I have been asked to check the mount a windows share on a CentOs7 box, before it was working and now not working anymore (no clue from the customer on what could be changed)
Local mount point /backup Windows share //xx.xx.xx.xx/000_BCK
I can ping the Windows machine with no problem
The local mount point exists
ls /backup
Prod Test
I can see the share via smbclient, even if there is an error at the end
smbclient -L xx.xx.xx.xx -U backup -m SMB2
Enter SAMBA\backup's password:
Sharename Type Comment
--------- ---- -------
000_BCK Disk
ADMIN$ Disk Amministrazione remota
B$ Disk Condivisione predefinita
C$ Disk Condivisione predefinita
IPC$ IPC IPC remoto
VBRCatalog Disk
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to xx.xx.xx.xx failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
Running the same command with the -d3 switch
smbclient -L xx.xx.0.39 -U backup -m SMB3 -d3
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[global]"
added interface ens160 ip=xx.xx.xx.xx bcast=xx.xx.3.255 netmask=255.255.252.0
added interface docker0 ip=xx.xy.0.1 bcast=xx.xy.255.255 netmask=255.255.0.0
added interface docker_gwbridge ip=xx.xz.0.1 bcast=xx.xz.255.255 netmask=255.255.0.0
Client started (version 4.10.16).
Connecting to xx.xx.0.39 at port 445
Enter SAMBA\backup's password:
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
Cannot do GSE to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898215
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088215
Sharename Type Comment
--------- ---- -------
000_BCK Disk
ADMIN$ Disk Amministrazione remota
B$ Disk Condivisione predefinita
C$ Disk Condivisione predefinita
I$ Disk Condivisione predefinita
IPC$ IPC IPC remoto
VBRCatalog Disk
Reconnecting with SMB1 for workgroup listing.
Connecting to xx.xx.0.39 at port 139
Connecting to xx.xx.0.39 at port 139
do_connect: Connection to xx.xx.0.39 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
fstab is configured as follows
cat /etc/fstab
#
# /etc/fstab
# Created by anaconda on Thu Jul 26 12:32:02 2018
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
//xx.xx.xx.xx/000_BCK /backup cifs uid=1000,credentials=/var/.smb39,iocharset=utf8,noperm,vers=1.0 0 0
I verified the credential file and it contains the correct credentials (those I used with smbclient)
if I run sudo mount -a I get "Host is down" as message
sudo mount -a
mount error(112): Host is down
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
Commenting that line in fstab, mount -a works fine so that's the "offending" line
After some more search, I tried to use smb 2 and now the error is different
I changed fstab to
//xx.xx.xx.xx/000_BCK /backup cifs uid=1000,credentials=/var/.smb39,iocharset=utf8,noperm,vers=2.0 0 0
And now the error is
mount error(13): Permission denied
and in dmsg I see
[2227599.842439] Status code returned 0xc000006d STATUS_LOGON_FAILURE
[2227599.842455] CIFS VFS: Send error in SessSetup = -13
[2227599.842993] CIFS VFS: cifs_mount failed w/return code = -13
...but (beginning of the post) with smbclient those credentials seems working fine
this is the content of /var/.smb39
user=backup
password=yyyyyyyyyyyyyyyy
I tried changing user to username but the result seems the same
There is no domain/workgroup specified in the credential file. Could it be the problem?
Is there anything I should ask the customer to check on windows side?
Edit: I tried the following
the rights on the folders seem ok
ls -l /backup totale 8 drwxr-xr-x 3 root root 4096 20 apr 21.30 Prod drwxr-xr-x 3 root root 4096 20 apr 21.45 Test
Someone suggested me to check selinux permissions. Selinux looks disabled on the machine, so it should not interfere with my work
getenforce Disabled
cat /etc/selinux/config
SELINUX=disabled SELINUXTYPE=minimum
Thanks for any hint to shed some light on this subject
VindalooMan