[Samba] [3.6.8] XP fails with error 1326

[Winfried]

Hello

I've googled and experimented for the past few hours but am still stuck
trying to simply share a temporary directory in read-only with anyone on the
LAN.

Here's the smb.conf I'm using:
==================================
/etc/samba# cat smb.conf
[global]
workgroup = WORKGROUP
encrypt passwords = yes
;wins support = yes
;log level = 1
;max log size = 1000
;read only = no
guest account = nobody

;[homes]
;browsable = no
;map archive = yes

[test]
path = /tmp
browsable = yes
read only = yes
guest ok = yes
;public = yes
==================================

Neither smbd nor nmbd show any error in the log files, so I guess things are
fine on this end.

But the share isn't displayed in XP's NetHood and "net view" returns this:
"System error 1326 has occurred. Logon failure: unknown user name or bad
password."

Any idea what could prevent XP from reading the share?

Thank you.



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631.html
Sent from the Samba - General mailing list archive at Nabble.com.
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Gaiseric Vandal]

Does the unix level nobody account exist?


Does it work with Win 7 clients?

[Rowland Penny]

Hi, I think you need to add these two lines to [global]:

security = user
map to guest = Bad User

Rowland

[Winfried]

Thanks for the help.

The "nobody" account was available by default in /etc/passwd. This is for a
home setup, and don't have a Windows7 to test.

Some feedback:
1. After adding "security = user" to the [global] section, killing and
restarting smbd/nmbd, XP still returns System error 1326 "Logon failure:
unknown user name or bad password." when typing "net view"

2. After adding "map to guest" to the [global] section, I now get "System
error 5 has occurred.
Access is denied."

FWIW, here's the "nobody" line in /etc/passwd:
nobody:x:99:99:nobody:/:/bin/false

If possible, I'd rather not have to add a user in /etc/passwd and a password
through smbpasswd just to share a few read-only files.

Thank you.



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654675.html

Sent from the Samba - General mailing list archive at Nabble.com.

[Winfried]

By editing "log level" to "2", log.smbd nows says "Authentication for user
[fred]" -> FAILED with error NT_STATUS_NO_SUCH_USER".

I read that Samba is able to share files with anonymous users, where all
users will be treated as "nobody": If this indeed possible, what do I need
to do?

Here's my smb.conf at this point:
=======================

[global]
workgroup = WORKGROUP
encrypt passwords = yes
;wins support = yes

log level = 2

;max log size = 1000
;read only = no
guest account = nobody

security = user
map to guest = Bad User

;[homes]
;browsable = no
;map archive = yes

[test]
path = /tmp
browsable = yes
read only = yes
guest ok = yes

;Still get ERR 5
;public = yes

;Err 6118: List of servers for workgroup not currently available
force user = nobody
=======================

Thank you.



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654676.html

[Dale Schroeder]

Here's the official wiki page:
http://wiki.samba.org/index.php/Public_Samba_Server

It looks like you've done what the page says. If that is the case, then
you will have to look for some other oddity.

Dale

[Rowland Penny]

OK, so I set up a test VM and set up samba as above and tried to connect
from a Linux Mint 15 machine running cinnamon and got the same result as
the OP. On cinnamon the file browser has the ability to connect to a
server via 'File' --> 'Connect to server', now if I use this and enter
the samba 3 servers details etc it connects and I can read a test
document I placed in the /tmp dir on the server. Initially it did not
connect, but once I changed the 'Domain' setting that cinnamon had
filled in automatically, from my domain name to 'workgroup' it did
connect, could this be the OP's problem?

Rowland

[Winfried]

Thanks for the help.

One thing that isn't clear from what I read on the Net, is whether it is
required to create a user in Samba or if an entry in /etc/passwd is enough
to grant access: Several documents use the "nobody" account which is already
part of /etc/passwd by default, so I didn't originally think it necessary to
also add that username in Samba.

1. But then, I suspected the former, and ran "useradd samba" followed by
"smbpasswd -a samba" with a password:
<code>
# smbpasswd -a samba
New SMB password: blah
Retype new SMB password: blah
</code>

2. However, I notice that "pdbedit" is 1) missing data for "NT username",
and 2) uses the Netbios name for the Domain instead of the Workgroup name I
chose:

smb.conf
<code>
[global]
workgroup = WORKGROUP
netbios name = LINUX

encrypt passwords = yes

;wins support = yes
log level = 2
;max log size = 1000

;guest account = nobody
guest account = samba

map to guest = Bad User

;REQUIRES ADDING USERS TO SAMBA THROUGH smbpasswd?
security = user
;DEPRECATED BUT REQUIRED WHEN USING nobody?
;security = share

;DEPRECATED
;null passwords = yes

[test]
path = /tmp
browsable = yes
read only = yes
guest ok = yes

only guest = yes
public = yes
available = yes

;force user = nobody
force user = samba
</code>

pdbedit -L -v
<code>
Unix username: samba
NT username:
Account Flags: [U ]
User SID: S-1-5-21-3543732248-827301621-1011492160-501
Primary Group SID: S-1-5-21-3543732248-827301621-1011492160-513
Full Name:
Home Directory:
HomeDir Drive: (null)
Logon Script:
Profile Path:
Domain: LINUX
</code>

3. Finally, when running "net view" from a Windows 7 host, Samba still
doesn't 1) force usernames to "samba" and 2) grant access:
<code>
[2013/10/09 16:13:41.458888, 2] smbd/reply.c:553(reply_special)
netbios connect: name1=LINUX 0x20 name2=FRED-PC 0x0
[2013/10/09 16:13:41.460377, 2] smbd/reply.c:573(reply_special)
netbios connect: local=linux remote=fred-pc, name type = 0
[2013/10/09 16:13:41.465734, 2] smbd/sesssetup.c:1279(setup_new_vc_session)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all
old resources.
[2013/10/09 16:13:41.468900, 2] smbd/sesssetup.c:1279(setup_new_vc_session)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all
old resources.
[2013/10/09 16:13:41.818774, 2] smbd/reply.c:553(reply_special)
netbios connect: name1=LINUX 0x20 name2=FRED-PC 0x0
[2013/10/09 16:13:41.820275, 2] smbd/reply.c:573(reply_special)
netbios connect: local=linux remote=fred-pc, name type = 0
[2013/10/09 16:13:41.832520, 2] auth/auth.c:319(check_ntlm_password)
check_ntlm_password: Authentication for user [fred] -> [fred] FAILED with
error NT_STATUS_NO_SUCH_USER
[2013/10/09 16:13:41.837126, 2] auth/auth.c:319(check_ntlm_password)
check_ntlm_password: Authentication for user [fred] -> [fred] FAILED with
error NT_STATUS_NO_SUCH_USER
</code>

Any idea what I could try next?

Thank you.



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654749.html

Sent from the Samba - General mailing list archive at Nabble.com.

[Rowland Penny]

Hi, when I ran my test, I only had the root user on my VM and did not
add any users to samba.

Rowland

[Winfried]

Thanks for the tip.

However, I read that /etc/passwd only contains hashes and not the actual
passwords, which is why Samba requires adding users to its own database.

Could you share your smb.conf so I see what it looks like when only relying
on entries from /etc/passwd and not prompting Windows users for their
passwords?



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654757.html

Sent from the Samba - General mailing list archive at Nabble.com.

[Rowland Penny]

On 09/10/13 16:20, Winfried wrote:
> Thanks for the tip.
>
> However, I read that /etc/passwd only contains hashes and not the actual
> passwords, which is why Samba requires adding users to its own database.
>
> Could you share your smb.conf so I see what it looks like when only relying
> on entries from /etc/passwd and not prompting Windows users for their
> passwords?
>
>
>
> --
> View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654757.html
> Sent from the Samba - General mailing list archive at Nabble.com.

Hi, this is the smb.conf I used:

[global]
workgroup = WORKGROUP
encrypt passwords = yes
log level = 2

guest account = nobody
security = user

map to guest = Bad User

[test]
path = /tmp
browsable = yes
read only = yes
guest ok = yes

Look familiar ?

man smb.conf has this to say about 'map to guest = Bad User'

Bad User - Means user logins with an invalid password are rejected,
unless the username does not exist, in which case it is treated as a
guest login and mapped into the guest account.

As I said the only user I had on the test VM was the root user and I did
not add any users to samba, so when I connected to the share, both the
user & the password did not exist, so I was mapped to the guest account
and as the share has 'guest ok = yes' I was allowed in.

Rowland

[Winfried]

A bit of progress:

1. security = user : doesn't switch from "fred" to "nobody", so it can't
work since the user isn't mapped to "nobody".

2. security = share : switches from "fred" to "nobody", but Access Denied:
<code>
check_ntlm_password: Authentication for user [nobody] -> [nobody] FAILED
with error NT_STATUS_LOGON_FAILURE
</code>

3. If I add "invalid users = nobody":
<code>
authorise_login: rejected invalid user nobody
[2013/10/11 02:01:49.538091, 2]
smbd/service.c:655(create_connection_session_info)
Invalid username/password for [IPC$]
[2013/10/11 02:01:49.540197, 1] smbd/service.c:805(make_connection_snum)
create_connection_session_info failed: NT_STATUS_WRONG_PASSWORD
</code>

4. If I add "null passwords = yes" to the mix:
<code>
authorise_login: rejected invalid user nobody
[2013/10/11 02:10:27.700093, 2]
smbd/service.c:655(create_connection_session_info)
Invalid username/password for [IPC$]
[2013/10/11 02:10:27.702215, 1] smbd/service.c:805(make_connection_snum)
create_connection_session_info failed: NT_STATUS_WRONG_PASSWORD
</code>



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654833.html

Sent from the Samba - General mailing list archive at Nabble.com.

[Winfried]

Thanks but still no go :-/

At this point, I can see the server (Looks like "netbios name" is required,
while I assumed its absence would have Samba use the Unix hostname), but
when I use "c:\net view \\linux", I get the familiar error 5 "Access
denied". Samba still seems to not ignore the Windows username and use
"nobody" instead.

1. # grep nobody /etc/passwd

nobody:x:99:99:nobody:/:/bin/false

2. # grep nobody /etc/shadow
nobody:*:9797:0:::::

3. # pdbedit -Lv
---------------
Unix username: nobody

NT username:
Account Flags: [U ]

Full Name: nobody
Domain: LINUX

4. # pdbedit -x -u nobody
user nobody does not exist in the passdb

5. C:\Users\fred>net view \\LINUX

System error 5 has occurred.

Access is denied.

6. [2013/10/10 17:27:45.997569, 2] auth/auth.c:319(check_ntlm_password)

check_ntlm_password: Authentication for user [fred] -> [fred] FAILED with
error NT_STATUS_NO_SUCH_USER

7. # cat smb.conf

[global]
workgroup = WORKGROUP
netbios name = LINUX

encrypt passwords = yes
log level = 2
guest account = nobody

map to guest = Bad User

security = user

[test]
path = /tmp
browsable = yes
read only = yes
guest ok = yes

I don't know where else to look. Could it be some setting in Windows 7?



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654808.html

Sent from the Samba - General mailing list archive at Nabble.com.

[Winfried]

Started over by removing the Windows host from the equation, and connecting
to Samba from within the server.

===============================

# cat smb.conf
[global]
workgroup = WORKGROUP

security = SHARE

[Plans]
path = /plans
read only = Yes
guest ok = Yes

===============================

# smbclient -L localhost -U%
WARNING: The security=share option is deprecated
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.8]

Sharename Type Comment
--------- ---- -------
Error returning browse list: NT_STATUS_ACCESS_DENIED
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.8]

===============================

I get the same error message when adding those items one at a time:

===============================
[Plans]
browsable = yes

[global]

guest account = nobody
map to guest = Bad User

===============================

However, when adding "invalid users = nobody" to [global], I get the
following error message:
===============================
nobody "tree connect failed: NT_STATUS_WRONG_PASSWORD"

[2013/10/11 12:13:40.210674, 0] smbd/password.c:731(authorise_login)

authorise_login: rejected invalid user nobody

===============================

So I figured maybe Samba requires adding the "nobody" user to its user
database instead of just relying on the entry in /etc/passwd:
===============================
# smbpasswd -an nobody
User nobody password set to none.
===============================

... but no go:
===============================
# smbclient -L localhost -U%
tree connect failed: NT_STATUS_WRONG_PASSWORD
===============================

Could it be due to the way Samba is compiled?



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654863.html

[Rowland Penny]

OK, as I said, I set up Ubuntu 12.0.3 server in a VM, installed samba
3.6.3 and used this smb.conf:

[global]
workgroup = WORKGROUP

encrypt passwords = yes
log level = 2
guest account = nobody

security = user

map to guest = Bad User

[test]
path = /tmp
browsable = yes
read only = yes
guest ok = yes

There are NO users on the Ubuntu server apart from the root user and NO
users have been added to samba.

I created a test document in /tmp

I then fired up an XP VM, logged in and went to 'My Network places',
typed into the navigation bar '\\192.168.0.227\test'

192.168.0.227 being the ipaddress of the samba 3.6.3 server and 'test'
being the share

After a short pause, up came the share and I could open the test
document in notepad.

So, unless there was a drastic change between 3.6.3 and 3.6.8, either
your latest smb.conf is at fault or it is network fault or similar. Try
opening a terminal on the Linux machine and typing 'man smb.conf' and
then start reading.

Rowland

[Winfried]

Doesn't work on my host.

# cat /etc/samba/smb.conf

[global]
workgroup = WORKGROUP
encrypt passwords = yes
log level = 2
guest account = nobody
security = user
map to guest = Bad User

[test]
path = /tmp
browsable = yes
read only = yes
guest ok = yes

# pdbedit -L
nobody:99:nobody

# smbpasswd -x nobody
Deleted user nobody.

# pdbedit -L

# /etc/rc.d/rc.samba restart

# smbclient -L localhost -U%

Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.8]

Sharename Type Comment
--------- ---- -------
Error returning browse list: NT_STATUS_ACCESS_DENIED
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.8]

Server Comment
--------- -------

Workgroup Master
--------- -------

# tail /var/log/samba/log.smbd

[2013/10/11 14:20:50.229649, 2] smbd/reply.c:553(reply_special)
netbios connect: name1=LOCALHOST 0x20 name2=SLAX 0x0
[2013/10/11 14:20:50.231106, 2] smbd/reply.c:573(reply_special)
netbios connect: local=localhost remote=slax, name type = 0



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654870.html

Sent from the Samba - General mailing list archive at Nabble.com.

[Rowland Penny]

On 11/10/13 13:10, Winfried wrote:
> Doesn't work on my host.

On my samba 3.6.3 server

> # cat /etc/samba/smb.conf
> [global]
> workgroup = WORKGROUP
> encrypt passwords = yes
> log level = 2
> guest account = nobody
> security = user
> map to guest = Bad User
>
> [test]
> path = /tmp
> browsable = yes
> read only = yes
> guest ok = yes

AS above

> # pdbedit -L
> nobody:99:nobody

pdbedit -L
nobody:65534:nobody

Note: I never added user 'nobody'

>
> # smbpasswd -x nobody
> Deleted user nobody.

Did not do this

>
> # pdbedit -L
>
> # /etc/rc.d/rc.samba restart

Or the above

> # smbclient -L localhost -U%
> Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.8]
>
> Sharename Type Comment
> --------- ---- -------
> Error returning browse list: NT_STATUS_ACCESS_DENIED
> Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.8]
>
> Server Comment
> --------- -------
>
> Workgroup Master
> --------- -------
smbclient -L localhost -U%

Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.3]

Sharename Type Comment
--------- ---- -------

IPC$ IPC IPC Service (Samba 3.6.3)
test Disk
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.3]

Server Comment
--------- -------
TESTCLIENT Samba 3.6.3

Workgroup Master
--------- -------
WORKGROUP TESTCLIENT

> # tail /var/log/samba/log.smbd
>
> [2013/10/11 14:20:50.229649, 2] smbd/reply.c:553(reply_special)
> netbios connect: name1=LOCALHOST 0x20 name2=SLAX 0x0
> [2013/10/11 14:20:50.231106, 2] smbd/reply.c:573(reply_special)
> netbios connect: local=localhost remote=slax, name type = 0
>

[2013/10/11 13:15:05.159362, 2] smbd/reply.c:553(reply_special)
netbios connect: name1=LOCALHOST 0x20 name2=TESTCLIENT 0x0
[2013/10/11 13:15:05.159504, 2] smbd/reply.c:573(reply_special)
netbios connect: local=localhost remote=testclient, name type = 0

It would seem that you do need the user 'nobody' but it also seems that
samba adds it automatically, what I do find strange is that on your
machine 'nobody' has the uidNumber of 99, whether this makes any
difference, I do not know.

I can only add that this setup works for me.

Rowland

[Winfried]

Changing to "log level = 3" shows this:

> ...
> Transaction 3 of length 132 (0 toread)
> [2013/10/11 14:35:26.670629, 3] smbd/process.c:1467(switch_message)
> switch message SMBtrans (pid 3767) conn 0xb7c0cf78
> [2013/10/11 14:35:26.672412, 3] smbd/service.c:190(set_current_service)
> chdir (/tmp) failed, reason: Permission denied
> [2013/10/11 14:35:26.674207, 3] smbd/error.c:81(error_packet_set)
> error packet at smbd/process.c(1558) cmd=37 (SMBtrans)
> NT_STATUS_ACCESS_DENIED
> ...

Since it's a bit long, I pasted the whole message here:
www.pastebin.com/a80UcTwz

Interestingly, this error shows up even after changing "path" from "/tmp" to
"/plans":
==================
[test]
;path = /tmp
path = /plans
==================

So it appears that smbd 1) tries chdir to /tmp even though no share is
mapped there, and 2) is denied this by Linux, for some reason.



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654879.html

Sent from the Samba - General mailing list archive at Nabble.com.

[Rowland Penny]

Just had another thought, the samba server wouldn't be running selinux
or apparmor would it ?

Rowland

[Rowland Penny]

On 11/10/13 13:58, Winfried wrote:

Did you restart samba after altering smb.conf ?

Try chmod 777 on /plans and try again

Rowland

[Winfried]

After editing smb.conf, I always run "/etc/rc.d/rc.samba restart".

The host isn't running a firewall, and the error message mentions "/tmp"
instead of "/plans", so "chmod 777 /plans" did nothing: "chdir (/tmp)
failed, reason: Permission denied"

I don't know if it means anything, but the host is running Slax off a USB
keydrive. No one has reported the same problem.




--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654891.html

Sent from the Samba - General mailing list archive at Nabble.com.

[Rowland Penny]

On 11/10/13 15:05, Winfried wrote:
> After editing smb.conf, I always run "/etc/rc.d/rc.samba restart".
>
> The host isn't running a firewall, and the error message mentions "/tmp"
> instead of "/plans", so "chmod 777 /plans" did nothing: "chdir (/tmp)
> failed, reason: Permission denied"
>
> I don't know if it means anything, but the host is running Slax off a USB
> keydrive. No one has reported the same problem.
>
>
>
>
> --
> View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4654891.html
> Sent from the Samba - General mailing list archive at Nabble.com.

OK, I setup another VM, but this time with Centos 6.4, added samba and
exactly the same smb.conf etc and tried to connect.
I couldn't even connect, so turned off iptables and tried again, it now
connected but now I got 'Permission denied'

Turned off selinux 'echo 0 > /selinux/enforce'

I could now enter the share and open the test document.

Could this be your problem?

After this I am lost, I can see no other reason why it does not work,
have you thought about Ubuntu server 12.04?

Rowland

[Winfried]

No, but I finally found the issue: I was using an older version of the OS
instead of checking if a new version was available :-/ The latest worked
right away after downloading and activating the Samba module. I should have
checked that, first thing.

Then, all I needed to share files with any user without adding any user
account to Slax (either Unix or Samba) is this smb.conf:

<code>
[global]
workgroup = WORKGROUP

;Not neeeded, but in case you don't like the hostname
netbios name = LINUX

;Important: Otherwise, doesn't switch to Unix "nobody" -> Err 5 Access
denied
security = share

;if you need to investigate : 2 or 3
;log level = 2

[test]
path=/tmp

read only = yes
guest ok = yes

</code>

What I've learned:
1. Use the latest OS
2. In case Samba isn't working as exepcted, use "log level =2" or even "= 3"
to investigate, as it provides more information than what Windows says.

Thanks a lot for your help.



--
View this message in context: http://samba.2283325.n4.nabble.com/3-6-8-XP-fails-with-error-1326-tp4654631p4655055.html

Sent from the Samba - General mailing list archive at Nabble.com.