else were. Just the bacics are needed.


Much thanks,
Spot.

If you want to hook your printer to your Ubuntu-Box and share it for the client on the LAN you need to install the Printer in CUPS first (in Gnome: "System" -> "Administration" -> "Printing") - there's no way around.

As soon as you installed your printer restart samba so that the newly added printer gets recognized for sure.

To add the printer to your Windows client you may either use the Network Neighborhood (browse to your Ubuntu Box, open the "Printers" Folder, right-click your printer and select "Connect") or the Add Printer Wizard in the Control Panel.

In both cases Windows will ask you to provide a driver for your printer in case it isn't directly supported by Windows. Install the driver and your're done.

The spool-file of Windows will be sent to Samba and forwarded to the appropriate CUPS-spool. If the job is already in the fitting native printer-language (PCL, PostScript, whatever) it will be put into the queue without further pre-processing and finally be printed.

In case the spool-file mismatches with the capabilities of the CUPS driver the job WILL be pre-processed to make it fit.

In the end it's CUPS that's handling your printer - not Windows or one of it's drivers.

If you have doubts you may also hook the printer to one of your Windows clients and setup a shared printer there ... in case the Windows-driver will output better quality.

-Storm

[spot101]

Thanks for the ultra quick reply. I'm glad it's so straight foreward to do. I had read about having to set-up raw print queues in CUPS and wasn't sure if it needed to be that invloved. This way is automatic. Cool!!

Earlier in this thread I read about someone who needed to set-up samba for himself, his brother and father. The problem was to give read/write access to a share to himself and his brother and read only access to the father.
In my reading I came accross this and wondered if this approach would work.

Here's another example of using variables: let's say there are five clients on your network, but one client, maya, requires a slightly different [homes] configuration. With Samba, it's simple to handle this:
[homes]
...
include = /usr/local/samba/lib/smb.conf.%m
...

The include option here causes a separate configuration file for each particular NetBIOS machine (%m) to be read in addition to the current file. If the hostname of the client system is maya, and if a smb.conf.maya file exists in the /usr/local/samba/lib directory, Samba will insert that configuration file into the default one. If any configuration options are restated in smb.conf.maya, those values will override any options previously encountered in that share. Note that we say "previously." If any options are restated in the main configuration file after the include option, Samba will honor those restated values for the share in which they are defined.

From Using Samba Chapter 6 http://us2.samba.org/samba/docs/using_samba/ch06.html

You might then be able to set the share read only for one user. i.e. the father.

Any thoughts?

Thanks again for your help.

Spot.

[addisor]

All went well to a point. The XP computer is a wireless laptop. When i got to the network mapping bit, i chose Z drive and //rob/myfiles, fails everytime with "an extended error has occured" any suggestions

[dmizer]

what is suppose to be in the /etc/samba/smbusers file?

for some reason or another, this file has been either deleted or removed without my knowledge (an update maybe?)

my logs contain the following:

Sep  2 01:11:53 storage smbd[21960]: [2006/09/02 01:11:53, 0] lib/username.c:map_username(139) 
Sep  2 01:11:53 storage smbd[21960]:   can't open username map /etc/samba/smbusers. Error No such file or directory

i am VERY concerned about this. both that the file can't be found, and the fact that i'm getting write_data errors.

i am still able to log in, and everything seems to be running okay ...