On Sun, May 25, 2008 at 3:38 AM, Christopher Chan christopher@ias.com.hk wrote:

Do they should up if you run the command below in the Linux host?

smbclient -L //localhost

I'm guessing you meant "show up" and yes, everything looks normal, but only if I use a -U option with a known user. Is there a way to allow printer access without a user login?

Not even the home share? Have you created a machine account for the XP guest?

Not sure what a "machine account" is - there is a user account on the host that has the same user name and password as the one on the guest.

Thanks.

mhr

On Tue, May 27, 2008 at 4:51 PM, Christopher Chan christopher@ias.com.hk wrote:

Try adding 'guest ok = yes' to the printer share configuration.

I will - thanks.

...I think you need to pick a bit more on Windows networking...more reading of the books/documentation provided with samba should help.

Definitely - I'm working on that in my copious (gales of laughter) spare time, along with the other two or three hundred projects....

:-)

mhr

-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of MHR Sent: Saturday, May 31, 2008 2:57 PM To: CentOS mailing list Subject: Re: [CentOS] CentOS-Samba question

On Tue, May 27, 2008 at 5:17 PM, MHR mhullrich@gmail.com wrote:

On Tue, May 27, 2008 at 4:51 PM, Christopher Chan christopher@ias.com.hk wrote:

Okay, I went through the Samba Guide at http://us3.samba.org/samba/docs/using_samba. I read chapters 1, 2 & 3 fairly thoroughly, and I'm going through 12 (troubleshooting) now. ----------------------------------------------

I think your reading the wrong guide, try this one and this has traversed on long enough. Almost Two weeks now. Below included is also a work (BASIC) Configuration file to get you going. Then you will need to go on and experiment from there.

This configuration below will work with a "forced user = use_name". Or change the security mode to user and create accounts on the samba server for the windows clients. Those accounts **HAVE** to mach the Window user and password logons! Please read the comented sections.

Hope All This Helps and the Formatting Stays, JohnStanley

Samba 3 By Example: http://us3.samba.org/samba/docs/man/Samba3-ByExample/

Samba 3 How To: http://us3.samba.org/samba/docs/Samba3-HOWTO.pdf http://us3.samba.org/samba/docs/man/Samba3-HOWTO/ ************************************************

# Any line which starts with a ; (semi-colon) or a # (hash) # is a comment and is ignored. In this example we will use a # # for commentry and a ; for parts of the config file that you # may wish to enable # # NOTE: Whenever you modify this file you should run the command "testparm" # to check that you have not made any basic syntactic errors. # #--------------- # SELINUX NOTES: Pay Attention Here # # If you want to use the useradd/groupadd family of binaries please run: # setsebool -P samba_domain_controller on # # If you want to share home directories via samba please run: # setsebool -P samba_enable_home_dirs on # # If you create a new directory you want to share you should mark it as # "samba-share_t" so that selinux will let you write into it. # Make sure not to do that on system directories as they may already have # been marked with othe SELinux labels. # # Use ls -ldZ /path to see which context a directory has # # Set labels only on directories you created! # To set a label use the following: chcon -t samba_share_t /path # # If you need to share a system created directory you can use one of the # following (read-only/read-write): # setsebool -P samba_export_all_ro on # or # setsebool -P samba_export_all_rw on # # If you want to run scripts (preexec/root prexec/print command/...) please # put them into the /var/lib/samba/scripts directory so that smbd will be # allowed to run them. # Make sure you COPY them and not MOVE them so that the right SELinux context # is applied, to check all is ok use restorecon -R -v /var/lib/samba/scripts # #-------------- # #======================= Global Settings ===================================== [global] #Below line is an Option... socket options = TCP_NODELAY

# ----------------------- Netwrok Related Options ------------------------- # # workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH # # server string is the equivalent of the NT Description field # # netbios name can be used to specify a server name not tied to the hostname # # Interfaces lets you configure Samba to use multiple interfaces # If you have multiple network interfaces then you can list the ones # you want to listen on (never omit localhost) # # Hosts Allow/Hosts Deny lets you restrict who can connect, and you can # specifiy it as a per share option as well # workgroup = Workgroup server string = Samba Server Version %v ; netbios name = MYSERVER ; interfaces = lo eth0 192.168.0.1/24 192.168.0.254/24 ; hosts allow = 127. 192.168.0. 192.168.0. # --------------------------- Logging Options ----------------------------- # # Log File let you specify where to put logs and how to split them up. # # Max Log Size let you specify the max size log files should reach # logs split per machine log file = /var/log/samba/%m.log # max 50KB per log file, then rotate max log size = 50 # ----------------------- Standalone Server Options ------------------------ # # Scurity can be set to user, share(deprecated) or server(deprecated) # # Backend to store user information in. New installations should # use either tdbsam or ldapsam. smbpasswd is available for backwards # compatibility. tdbsam requires no further configuration.

#When commented out Samba reverts to share mode ah ha! security = share # passdb backend = tdbsam

# ----------------------- Domain Members Options ------------------------ # # Security must be set to domain or ads (Active Directory Server) # # Use the realm option only with security = ads # Specifies the Active Directory realm the host is part of # # Backend to store user information in. New installations should # use either tdbsam or ldapsam. smbpasswd is available for backwards # compatibility. tdbsam requires no further configuration. # # Use password server option only with security = server or if you can't # use the DNS to locate Domain Controllers # The argument list may include: # password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name] # or to auto-locate the domain controller/s # password server = * ; security = domain ; passdb backend = tdbsam ; realm = MY_REALM

; password server = <NT-Server-Name>

# ----------------------- Domain Controller Options ------------------------ # # Security must be set to user for domain controllers # # Backend to store user information in. New installations should # use either tdbsam or ldapsam. smbpasswd is available for backwards # compatibility. tdbsam requires no further configuration. # # Domain Master specifies Samba to be the Domain Master Browser. This # allows Samba to collate browse lists between subnets. Don't use this # if you already have a Windows NT domain controller doing this job # # Domain Logons let Samba be a domain logon server for Windows workstations.

# # Logon Scrpit let yuou specify a script to be run at login time on the client # You need to provide it in a share called NETLOGON # # Logon Path let you specify where user profiles are stored (UNC path) # # Various scripts can be used on a domain controller or stand-alone # machine to add or delete corresponding unix accounts # ; security = user ; passdb backend = tdbsam ; domain master = yes ; domain logons = yes # the login script name depends on the machine name ; logon script = %m.bat # the login script name depends on the unix user used ; logon script = %u.bat ; logon path = \%L\Profiles%u # disables profiles support by specifing an empty path ; logon path = ; add user script = /usr/sbin/useradd "%u" -n -g users ; add group script = /usr/sbin/groupadd "%g" ; add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /bin/false "%u" ; delete user script = /usr/sbin/userdel "%u" ; delete user from group script = /usr/sbin/userdel "%u" "%g" ; delete group script = /usr/sbin/groupdel "%g" # ----------------------- Browser Control Options ---------------------------- # # set local master to no if you don't want Samba to become a master # browser on your network. Otherwise the normal election rules apply # # OS Level determines the precedence of this server in master browser # elections. The default value should be reasonable # # Preferred Master causes Samba to force a local browser election on startup # and gives it a slightly higher chance of winning the election ; local master = no ; os level = 33 ; preferred master = yes #----------------------------- Name Resolution ------------------------------- # Windows Internet Name Serving Support Section: # Note: Samba can be either a WINS Server, or a WINS Client, but NOT both # # - WINS Support: Tells the NMBD component of Samba to enable it's WINS Server # # - WINS Server: Tells the NMBD components of Samba to be a WINS Client # # - WINS Proxy: Tells Samba to answer name resolution queries on # behalf of a non WINS capable client, for this to work there must be # at least one WINS Server on the network. The default is NO. # # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names # via DNS nslookups. ; wins support = yes ; wins server = w.x.y.z ; wins proxy = yes ; dns proxy = yes # --------------------------- Printing Options ----------------------------- # # Load Printers let you load automatically the list of printers rather # than setting them up individually # # Cups Options let you pass the cups libs custom options, setting it to raw # for example will let you use drivers on your Windows clients # # Printcap Name let you specify an alternative printcap file # # You can choose a non default printing system using the Printing option load printers = yes cups options = raw

; printcap name = /etc/printcap #obtain list of printers automatically on SystemV ; printcap name = lpstat ; printing = cups

# --------------------------- Filesystem Options --------------------------- # # The following options can be uncommented if the filesystem supports # Extended Attributes and they are enabled (usually by the mount option # user_xattr). Thess options will let the admin store the DOS attributes # in an EA and make samba not mess with the permission bits. # # Note: these options can also be set just per share, setting them in global # makes them the default for all shares

; map archive = no ; map hidden = no ; map read only = no ; map system = no ; store dos attributes = yes

#============================ Share Definitions ============================== [homes] comment = Home Directories browseable = no writable = yes ; valid users = %S ; valid users = MYDOMAIN%S #This will actually work with Window NT to XP verified!! #Only bad thing is you may have to config samba for printer drivers. #So the Win Clients can load them on demand. See the PDFs about #how to do this. ""The Links Above" [printers] comment = All Printers path = /var/spool/samba browseable = yes guest ok = yes writable = yes printable = yes # Un-comment the following and create the netlogon directory for Domain Logons ; [netlogon] ; comment = Network Logon Service ; path = /var/lib/samba/netlogon ; guest ok = yes ; writable = no ; share modes = no # Un-comment the following to provide a specific roving profile share # the default is to use the user's home directory ; [Profiles] ; path = /var/lib/samba/profiles ; browseable = no ; guest ok = yes [SAN] comment = Storage path = /mnt/SAN public = yes writable = yes # readable = yes browseable = yes # printable = no # write list = +staff vfs objects = recycle #recycle: config-file = /etc/samba/recycle.conf recycle:repository = Recycle Bin #recycle:versions = Yes #recycle:keeptree = Yes #recycle:exclude = *.tmp|*.temp|*.o|*.obj|~$*|*.~??|*.log|*.trace|*.TMP #recycle:excludedir = /tmp|/temp|/cache #recycle:noversions = *.doc|*.ppt|*.dat|*.ini #Belowe This user Has to exist on the Server! force user = *UserNameHere* force group = *UserNameHere* guest ok = yes

[SAN1] comment = Storage Temp path = /SAN1 public = yes writable = yes browseable = yes vfs objects = recycle recycle:repository = Recycle Bin # printable = no # write list = +staff force user = ethan force group = ethan guest ok = yes

I just found something interesting. I brought up my XP guest, and it had no trouble at all connecting to the shares, but it couldn't open the workgroup at all and the printer had become disconnected. I could not reconnect through the workgroup (duh), but if I just input the network name, the printer came up just fine.

So:

I can connect to my shares from the XP guest, and I can connect to my printer from the XP guest, I just can't open the workgroup (this is relatively new, like, since I began messing with the smb.conf file in the last two weeks).

Don't know exactly what that means, but I haven't given up yet. Tomorrow I'll dig in more on the remote machine and see where that all takes me.

Any helpful suggestions still welcome.... :-)

mhr

On Sun, Jun 1, 2008 at 5:20 AM, John jses27@gmail.com wrote:

"""If you logged on from the Windows Guest Account then you know it is authenticating by the guest or nobody account that's on the Samba Server. The previous config file I that I stuck in the mail for you will work on a Windows Client machine providing there is sufficient name and ip address translation. It will authenticate against the samba server "nobody" account. IE, as in provide anonymous user name and password authentication so the user will not have to enter a password. That is to get you going on the right path. From there you will need to incorporate some type of user mode authentication. You don't want the whole world to access it."""

Clarification: "my XP guest" is my VMWare Windows XP guest OS running on top of my CentOS host. I use a known account to logon from the XP guest OS to the CentOS host and all works just fine, except that I changed <something> last night, or recently, and the guest XP can no longer see the host "machine" in the workgroup.

This is a very minor problem, unless there's some connection we aren't talking about yet. .

OK, you don't need to just open the Workgroup. All you really need to do is just add the share on the Samba server.

Actually, I think it was when either 5.0 or 5.1 came out that the sample config file you sent, with a few minor differences, was posted and I have a copy on my machine. I used that, in part, to construct the config file I am using.

Today, I am trying to test with the remote XP machine, and the results get weirder (to me). I can now see the CentOS server in the XP's network under the workgroup, but I can't open the host for access to either the shares or the printers. I can still ping the server, I can even open a putty window to it and login just fine.

But, now, I can no longer ping the XP machine from my server (!!!) at all.

I am running zonealarm (free) on the XP machine and am wondering if there might be a problem there. Reason I mention this is that ZA used to allow control of access by program and by machine, but now it only offers program control (which really stinks - any other free Win$$$ firewalls worth a hoot out there?). So I can't even tell if my server is getting blocked by the firewall any more.

Foo.

mhr

On Mon, Jun 2, 2008 at 12:25 AM, MHR mhullrich@gmail.com wrote:

I have a couple of partial solutions.

:

Unfortunately, this did nothing to help the remote Windows 98 boot, which still can't see the network server or its resources. Also unfortunately, the 98 boot is the more important one to have printer access. (Don't ask.)

It was late last night and I forgot to include any useful information here.

The 98 boot has an automatic (no password) logon. As I said, I can't use the Network Neighborhood to see anything on the server - in fact, it can't even see the workgroup, even after I double checked all the setting.

However, I can attempt to attach to resources, but, e.g., when I try to attach to my mpp1100 printer, it posts a password input window for resource \mhrichter\IPC$, but I can't figure out which password, and none of the ones I tried works.

On the server side, I have (something like) this for my smbusers (I'm going from memory here, but it's not too hard):

# root = administrator admin mark = mark guest = esther ruth guest smbguest nobody = pcguest

(Yes, I have root access from the samba clients disabled.)

The default login account is esther, but the passwords for guest and mark don't work, and no password also does not work. When I get home, I'll add an account for esther on the server, fix up the smbusers file and see what happens.

Another anomaly - when I was logged into the XP boot as mark, I could not connect to the printer without specifying a password (with the "connect as another user" dodge), even though the passwords on both machines are the same.

Ok, back to work. :-)

Thanks, everyone, especially John.

mhr

On Mon, Jun 2, 2008 at 10:16 AM, John R Pierce pierce@hogranch.com wrote:

win9X has horrible network username habits... you need to determine what username its running as... dirty trick, log off, and the username should be in the login prompt, just hit enter to relogin with the same username and the same blank local password.. on the SAMBA server, create that username as a linux user, AND `smbuser -a username`, assign it a smb password. when win98 prompts for a password, thats the username it will use, you get no choice, and win98 should be able to 'save' that password (if you check said box on the login prompt), which causes it to be saved to a <username>.pwd file (I think thats the name of the password cache).

does that make sense?

Well, sort of, but we are talking about Micro$oft and Window$$$ here .... :-)

Now that I've had some rest, that's pretty much what I was going to try next.

Wish me luck!

Thanks.

mhr

On Mon, Jun 2, 2008 at 10:16 AM, John R Pierce pierce@hogranch.com wrote:

...

win9X has horrible network username habits... you need to determine what username its running as... dirty trick, log off, and the username should be in the login prompt, just hit enter to relogin with the same username and the same blank local password.. on the SAMBA server, create that username as a linux user, AND `smbuser -a username`, assign it a smb password. when win98 prompts for a password, thats the username it will use, you get no choice, and win98 should be able to 'save' that password (if you check said box on the login prompt), which causes it to be saved to a <username>.pwd file (I think thats the name of the password cache).

More progress:

It occurred to me that somewhere along the line I had not given my CentOS guest user smb access, so I ran smbpasswd and set the guest password to match its login password. When I went back to W98, I tried to add the network printer - it recognized the name (\mhrichter\MPP1100) and asked for a password. I gave it the guest password, and it proceeded to try to install it. I put in the CD, went through all the (right) moves to install the driver, and then the moment of truth:

W98 said I had to reboot.

I knew I was in trouble. I rebooted, and, lo and behold, the printer was suddenly offline and unavailable (there was no change to the CentOS host or the printer at all).

I deleted the printer to start over, but this time W98 said the printer was offline when I input the name and the password.

W98 still can't see the network or any of the shares in the Network Neighborhood, but at least I can reach for it by name.

Any doors or windows in this wall?

Thanks.

mhr

PS: I have always said that I don't really hate Window$, I just prefer working in and on Unix/Linux. I don't think that's true any more, although I must say that of all the versions of Window$ I've ever used, XP is the least objectionable.

PPS: Yes, this is Window$ XP Pro (but I think it's still SP1), and 98 SE. It's still Window$, a Micro$oft product, which really says it all.

Robert wrote:

It might be easier to give up.*

For years, I had a single inkjet printer on my modest home network, physically connected to this machine. It works great once setup until something changes. (Versions of Windows and/or versions and/or flavors of Linux on another box.) A while back, I added a laser printer, choosing one that could go either parallel, USB or ethernet. I got out my crimpers, made a network cable and haven't looked back. What a pleasure! It was a breeze to set up and it's alway visible to any computer on the network.

The point is, unless your time is virtually worthless, you might think about a print server. Netgear, D-link and Linksys all make them. BTW, my laser printer is a Brother HL-5250 DN and I'm pretty happy with it.

Those mini print servers would save you a lot of time by the sound of it, if it's just the printer sharing that's the problem. Or if distance is not an issue, it could possibly be directly connected to one of the windows machines and shared from there. However, that would result in you having to leave the windows box on all the time for the printing to be enabled.

Well, that's my 2 cents worth anyway, hope it helps.

-Ross-

On Tue, Jun 3, 2008 at 2:30 PM, Scott Silva ssilva@sgvwater.com wrote:

on 6-3-2008 1:00 PM MHR spake the following:

...

...

On Mon, Jun 2, 2008 at 10:16 AM, John R Pierce pierce-BRp9yk6zKL1Wk0Htik3J/w@public.gmane.org wrote:

...

win9X has horrible network username habits... you need to determine what username its running as... dirty trick, log off, and the username should be in the login prompt, just hit enter to relogin with the same username and the same blank local password.. on the SAMBA server, create that username as a linux user, AND `smbuser -a username`, assign it a smb password. when win98 prompts for a password, thats the username it will use, you get no choice, and win98 should be able to 'save' that password (if you check said box on the login prompt), which causes it to be saved to a <username>.pwd file (I think thats the name of the password cache).

:::

...

PS: I have always said that I don't really hate Window$, I just prefer working in and on Unix/Linux. I don't think that's true any more, although I must say that of all the versions of Window$ I've ever used, XP is the least objectionable.

Vista will raise your disappointment level back up!

That was intended to include Vista - it sinks to a new low for Micro$$$$. Even SP1 made it worse.

mhr

On Tue, Jun 3, 2008 at 4:16 PM, Ross Cavanagh ross-cavanagh@bm-sms.co.jp wrote:

MHR wrote:

...

...

Vista will raise your disappointment level back up!

That was intended to include Vista - it sinks to a new low for Micro$$$$. Even SP1 made it worse.

Funny article in regards to upgrading from Vista to XP.

http://dotnet.org.za/codingsanity/archive/2007/12/14/review-windows-xp.aspx

ROTFLMAO!

Thanks!

<RBFG>

mhr

----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of MHR Sent: Sunday, June 01, 2008 6:34 PM To: CentOS mailing list Subject: Re: [CentOS] CentOS-Samba question

On Sun, Jun 1, 2008 at 5:20 AM, John jses27@gmail.com wrote:

"""If you logged on from the Windows Guest Account then you know it is authenticating by the guest or nobody account that's on the Samba Server. The previous config file I that I stuck in the mail for you will work on a Windows Client machine providing there is sufficient name and ip address translation. It will authenticate against the samba server

"nobody" account.

IE, as in provide anonymous user name and password authentication so the user will not have to enter a password. That is to get you going on the right path. From there you will need to incorporate some type of user mode authentication. You don't want the whole world to access

it."""

Clarification: "my XP guest" is my VMWare Windows XP guest OS running on top of my CentOS host. I use a known account to logon from the XP guest OS to the CentOS host and all works just fine, except that I changed <something> last night, or recently, and the guest XP can no longer see the host "machine" in the workgroup.

This is a very minor problem, unless there's some connection we aren't talking about yet. .

OK, you don't need to just open the Workgroup. All you really need to do is just add the share on the Samba server.

Actually, I think it was when either 5.0 or 5.1 came out that the sample config file you sent, with a few minor differences, was posted and I have a copy on my machine. I used that, in part, to construct the config file I am using.

Today, I am trying to test with the remote XP machine, and the results get weirder (to me). I can now see the CentOS server in the XP's network under the workgroup, but I can't open the host for access to either the shares or the printers. I can still ping the server, I can even open a putty window to it and login just fine.

But, now, I can no longer ping the XP machine from my server (!!!) at all.

I am running zonealarm (free) on the XP machine and am wondering if there might be a problem there. Reason I mention this is that ZA used to allow control of access by program and by machine, but now it only offers program control (which really stinks - any other free Win$$$ firewalls worth a hoot out there?). So I can't even tell if my server is getting blocked by the firewall any more.

Foo.

Mhr ------------------------------------- Actually my opinion on that is is to trash the ZoneAlarm Firewall. Use the firewall that came with windows. It actually works just as good. That is if there is someone that knows how to config it.

For your sake. The heck of it Disable all firewalls in all clients and servers your using and see what type of access you have to the sambaserver. See your fighting two firewalls at once on your DomU and DomO.

If I remember right ports 138 and 139 have to be open on the Win98 clients they will work over NetBios where as xp will work over TCP/IP.

JohnStanley _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos