Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

[Samba] mount cifs

360 views
Skip to first unread message

lists

unread,
Apr 18, 2016, 3:50:04 PM4/18/16
to
Hi,

I updated our servers to 4.2.11, and I have a problem, but I'm not sure
if the problem is related to the update.

I am trying to use mount.cifs:

> mount -t cifs -o username=username,password=super_secret,domain=WRKGRP //ip.of.our.samba/share /mnt
> mount error(112): Host is down
> Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

Host is up, i can use smbclient to connect, and also coming from windows
everything works.

I also tried adding sec=ntlmv2i, makes no difference.

mount.cifs version: 6.4, debian jessie

Could this perhaps have something to do with the new defaults getting in
the way? Host down seems such a strange message...

The only interesting lines on the samba server (log level 5) is:

> [2016/04/18 21:39:44.373051, 5] ../source3/lib/messages.c:384(messaging_register)
> Registering messaging pointer for type 1 - private_data=(nil)
> [2016/04/18 21:39:44.496187, 5] ../source3/lib/util_sock.c:132(read_fd_with_timeout)
> read_fd_with_timeout: blocking read. EOF from client.
> [2016/04/18 21:39:44.496225, 5] ../source3/smbd/process.c:553(receive_smb_talloc)
> receive_smb_raw_talloc failed for client ipv4:192.87.143.26:60884 read error = NT_STATUS_END_OF_FILE.
> [2016/04/18 21:39:44.496318, 4] ../source3/smbd/sec_ctx.c:316(set_sec_ctx)
> setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
> [2016/04/18 21:39:44.496342, 5] ../libcli/security/security_token.c:53(security_token_debug)
> Security token: (NULL)

EOF from client, NT_STATUS_END_OF_FILE?

Ideas anyone?

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

Denis Cardon

unread,
Apr 19, 2016, 3:30:03 AM4/19/16
to
Hi lists at merit.unu.edu,

> I updated our servers to 4.2.11, and I have a problem, but I'm not sure
> if the problem is related to the update.

I've had a call from a client yesterday who had issue with his copiers'
scan2folder feature after badlock samba file server upgrade. The
mount.cifs ntlm basic auth was not working either, and we had to
configure "server signing=disabled" as a temporary workaround. Could you
try that?

Cheers,

Denis
Denis Cardon
Tranquil IT Systems
Les Espaces Jules Verne, bâtiment A
12 avenue Jules Verne
44230 Saint Sébastien sur Loire
tel : +33 (0) 2.40.97.57.55
http://www.tranquil-it-systems.fr

lists

unread,
Apr 19, 2016, 7:50:04 AM4/19/16
to
Hi Denis, list,


On 19-4-2016 9:18, Denis Cardon wrote:
> Hi lists at merit.unu.edu,
>
>> I updated our servers to 4.2.11, and I have a problem, but I'm not sure
>> if the problem is related to the update.
>
> I've had a call from a client yesterday who had issue with his copiers'
> scan2folder feature after badlock samba file server upgrade. The
> mount.cifs ntlm basic auth was not working either, and we had to
> configure "server signing=disabled" as a temporary workaround. Could you
> try that?

Disabled server signing, but unfortunately the error remains the same.

Any other suggestions..?

Could someone else check that mount.cifs 6.4 on jessie is still working
against samba after the badlock upgrade?

MJ

lists

unread,
Apr 19, 2016, 9:10:03 AM4/19/16
to

On 19-4-2016 9:18, Denis Cardon wrote:
> Hi lists at merit.unu.edu,
>
>> I updated our servers to 4.2.11, and I have a problem, but I'm not sure
>> if the problem is related to the update.
>
> I've had a call from a client yesterday who had issue with his copiers'
> scan2folder feature after badlock samba file server upgrade. The
> mount.cifs ntlm basic auth was not working either, and we had to
> configure "server signing=disabled" as a temporary workaround. Could you
> try that?

Reading the release notes for the samba badlock release, we are advised
to use mount.cifs with "sec=krb5(i)" or "sec=ntlmssp(i)", and not
"sec=ntlmv2".

I am using those, but still receive the "mount error(112): Host is down"
error. I tried mount.cifs to connect to a real windows machine, and that
one works as expected.

So the problem seems to be samba-specific..?

lists

unread,
Apr 19, 2016, 9:50:04 AM4/19/16
to
Found some more info:

mount.cifs to mount shares from my DCs (samba 4.2.11) works
mount.cifs to mount shares from smbserver (also 4.2.11) does NOT work.

Here is the debug log it produces:

> root@epo:/proc/fs/cifs# mount.cifs //smbserver.domain.com/share /mnt -o username=username,domain=WRKGRP,sec=ntlmsspi
> Password:
> Apr 19 15:19:58 epo kernel: [74522.479080] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/cifsfs.c: Devname: //smbserver.domain.com/share flags: 0
> Apr 19 15:19:58 epo kernel: [74522.479098] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: Domain name set
> Apr 19 15:19:58 epo kernel: [74522.479103] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: Username: username
> Apr 19 15:19:58 epo kernel: [74522.479111] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: file mode: 0x1ed dir mode: 0x1ed
> Apr 19 15:19:58 epo kernel: [74522.479229] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: CIFS VFS: in cifs_mount as Xid: 133 with uid: 0
> Apr 19 15:19:58 epo kernel: [74522.479234] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: UNC: \\smbserver.domain.com\share ip: 1.2.3.4
> Apr 19 15:19:58 epo kernel: [74522.479268] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: Socket created
> Apr 19 15:19:58 epo kernel: [74522.479272] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: sndbuf 16384 rcvbuf 87380 rcvtimeo 0x6d6
> Apr 19 15:19:58 epo kernel: [74522.479748] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/fscache.c: cifs_fscache_get_client_cookie: (0xffff88105ddb8000/0xffff88085cdf6c00)
> Apr 19 15:19:58 epo kernel: [74522.479758] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: CIFS VFS: in cifs_get_smb_ses as Xid: 134 with uid: 0
> Apr 19 15:19:58 epo kernel: [74522.479763] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: Existing smb sess not found
> Apr 19 15:19:58 epo kernel: [74522.479776] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/cifssmb.c: secFlags 0x1081
> Apr 19 15:19:58 epo kernel: [74522.479780] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/cifssmb.c: NTLMSSP only mechanism, enable extended security
> Apr 19 15:19:58 epo kernel: [74522.479788] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: Demultiplex PID: 13704
> Apr 19 15:19:58 epo kernel: [74522.479798] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/transport.c: For smb_command 114
> Apr 19 15:19:58 epo kernel: [74522.479809] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/transport.c: Sending smb: total_len 82
> Apr 19 15:19:58 epo kernel: [74522.491173] /build/linux-4wkEzn/linux-3.2.68/fs/cifs/connect.c: Received no data or error: expecting 4 got 0
> mount error(112): Host is down
> Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
> root@epo:/proc/fs/cifs#

And even though mount.cifs complains and refuses to mount stuff, the
smbserver ACTUALLY works fine, all windows clients map their drives to
it, I can also browse it with smbclient. It's just mount.cifs that
complains.

As for smb.conf options: similar on the DCs and the smbserver, with:

server signing = mandatory
ntlm auth = yes
server min protocol = SMB2
client max protocol = SMB3

Any ideas why mount.cifs doesn't connect to our smbserver?

MJ

Dale Schroeder

unread,
Apr 19, 2016, 2:40:03 PM4/19/16
to
I echo MJ's request, what is now needed to mount a CIFS share? Using
krb5 was mentioned, but what about standalone servers that don't use
kerberos?

Dale

Helmut Hullen

unread,
Apr 19, 2016, 3:00:03 PM4/19/16
to
Hallo, Dale,

Du meintest am 19.04.16:

>> Found some more info:
>>
>> mount.cifs to mount shares from my DCs (samba 4.2.11) works
>> mount.cifs to mount shares from smbserver (also 4.2.11) does NOT
>> work.

[...]

>> As for smb.conf options: similar on the DCs and the smbserver, with:
>>
>> server signing = mandatory
>> ntlm auth = yes
>> server min protocol = SMB2
>> client max protocol = SMB3
>>
>> Any ideas why mount.cifs doesn't connect to our smbserver?


> I echo MJ's request, what is now needed to mount a CIFS share? Using
> krb5 was mentioned, but what about standalone servers that don't use
> kerberos?

Again: try (the default)

max protocol = NT1

instead of the above options.

Viele Gruesse!
Helmut

mj

unread,
Apr 19, 2016, 3:30:04 PM4/19/16
to
Hi Helmut,

On 04/19/2016 08:44 PM, Helmut Hullen wrote:
> Again: try (the default)
>
> max protocol = NT1
>
> instead of the above options.

If I understand things correctly, this would set my samba server to use
NT1 as the MAX protocol, no SMB2 or SMB3 anymore?

Or do I misunderstand something?

Dale Schroeder

unread,
Apr 19, 2016, 4:40:03 PM4/19/16
to
On 04/19/2016 1:44 PM, Helmut Hullen wrote:
> Hallo, Dale,
>
> Du meintest am 19.04.16:
>
>>> Found some more info:
>>>
>>> mount.cifs to mount shares from my DCs (samba 4.2.11) works
>>> mount.cifs to mount shares from smbserver (also 4.2.11) does NOT
>>> work.
> [...]
>
>>> As for smb.conf options: similar on the DCs and the smbserver, with:
>>>
>>> server signing = mandatory
>>> ntlm auth = yes
>>> server min protocol = SMB2
>>> client max protocol = SMB3
>>>
>>> Any ideas why mount.cifs doesn't connect to our smbserver?
>
>> I echo MJ's request, what is now needed to mount a CIFS share? Using
>> krb5 was mentioned, but what about standalone servers that don't use
>> kerberos?
> Again: try (the default)
>
> max protocol = NT1
>
> instead of the above options.
>
> Viele Gruesse!
> Helmut

Helmut,

I added that parameter to smb.conf, then ran this:

mount -t cifs //path/to/share /path/to/mount_point -o
sec=ntlmv2,credentials=/path/to/credentials_file

and got this:

mount error(22): Invalid argument
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

It seems that something more is needed.

Thanks,
Dale

Helmut Hullen

unread,
Apr 19, 2016, 4:50:03 PM4/19/16
to
Hallo, mj,

Du meintest am 19.04.16:

>> Again: try (the default)
>>
>> max protocol = NT1
>>
>> instead of the above options.

> If I understand things correctly, this would set my samba server to
> use NT1 as the MAX protocol, no SMB2 or SMB3 anymore?

a. you understand right
b. with that (default) option my samba3 server (Samba 4.2 running as no
AD server) mounts Linux, Windows XP, Windows 7 and Windows 10 shares.
And all these clients can mount (with other commands) the server shares.

Viele Gruesse!
Helmut

Helmut Hullen

unread,
Apr 19, 2016, 5:00:04 PM4/19/16
to
Hallo, Dale,

Du meintest am 19.04.16:

>>>> As for smb.conf options: similar on the DCs and the smbserver,
>>>> with:
>>>>
>>>> server signing = mandatory
>>>> ntlm auth = yes
>>>> server min protocol = SMB2
>>>> client max protocol = SMB3


>> Again: try (the default)
>>
>> max protocol = NT1
>>
>> instead of the above options.



> I added that parameter to smb.conf, then ran this:

You should not add it, this option should _replace_ the above options.

Viele Gruesse!
Helmut

mj

unread,
Apr 20, 2016, 3:50:04 AM4/20/16
to
Hi all,

The solution for me turned out to be, adding this:

server min protocol = NT1

So I did NOT want to set a max protocol, because the way I understand
things, that would force ALL my connections to use that as a maximum:
not acceptable for us.

However, specifying a min protocol, we allow samba to serve clients with
lower security as well.

It would be nice to allow these lower security options to *specific*
clients only, instead of just global on/off.

Anyway: with the above option, mount.cifs works again.

MJ

Dale Schroeder

unread,
Apr 20, 2016, 8:50:03 AM4/20/16
to
On 04/19/2016 3:49 PM, Helmut Hullen wrote:
> Hallo, Dale,
>
> Du meintest am 19.04.16:
>
>>>>> As for smb.conf options: similar on the DCs and the smbserver,
>>>>> with:
>>>>>
>>>>> server signing = mandatory
>>>>> ntlm auth = yes
>>>>> server min protocol = SMB2
>>>>> client max protocol = SMB3
>
>>> Again: try (the default)
>>>
>>> max protocol = NT1
>>>
>>> instead of the above options.
>
>
>> I added that parameter to smb.conf, then ran this:
> You should not add it, this option should _replace_ the above options.
>
> Viele Gruesse!
> Helmut
Hi Helmut,

Thanks for your help.

The additions above were MJ's not mine. I have no such declarations, so
they are the defaults ==>

server min protocol = LANMAN1
server signing = default
ntlm auth = Yes

This is on Debian with Samba version 4.3.7.

If I am to replace some values, which ones are you suggesting?


Thanks,
Dale

Helmut Hullen

unread,
Apr 20, 2016, 11:50:06 AM4/20/16
to
Hallo, Dale,

Du meintest am 20.04.16:


> Thanks for your help.

> The additions above were MJ's not mine. I have no such declarations,
> so they are the defaults ==>

> server min protocol = LANMAN1
> server signing = default
> ntlm auth = Yes

> This is on Debian with Samba version 4.3.7.

> If I am to replace some values, which ones are you suggesting?

Sorry - I don't use Debian, and I use Samba not as AD; I don't know what
special options Debian requests.

Viele Gruesse!
Helmut

L.P.H. van Belle

unread,
Apr 20, 2016, 12:30:03 PM4/20/16
to
4.3.7 Debian = 4.3.8 samba.org

But last Saturday Jelmer updated to 4.3.8 so its not confusing anymore.
Go through the list, see which versions i tested.

Recap.
Imo 4.4.2 is at this time the only with correct outputs.

DONT GET MET WRONG.

Debian 4.2.10, yes, wbinfo -u mail fail, but EVERYTHING works.
You just dont see any output.

Debian 4.3.8, yes, wbinfo -u mail fail, but EVERYTHING works.
You just dont see any output.

Debian 4.4.1, yes, wbinfo -u mail fail, but EVERYTHING works.
You just dont see any output.

Debian 4.4.2, ( samba source, with debian patches, -1 ) everything works.


Greetz,

Louis



> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-...@lists.samba.org] Namens Denis Cardon
> Verzonden: woensdag 20 april 2016 18:19
> Aan: Dale Schroeder; sa...@lists.samba.org
> Onderwerp: Re: [Samba] mount cifs
>
> Hi Dale,
>
> ...
> > ntlm auth = Yes
> >
> > This is on Debian with Samba version 4.3.7.
>
> are you really using 4.3.7? Samba 4.3.7 was an samba team "internal"
> intermediate release before the 12th of April badlock announcement which
> brought 4.3.8.
>
> On https://www.samba.org/samba/history/ , samba 4.3.7 is flaged as "do
> not use"...
>
> Cheers,
>
> Denis
>
>
> >
> > If I am to replace some values, which ones are you suggesting?
> >
> >
> > Thanks,
> > Dale
> >
>
> --
> Denis Cardon
> Tranquil IT Systems
> Les Espaces Jules Verne, bâtiment A
> 12 avenue Jules Verne
> 44230 Saint Sébastien sur Loire
> tel : +33 (0) 2.40.97.57.55
> http://www.tranquil-it-systems.fr
>
>

Denis Cardon

unread,
Apr 20, 2016, 12:30:03 PM4/20/16
to
Hi Dale,

...
> ntlm auth = Yes
>
> This is on Debian with Samba version 4.3.7.

are you really using 4.3.7? Samba 4.3.7 was an samba team "internal"
intermediate release before the 12th of April badlock announcement which
brought 4.3.8.

On https://www.samba.org/samba/history/ , samba 4.3.7 is flaged as "do
not use"...

Cheers,

Denis


>
> If I am to replace some values, which ones are you suggesting?
>
>
> Thanks,
> Dale
>

--
Denis Cardon
Tranquil IT Systems
Les Espaces Jules Verne, bâtiment A
12 avenue Jules Verne
44230 Saint Sébastien sur Loire
tel : +33 (0) 2.40.97.57.55
http://www.tranquil-it-systems.fr


Rowland penny

unread,
Apr 20, 2016, 12:40:04 PM4/20/16
to
On 20/04/16 17:18, Denis Cardon wrote:
> Hi Dale,
>
> ...
>> ntlm auth = Yes
>>
>> This is on Debian with Samba version 4.3.7.
>
> are you really using 4.3.7? Samba 4.3.7 was an samba team "internal"
> intermediate release before the 12th of April badlock announcement
> which brought 4.3.8.
>
> On https://www.samba.org/samba/history/ , samba 4.3.7 is flaged as "do
> not use"...
>
> Cheers,
>
> Denis
>
>
>>
>> If I am to replace some values, which ones are you suggesting?
>>
>>
>> Thanks,
>> Dale
>>
>

Somebody else that this has confused, Debian 4.3.7 was patched to be the
same as Samba 4.3.8, or to put it another, Samba 4.3.8 includes the
separate patch that was added to Debian 4.3.7

Is that any clearer, I got slapped down for saying this was a S####d idea.

Rowland

Dale Schroeder

unread,
Apr 20, 2016, 2:30:03 PM4/20/16
to
On 04/20/2016 11:24 AM, L.P.H. van Belle wrote:
> 4.3.7 Debian = 4.3.8 samba.org
>
> But last Saturday Jelmer updated to 4.3.8 so its not confusing anymore.
> Go through the list, see which versions i tested.
>
> Recap.
> Imo 4.4.2 is at this time the only with correct outputs.
>
> DONT GET MET WRONG.
>
> Debian 4.2.10, yes, wbinfo -u mail fail, but EVERYTHING works.
> You just dont see any output.
>
> Debian 4.3.8, yes, wbinfo -u mail fail, but EVERYTHING works.
> You just dont see any output.
>
> Debian 4.4.1, yes, wbinfo -u mail fail, but EVERYTHING works.
> You just dont see any output.
>
> Debian 4.4.2, ( samba source, with debian patches, -1 ) everything works.
>
>
> Greetz,
>
> Louis
>
Louis,

I haven't had any problems with wbinfo; it continues to function. What I
can't get to work is a CIFS mount. Even rsync continues to work.

Note that this domain is an AD domain, therefore a different network and
domain than the NT4 problem in my other thread. The only thing they
have in common is that both have broken parts after upgrading to more
recent versions of Samba.

Dale
0 new messages