0

I've successfully shared Windows share over VPN (PPTP), mounted it with mount.cifs on my Ubuntu machine and I'm able to browse the shared contents from the Ubuntu.

However, sometimes, when the network traffic between the two machines gets huge (rsync, cifs Windows-> Ubuntu, samba share Ubuntu -> Windows; all over PPTP), PPTP seems to crash and reconnect (since option 'persist' is enabled). Now, the cifs share 'hangs' - I'm no longer able to list it's content, nor unmount it and need to reboot the ubuntu.

Is there any solution to this issue? Should I change something within the VPN connection itself, modify cifs settings or use different protocols?

VPN server is my home router (TomatoUSB). Windows machine is connected to the router physically, ip: 192.168.1.102.

Ubuntu machine is an Amazon EC2 instance. It's connected to my home network via VPN (PPTP) tunnel and gets ip: 192.168.1.202.

VPN connections details (in /etc/ppp/peers/ on Ubuntu):

remotename <vpn-name>
linkname <vpn-name>
pty "pptp <my-ip> --nolaunchpppd "
ipparam <vpn-name>
name <username>
usepeerdns
require-mppe
refuse-eap
noauth
persist

Ubuntu shares it's content using samba:

[smb-share]
path = /home/user1
available = yes
valid users = user1-smb
read only = yes
browsable = yes
public = no
writable = no

Ubuntu mounts windows share with mount.cifs (the following lines are added to ip-up.local to mount each time the VPN connection is estabilished):

umount -l /mnt/cifs/win-share    
mount.cifs //192.168.1.102/win-share /mnt/cifs/win-share -o credentials=/home/user1/.credentials/cifs,ro,iocharset=utf8

VPN disconnects sometimes when I'm simultaneously:

  • accessing the ubuntu shares from windows
  • rsync windows shares toubuntu (command is executed from windows, within a putty terminal):

    sudo rsync -avP /mnt/cifs/win-share /home/user1/win-copy &

0

Client session timeout It is the most common exchange timeout. This is defined in [MS-CIFS] as a system-wide parameter Client.SessionTimeoutValue. This value can be configured through the SessTimeout registry key [KB102067].

\HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\
Value type: Dword
Value name: SessTimeout
Default:    45 seconds (Windows NT)
Default:    60 seconds (Windows 2000)

Extended session timeout This optional timeout may be useful in high latency networks. It applies to a timed exchange with a server listed in ServersWithExtendedSessTimeout.

\HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\
Value type: Dword
Value name: ExtendedSessTimeout
Default:    1000 (seconds)
Value type: Multi-string
Value name: ServersWithExtendedSessTimeout
Default:    <null>
These were introduced in Windows XP.

Idle Connection Timer

This is the amount of time that a connection can be idle before being disconnected. An idle connection is defined as a connection which has no existing open handles (no open files, directories, search contexts, etc.), and no pending operation. The Idle Connection Timer is implementation-specific. When the server receives a message, Server.Connection.IdleTime is set to the current time plus Server.AutoDisconnectTimeout [MS-CIFS]. On Windows servers it can be configured through the Autodisconnect registry key [KB297684].

\HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\
Value type: Dword
Value name: Autodisconnect
Default:    15 (minutes)

The Autodisconnect can also be configured through group policy: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options "Microsoft network server: Amount of idle time required before suspending session"

In older Windows clients (e.g. Windows 2000, Windows 2003), the client closes an idle connection based on the KeepConn workstation parameter [KB819108].

HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\parameters\
Value type: Dword
Value name: KeepConn
Default:    600 (seconds)

KeepConn is no longer used, except in Installable File System Kit (IFSKIT).

Session expiration and dynamic re-authentication In Windows implementation, SMB session expiration is enforced based upon the client’s support of dynamic re-authentication capability [MS-SMB]. If the client enables the CAP_DYNAMIC_REAUTH capability bit, the server will enforce session expiration. If a client does not set CAP_DYNAMIC_REAUTH, the Windows server does not return STATUS_NETWORK_SESSION_EXPIRED.
The SMB dynamic re-authentication feature was introduced in Windows XP. From there, Windows-based clients set the CAP_DYNAMIC_REAUTH capability bit to indicate to the server that the client supports re-authentication when the Kerberos service ticket for the session expires. Windows servers do check CAP_DYNAMIC_REAUTH: • If clientCapabilities sets CAP_DYNAMIC_REAUTH, the server will set Server.Session.AuthenticationExpirationTime to the expiry time returned by AcceptSecuirtyContext. • If clientCapabilities does not set CAP_DYNAMIC_REAUTH, the server will not set Server.Session.AuthenticationExpirationTime, basically a CAP_DYNAMIC_REAUTH capability bit not set by the client means the session will not expire on the server side.

References:

[MS-CIFS]: Common Internet File System (CIFS) Protocol

http://msdn.microsoft.com/en-us/library/ee442092.aspx

[MS-SMB]: Server Message Block (SMB) Protocol

http://msdn.microsoft.com/en-us/library/cc246231.aspx

[MS-WKST]: Workstation Service Remote Protocol

http://msdn.microsoft.com/en-us/library/cc250262.aspx

When the Kerberos ticket expires for a Kerberos-authenticated SMB connection that is created to a Windows Server 2003-based server, the oplock on a file cannot be broken in a timely manner

http://support.microsoft.com/kb/943459

LanmanWorkstation Parameters: SessTimeout

http://technet.microsoft.com/en-us/library/cc938292.aspx

LanmanServer Parameters: MaxKeepSearch

http://technet.microsoft.com/en-us/library/cc957456.aspx

Remote Storage and Windows 2000

http://technet.microsoft.com/en-us/library/cc938445.aspx

How to Troubleshoot Event ID 2009 Errors

http://support.microsoft.com/kb/165815

“Microsoft network server: Disconnect clients when logon hours expire”

http://technet.microsoft.com/en-us/library/cc758192.aspx

HOW TO: Limit User Logon Time in a Domain in Windows Server 2003

http://support.microsoft.com/kb/816666

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.