[Samba] WindowsPE 10.0 -- Samba 4.4.5 connection problem

[Ralf Aumüller]

Hello,

we use WindowsPE and a Samba-Share to install Windows. First WindowsPE is booted
and then a network drive with Windows-install-files is mapped.

This worked fine with WindowsPE 5.0. But with WindowsPE 10.0 it fails.

The error is:

net use \\PC\test

System error 58 has occurred.
The specified server cannot perform the requested operation.

I used a simple Samba-Config for testing and get the following:

Samba WindowsPE 5.0 WindowsPE 10.0
------------------------------------------------------
3.6.25 OK OK
4.4.5 OK Failed

The smb.conf file of all tests:

[global]
workgroup = VMTST
security = user
encrypt passwords = yes
passdb backend = smbpasswd
unix charset = UTF-8

[test]
comment = Test
guest ok = yes
path = /data/test

Any tips about that issue?

Best regards,
Ralf

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Rowland Penny]

I have never used used WindowsPE, but from what you posted, you just
want to connect anonymously to the Samba share.

Try changing the [global] part of your smb.conf to this:

[global]
workgroup = VMTST
security = user

map to guest = Bad User

With this, any user that isn't a Samba user on the Samba machine, will
be treated as a guest login.

Rowland

[Ralf Aumüller]

Hello Rowland,

> I have never used used WindowsPE, but from what you posted, you just
> want to connect anonymously to the Samba share.

Not really. Our Samba-production environment uses accounts. I just want to keep
the test Samba-cfg simple. (Even with Your change I can't connect. Same error).

Best regards,
Ralf

[Rowland Penny]

On Mon, 8 Aug 2016 12:56:49 +0200
Ralf Aumüller <Ralf.Au...@informatik.uni-stuttgart.de> wrote:

> Hello Rowland,
>
> > I have never used used WindowsPE, but from what you posted, you just
> > want to connect anonymously to the Samba share.
>
> Not really. Our Samba-production environment uses accounts. I just
> want to keep the test Samba-cfg simple. (Even with Your change I
> can't connect. Same error).
>
> Best regards,
> Ralf
>
>

In which case, what ever user is going to connect to the Samba server
will need to exist on it, as both a Unix & Samba user. The user will
need to have the same password everywhere.

If the user is just copying the files from the Samba share to the
windows machine and then running them, the anonymous user way should
work, but it will depend on the permissions being set correctly,
both in smb.conf and on the Unix machine, I would start by checking
that the Unix permisions are set to 777

Rowland

[Ralf Aumüller]

> In which case, what ever user is going to connect to the Samba server
> will need to exist on it, as both a Unix & Samba user. The user will
> need to have the same password everywhere.
>
> If the user is just copying the files from the Samba share to the
> windows machine and then running them, the anonymous user way should
> work, but it will depend on the permissions being set correctly,
> both in smb.conf and on the Unix machine, I would start by checking
> that the Unix permisions are set to 777

Maybe my description was not clear. We first see this problem in our production
environment. So I set up a test VM with samba 3.6.25 and 4.4.5 available.
Then I PXE-boot a notebook with Windows PE 5.0 and try to connect to my
test-samba-server. 3.6.25 works. Stopping 3.6.25 and starting 4.4.5: Works fine.

Then I PXE-boot Windows PE 10.0 and make the same test. Now just samba 3.6.25
works. Trying 4.4.5 gives error "System error 58 has occurred."
All tests use the same Samba-cfg-file.

Best regards,
Ralf

[Rowland Penny]

On Mon, 8 Aug 2016 14:17:43 +0200
Ralf Aumüller <Ralf.Au...@informatik.uni-stuttgart.de> wrote:

>
> > In which case, what ever user is going to connect to the Samba
> > server will need to exist on it, as both a Unix & Samba user. The
> > user will need to have the same password everywhere.
> >
> > If the user is just copying the files from the Samba share to the
> > windows machine and then running them, the anonymous user way should
> > work, but it will depend on the permissions being set correctly,
> > both in smb.conf and on the Unix machine, I would start by checking
> > that the Unix permisions are set to 777
>
> Maybe my description was not clear. We first see this problem in our
> production environment. So I set up a test VM with samba 3.6.25 and
> 4.4.5 available. Then I PXE-boot a notebook with Windows PE 5.0 and
> try to connect to my test-samba-server. 3.6.25 works. Stopping 3.6.25
> and starting 4.4.5: Works fine.
>
> Then I PXE-boot Windows PE 10.0 and make the same test. Now just
> samba 3.6.25 works. Trying 4.4.5 gives error "System error 58 has
> occurred." All tests use the same Samba-cfg-file.
>
> Best regards,
> Ralf
>
>

OK, as I don't have windows PE, I set up a standalone server using
4.4.5 in a VM and connected from a windows 10 VM, I used your smb.conf
with the alterations I suggested. Whilst I could connect to the share
and read a text file I created on the Samba server, I couldn't alter
it, or create a new file.
I added 'read only = no' to the share, changed the Unix permissions
for /data/test to 777 and I can connect as the domain user 'rowland'.
I can then create or alter files on the share, this is without the user
being created on the standalone Samba server. The only problem is (if
you can call it a problem) everything on the share belongs to
nobody:nogroup.

Rowland

[Steve Ankeny]

On 08/08/2016 08:17 AM, Ralf Aumüller wrote:
>> In which case, what ever user is going to connect to the Samba server
>> will need to exist on it, as both a Unix & Samba user. The user will
>> need to have the same password everywhere.
>>
>> If the user is just copying the files from the Samba share to the
>> windows machine and then running them, the anonymous user way should
>> work, but it will depend on the permissions being set correctly,
>> both in smb.conf and on the Unix machine, I would start by checking
>> that the Unix permisions are set to 777
> Maybe my description was not clear. We first see this problem in our production
> environment. So I set up a test VM with samba 3.6.25 and 4.4.5 available.
> Then I PXE-boot a notebook with Windows PE 5.0 and try to connect to my
> test-samba-server. 3.6.25 works. Stopping 3.6.25 and starting 4.4.5: Works fine.
>
> Then I PXE-boot Windows PE 10.0 and make the same test. Now just samba 3.6.25
> works. Trying 4.4.5 gives error "System error 58 has occurred."
> All tests use the same Samba-cfg-file.
>
> Best regards,
> Ralf
>
>

Looking at a "System 58 error" with Windows 7 --

https://serverfault.com/questions/69049/system-error-58-while-accessing-shares-on-windows-7-from-windows-xp

I'm wondering if the problem lies in the "server max level = NT1" issue
we've seen before with Windows 10?

In other words, the problem may lie in the PXE Windows PE 10.0 environment.

It's making a request but not receiving the answer it requires to make
the connection.

[Rowland Penny]

On Mon, 8 Aug 2016 14:33:37 -0400
Steve Ankeny <ste...@cinergymetro.net> wrote:


> Looking at a "System 58 error" with Windows 7 --
>
> https://serverfault.com/questions/69049/system-error-58-while-accessing-shares-on-windows-7-from-windows-xp
>
> I'm wondering if the problem lies in the "server max level = NT1"
> issue we've seen before with Windows 10?
>
> In other words, the problem may lie in the PXE Windows PE 10.0
> environment.
>
> It's making a request but not receiving the answer it requires to
> make the connection.
>

I thought that something like that might be the problem, but I can
connect from a win10 machine to a standalone Samba 4.4.5 server, which
has these as the defaults:

server max protocol = SMB3
server min protocol = LANMAN1

So, as Windows PE 10 is probably a subset of Windows 10, it should
work. It is definitely worth trying, but if it doesn't work, then it
could be a bug, but in Windows PE 10 not Samba.

Rowland

[Steve Ankeny]

On 08/08/2016 02:58 PM, Rowland Penny wrote:
> On Mon, 8 Aug 2016 14:33:37 -0400
> Steve Ankeny <ste...@cinergymetro.net> wrote:
>
>
>> Looking at a "System 58 error" with Windows 7 --
>>
>> https://serverfault.com/questions/69049/system-error-58-while-accessing-shares-on-windows-7-from-windows-xp
>>
>> I'm wondering if the problem lies in the "server max level = NT1"
>> issue we've seen before with Windows 10?
>>
>> In other words, the problem may lie in the PXE Windows PE 10.0
>> environment.
>>
>> It's making a request but not receiving the answer it requires to
>> make the connection.
>>
>
> I thought that something like that might be the problem, but I can
> connect from a win10 machine to a standalone Samba 4.4.5 server, which
> has these as the defaults:
>
> server max protocol = SMB3
> server min protocol = LANMAN1
>
> So, as Windows PE 10 is probably a subset of Windows 10, it should
> work. It is definitely worth trying, but if it doesn't work, then it
> could be a bug, but in Windows PE 10 not Samba.
>
> Rowland
>
>

What got me thinking along these lines was reviewing Windows PE & PXE

PXE uses common protocols such DHCP & TFTP as to boot a "blank" machine
to a network share.

https://en.wikipedia.org/wiki/Preboot_Execution_Environment

In essence, the client loads a network driver that finds a network share
through DHCP or TFTP, and from that share, it downloads whatever files
are necessary to "install" an operating system (Solaris used to do this)

Windows PE is a subset of the full Windows installation, so yes, it
essentially boots a slimmed down version that acts much like a command
line environment from which the entire operating system can install.

https://en.wikipedia.org/wiki/Windows_Preinstallation_Environment

It's a nice method of being able to install new clients with a prebuilt
environment to a new machine.

It's more-or-less hands-off while the installation takes place. We used
to do that with Windows NT 4.0

And, as I said, we used to do something similar installing a brand new
"blank" Sun machine (install from network)

I have a USB drive that "boots" Windows 7 PE It allows me to install
new machines or to troubleshoot existing. You use "net connect" to
connect to a network share and download whatever tools you need from there.

[Jeremy Allison]

On Mon, Aug 08, 2016 at 03:44:32PM -0400, Steve Ankeny wrote:
> On 08/08/2016 02:58 PM, Rowland Penny wrote:
> >On Mon, 8 Aug 2016 14:33:37 -0400
> >Steve Ankeny <ste...@cinergymetro.net> wrote:
> >
> >
> >>Looking at a "System 58 error" with Windows 7 --
> >>
> >>https://serverfault.com/questions/69049/system-error-58-while-accessing-shares-on-windows-7-from-windows-xp
> >>
> >>I'm wondering if the problem lies in the "server max level = NT1"
> >>issue we've seen before with Windows 10?
> >>
> >>In other words, the problem may lie in the PXE Windows PE 10.0
> >>environment.
> >>
> >>It's making a request but not receiving the answer it requires to
> >>make the connection.

Can you get a debug level 10 log from Samba, plus a wireshark
trace of this operation failing please ?

[Steve Ankeny]

On 08/08/2016 04:35 PM, Jeremy Allison wrote:
> On Mon, Aug 08, 2016 at 03:44:32PM -0400, Steve Ankeny wrote:
>> On 08/08/2016 02:58 PM, Rowland Penny wrote:
>>> On Mon, 8 Aug 2016 14:33:37 -0400
>>> Steve Ankeny <ste...@cinergymetro.net> wrote:
>>>
>>>
>>>> Looking at a "System 58 error" with Windows 7 --
>>>>
>>>> https://serverfault.com/questions/69049/system-error-58-while-accessing-shares-on-windows-7-from-windows-xp
>>>>
>>>> I'm wondering if the problem lies in the "server max level = NT1"
>>>> issue we've seen before with Windows 10?
>>>>
>>>> In other words, the problem may lie in the PXE Windows PE 10.0
>>>> environment.
>>>>
>>>> It's making a request but not receiving the answer it requires to
>>>> make the connection.
> Can you get a debug level 10 log from Samba, plus a wireshark
> trace of this operation failing please ?
>
>

Great idea, Jeremy, but it has to come from the OP, Ralf Aumuller!

[Rowland Penny]

On Mon, 8 Aug 2016 17:09:49 -0400

Steve Ankeny <ste...@cinergymetro.net> wrote:

> On 08/08/2016 04:35 PM, Jeremy Allison wrote:
> > On Mon, Aug 08, 2016 at 03:44:32PM -0400, Steve Ankeny wrote:
> >> On 08/08/2016 02:58 PM, Rowland Penny wrote:
> >>> On Mon, 8 Aug 2016 14:33:37 -0400
> >>> Steve Ankeny <ste...@cinergymetro.net> wrote:
> >>>
> >>>
> >>>> Looking at a "System 58 error" with Windows 7 --
> >>>>
> >>>> https://serverfault.com/questions/69049/system-error-58-while-accessing-shares-on-windows-7-from-windows-xp
> >>>>
> >>>> I'm wondering if the problem lies in the "server max level = NT1"
> >>>> issue we've seen before with Windows 10?
> >>>>
> >>>> In other words, the problem may lie in the PXE Windows PE 10.0
> >>>> environment.
> >>>>
> >>>> It's making a request but not receiving the answer it requires to
> >>>> make the connection.
> > Can you get a debug level 10 log from Samba, plus a wireshark
> > trace of this operation failing please ?
> >
> >
> Great idea, Jeremy, but it has to come from the OP, Ralf Aumuller!
>
>
>
>

OK, after downloading WindowsPE 10 and installing it in a VM, I can
confirm two things, as standard it doesn't connect to a Samba standalone
server and adding 'server max protocol = NT1' to smb.conf on the
Samba server, fixes it.

I have the level 10 logs.
Jeremy, do you still want the wireshark trace ?

Rowland

[Ralf Aumüller]

On 08/09/2016 11:28 AM, Rowland Penny wrote:

> OK, after downloading WindowsPE 10 and installing it in a VM, I can
> confirm two things, as standard it doesn't connect to a Samba standalone
> server and adding 'server max protocol = NT1' to smb.conf on the
> Samba server, fixes it.
>
> I have the level 10 logs.
> Jeremy, do you still want the wireshark trace ?

Can confirm that adding 'server max protocol = NT1' fixes it. Was still in the
process finding out how to provide logs -- but Rowland was faster. If I can
provide any info please let me know.

Best regards,
Ralf

[Rowland Penny]

On Tue, 9 Aug 2016 11:49:01 +0100
Rowland Penny <rpe...@samba.org> wrote:

> On Tue, 9 Aug 2016 10:28:24 +0100
> Rowland Penny <rpe...@samba.org> wrote:
>
> >
> > OK, after downloading WindowsPE 10 and installing it in a VM, I can
> > confirm two things, as standard it doesn't connect to a Samba
> > standalone server and adding 'server max protocol = NT1' to smb.conf
> > on the Samba server, fixes it.
> >
> > I have the level 10 logs.
> > Jeremy, do you still want the wireshark trace ?
> >
> > Rowland
> >
>

As I do not really know how to use wireshark and all the info I could
find expects the server to be running a GUI, I had a look on the
Samba wiki and found this page:

https://www.samba.org/~asn/reporting_samba_bugs.txt

So basically following that, here are the level 10 log files, a pcap
file and the smb.conf I used.

[Steve Ankeny via samba]

Kool, Rowland! You do take the cake.

[Jeremy Allison via samba]

On Tue, Aug 09, 2016 at 11:49:01AM +0100, Rowland Penny wrote:
> On Tue, 9 Aug 2016 10:28:24 +0100
> Rowland Penny <rpe...@samba.org> wrote:
>
> >

> > OK, after downloading WindowsPE 10 and installing it in a VM, I can
> > confirm two things, as standard it doesn't connect to a Samba
> > standalone server and adding 'server max protocol = NT1' to smb.conf
> > on the Samba server, fixes it.
> >
> > I have the level 10 logs.
> > Jeremy, do you still want the wireshark trace ?
> >
> > Rowland
> >
>

> As I do not really know how to use wireshark and all the info I could
> find expects the server to be running a GUI, I had a look on the
> Samba wiki and found this page:
>
> https://www.samba.org/~asn/reporting_samba_bugs.txt
>
> So basically following that, here are the level 10 log files, a pcap
> file and the smb.conf I used.

Thanks a lot for that ! Can you log a bug at bugzilla.samba.org
and upload these files so we can track it ?

If you don't get to it today I'll try and get to it, but
having a bugzilla bug will allow us to keep all info on
the problem together.

Much appreciated Rowland and thanks a *LOT* for reproducing !

Jeremy.

[Jeremy Allison via samba]

On Tue, Aug 09, 2016 at 11:49:01AM +0100, Rowland Penny wrote:
> On Tue, 9 Aug 2016 10:28:24 +0100
> Rowland Penny <rpe...@samba.org> wrote:
>
> >

> > OK, after downloading WindowsPE 10 and installing it in a VM, I can
> > confirm two things, as standard it doesn't connect to a Samba
> > standalone server and adding 'server max protocol = NT1' to smb.conf
> > on the Samba server, fixes it.
> >
> > I have the level 10 logs.
> > Jeremy, do you still want the wireshark trace ?
> >
> > Rowland
> >
>

> As I do not really know how to use wireshark and all the info I could
> find expects the server to be running a GUI, I had a look on the
> Samba wiki and found this page:
>
> https://www.samba.org/~asn/reporting_samba_bugs.txt
>
> So basically following that, here are the level 10 log files, a pcap
> file and the smb.conf I used.

Logged as bug:

https://bugzilla.samba.org/show_bug.cgi?id=12136

Cheers,

Jeremy.

[Jeremy Allison via samba]

On Tue, Aug 09, 2016 at 11:49:01AM +0100, Rowland Penny wrote:
> On Tue, 9 Aug 2016 10:28:24 +0100
> Rowland Penny <rpe...@samba.org> wrote:
>
> >

> > OK, after downloading WindowsPE 10 and installing it in a VM, I can
> > confirm two things, as standard it doesn't connect to a Samba
> > standalone server and adding 'server max protocol = NT1' to smb.conf
> > on the Samba server, fixes it.
> >
> > I have the level 10 logs.
> > Jeremy, do you still want the wireshark trace ?
> >
> > Rowland
> >
>

> As I do not really know how to use wireshark and all the info I could
> find expects the server to be running a GUI, I had a look on the
> Samba wiki and found this page:
>
> https://www.samba.org/~asn/reporting_samba_bugs.txt
>
> So basically following that, here are the level 10 log files, a pcap
> file and the smb.conf I used.

Thanks Rowland, sorry for the delay in looking at this.

Can you get a wireshark trace of this client connecting
to a Windows server please ?

It seems to be trying to log on using a 'guest' connection,
and refusing to accept the reply we finally give to
the SMB2 sessionsetup.

Seeing a WindowsPE 10 -> Windows server trace would
help in me figuring out what is missing.

I'll try following up with this at the SNIA conf
next week if I can get a WindowsPE10 install.

Cheers,

Jeremy.

[Rowland Penny via samba]

Hi jeremy, there was a very big hint in there ;-)

'As I do not really know how to use wireshark'

You tell me what to do and I will do it.

Rowland

[Jeremy Allison via samba]

Let me try and get to this next week with Microsoft
engineers at SNIA.

Thanks !

Jeremy.