fostandy's questions

Edit: IT WAS F#$CKING SELINUX. echo 0 >/selinux/enforce and it works.

Edit: Based on the fact I can't view files in the directory even when they are recursively set to ugo+rwx (see edits at bottom of this post), I suspect the problem is more fundamental than the mounted share.

I have the following share setup in my samba configuration:

[test]
path = /mnt/
guest ok = yes
writeable = yes
browseable = yes

The /mnt folder has permissions as follows:

[root@[host-redacted] mnt]# ls -al /mnt
total 16
drwxr-xr-x.  4 root root 4096 Mar  3 00:54 .
dr-xr-xr-x. 25 root root 4096 Feb 25 19:04 ..
drwxr-xr-x.  2 root root 4096 Feb 26 21:45 files
drwxr-xr-x.  2 root root 4096 Mar  3 00:54 tmp

At this point, nothing is mounted to these folders. When I try to access this via samba it works fine:

[root@[host-redacted] mnt]# smbclient -Uguest //[host-redacted]/test
Enter guest's password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.5.10-125.el6]
smb: \> ls
  .                                   D        0  Sun Mar  3 00:54:52 2013
  ..                                 DR        0  Mon Feb 25 19:04:02 2013
  tmp                                 D        0  Sun Mar  3 00:54:52 2013
  files                               D        0  Tue Feb 26 21:45:55 2013

                50396 blocks of size 1048576. 46487 blocks available
smb: \> cd files
smb: \files\> ls
  .                                   D        0  Tue Feb 26 21:45:55 2013
  ..                                  D        0  Sun Mar  3 00:54:52 2013

                50396 blocks of size 1048576. 46487 blocks available

However after I mount an encrypted share to that drive things to awry. I mount it and check permissions and ownership are identical:

[root@[host-redacted] mnt]# mount /dev/mapper/[encrypted-partition-redacted] files

[root@[host-redacted] mnt]# ls -al /mnt/
total 16
drwxr-xr-x.  4 root root 4096 Mar  3 00:54 .
dr-xr-xr-x. 25 root root 4096 Feb 25 19:04 ..
drwxr-xr-x. 13 root root 4096 Jul  6  2012 files
drwxr-xr-x.  2 root root 4096 Mar  3 00:54 tmp

But now when I access the share, the files directory has disappeared:

[root@[host-redacted] ~]# smbclient -Uguest //[host-redacted]/test
Enter guest's password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.5.10-125.el6]
smb: \> ls
  .                                   D        0  Sun Mar  3 00:54:52 2013
  ..                                 DR        0  Mon Feb 25 19:04:02 2013
  tmp                                 D        0  Sun Mar  3 00:54:52 2013

                50396 blocks of size 1048576. 46487 blocks available

I did a quick check to make sure my guest user (nobody) can read /mnt and it seems okay:

[root@[host-redacted] mnt]# sudo -u nobody ls /mnt
files  tmp

Can someone explain what is going on? My samba configuration was copied from a previous machine running samba 3.3 in much the same setup, and this new setup is running the same configuration (files copied) but with samba 3.5.10-125.el6.

I've also checked the changelog and can't see anything that stands out.

edit: I do not have any veto files directive in my smb.conf:

[root@pmfs mnt]# grep -i veto /etc/samba/smb.conf

edit2: When the directory is not mounted I am able to cd into files - HOWEVER I am not able to see a file I created there

[root@pmfs samba]# echo asdf > /mnt/files/test.txt

[root@pmfs files]# chmod -R ugo+rwx /mnt/files/

[root@pmfs ~]# smbclient -Uguest //pmfs/test
Enter guest's password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.5.10-125.el6]
smb: \> ls
  .                                   D        0  Sun Mar  3 00:54:52 2013
  ..                                 DR        0  Mon Feb 25 19:04:02 2013
  tmp                                 D        0  Sun Mar  3 00:54:52 2013
  files                               D        0  Mon Mar  4 20:05:45 2013

                50396 blocks of size 1048576. 46486 blocks available
smb: \> cd files
smb: \files\> ls
  .                                   D        0  Mon Mar  4 20:05:45 2013
  ..                                  D        0  Sun Mar  3 00:54:52 2013

                50396 blocks of size 1048576. 46486 blocks available

As well as a solution to this specific problem I'd be interested in knowing if there is anything else I should be doing to troubleshoot this problem - as I have often struggled with configuring samba I'm always interested in learning how to better improve the troubleshooting process

I have several shares residing on a samba server in a small business environment that I would like to provide search facilities for. Ideally this would be something like google desktop with some extra features (see below), but lacking this the idea is to take what I can get, or at least get an idea for what is out there.

Using google desktop search as a reference model, the principle additional requirement is that it is usable from clients over the network. In addition there are some other notes (note that none of these are hard requirements)

• The content is always files, residing on a single server, accessible from samba shares.
  • Standard ms office document fare
  • Also a lot of rars and zips which it is necessary to search inside.
• Permissions support, allowing for user-based control to reflect current permission access in samba shares.
  • The userbase will remain fairly static, so manual management of users is fine.
• majority of users will be Windows based

I know there are plenty of search indexers out there: beagle and tracker seem to be the most popular. Most do not seem to offer access control and web-based/remote search does not seem to be high priority. I've also seen a recent post on the samba mailing list asking for pretty much the exact same thing. (They mention a product called IBM OmniFind Yahoo! Edition and while their initial reception seems positive, I am pretty skeptical. RHEL 4? Firefox 2? Updated much?)

edit: similar question here

What else is out there? Are you in a similar situation? What do you use?

I'm trying to openvpn into an office network (192.168.1.0/24) from a client sitting on a network with the same subnet (also 192.168.1.0/24). It is a linux (ubuntu 9.10) server and windows client.

I followed this ubuntu openvpn community documentation guide and from what I can tell the base connection works fine. Of course I get a bunch of error/warnings about ip address collisions.

I was then trying to follow this guide on 'Dirty NAT tricks to get a VPN to work with clients also numbered in the private address space' but have not been successful. While I have a theoretical understanding of routing/masquerading I have relatively little practical experience and am unsure what is wrong.

Thus far, I have gotten to the point where the client connects to the server and is assigned an IP 10.22.8.10. However I am unable to ping the server ip 10.22.8.1 like the documentation suggests I should be able to.

The server config is basically identical to guide 1 with the modifications from guide 2, i.e. setting the 'server-bridge 10.22.8.1 255.255.255.0 10.22.8.10 10.22.8.120' and 'push "route 10.22.0.0 255.255.0.0 10.22.8.1"'. In addition I add the tap interface configuration commands to up.sh.

The client config remains the same as guide 1.

Server 'ifconfig tap0' (edit: sorry if this looks screwy. In the preview pane of editing this post it looks fine)

tap0 Link encap:Ethernet HWaddr ee:ee:a8:04:8a:fc inet addr:10.22.8.1 Bcast:0.0.0.0 Mask:255.255.255.0 inet6 addr: fe80::ecee:a8ff:fe04:8afc/64 Scope:Link UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:610 errors:0 dropped:0 overruns:0 frame:0 TX packets:4533 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:111341 (111.3 KB) TX bytes:650830 (650.8 KB)

The client log on connection:

  Mon Mar 01 00:30:13 2010 OpenVPN 2.1.1 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Dec 11 2009  
    Mon Mar 01 00:30:13 2010 WARNING: No server certificate verification method has been enabled.  See URL-REDACTED for more info.
    Mon Mar 01 00:30:13 2010 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
    Mon Mar 01 00:30:13 2010 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
    Mon Mar 01 00:30:13 2010 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
    Mon Mar 01 00:30:13 2010 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
    Mon Mar 01 00:30:13 2010 LZO compression initialized
    Mon Mar 01 00:30:13 2010 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
    Mon Mar 01 00:30:13 2010 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
    Mon Mar 01 00:30:13 2010 Local Options hash (VER=V4): '13a273ba'
    Mon Mar 01 00:30:13 2010 Expected Remote Options hash (VER=V4): '360696c5'
    Mon Mar 01 00:30:13 2010 Socket Buffers: R=[8192->8192] S=[8192->8192]
    Mon Mar 01 00:30:13 2010 UDPv4 link local: [undef]
    Mon Mar 01 00:30:13 2010 UDPv4 link remote: REDACTED:1194
    Mon Mar 01 00:30:13 2010 TLS: Initial packet from REDACTED:1194, sid=11055cf2 cc0d1ea0
    Mon Mar 01 00:30:14 2010 VERIFY OK: depth=1, REDACTED
    Mon Mar 01 00:30:14 2010 VERIFY OK: depth=0, REDACTED
    Mon Mar 01 00:30:14 2010 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
    Mon Mar 01 00:30:14 2010 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
    Mon Mar 01 00:30:14 2010 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
    Mon Mar 01 00:30:14 2010 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
    Mon Mar 01 00:30:14 2010 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
    Mon Mar 01 00:30:14 2010 [server] Peer Connection Initiated with REDACTED:1194
    Mon Mar 01 00:30:17 2010 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
    Mon Mar 01 00:30:17 2010 PUSH: Received control message: 'PUSH_REPLY,route 10.22.0.0 255.255.0.0 10.22.8.1,route-gateway 10.22.8.1,ping 10,ping-restart 120,ifconfig 10.22.8.10 255.255.255.0'
    Mon Mar 01 00:30:17 2010 OPTIONS IMPORT: timers and/or timeouts modified
    Mon Mar 01 00:30:17 2010 OPTIONS IMPORT: --ifconfig/up options modified
    Mon Mar 01 00:30:17 2010 OPTIONS IMPORT: route options modified
    Mon Mar 01 00:30:17 2010 OPTIONS IMPORT: route-related options modified
    Mon Mar 01 00:30:17 2010 ROUTE default_gateway=192.168.1.254
    Mon Mar 01 00:30:17 2010 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{7464875E-98E9-46AF-8F86-69FF32FFB722}.tap
    Mon Mar 01 00:30:17 2010 TAP-Win32 Driver Version 9.6 
    Mon Mar 01 00:30:17 2010 TAP-Win32 MTU=1500
    Mon Mar 01 00:30:17 2010 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.22.8.10/255.255.255.0 on interface {7464875E-98E9-46AF-8F86-69FF32FFB722} [DHCP-serv: 10.22.8.0, lease-time: 31536000]
    Mon Mar 01 00:30:17 2010 Successful ARP Flush on interface [33] {7464875E-98E9-46AF-8F86-69FF32FFB722}
    Mon Mar 01 00:30:22 2010 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
    Mon Mar 01 00:30:22 2010 C:\WINDOWS\system32\route.exe ADD 10.22.0.0 MASK 255.255.0.0 10.22.8.1
    Mon Mar 01 00:30:22 2010 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
    Mon Mar 01 00:30:22 2010 Route addition via IPAPI succeeded [adaptive]
    Mon Mar 01 00:30:22 2010 Initialization Sequence Completed
    Mon Mar 01 01:30:14 2010 TLS: soft reset sec=0 bytes=648728/0 pkts=3922/0
    Mon Mar 01 01:30:14 2010 VERIFY OK: depth=1, REDACTED
    Mon Mar 01 01:30:14 2010 VERIFY OK: depth=0, REDACTED
    Mon Mar 01 01:30:15 2010 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
    Mon Mar 01 01:30:15 2010 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
    Mon Mar 01 01:30:15 2010 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
    Mon Mar 01 01:30:15 2010 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
    Mon Mar 01 01:30:15 2010 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA

The client route seems to be pushed ok (route print):

  Active Routes:
    Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.1.254     192.168.1.23     25
        10.22.0.0      255.255.0.0        10.22.8.1       10.22.8.10     30
        10.22.8.0    255.255.255.0         On-link        10.22.8.10    286
       10.22.8.10  255.255.255.255         On-link        10.22.8.10    286
      10.22.8.255  255.255.255.255         On-link        10.22.8.10    286
    ...

However when I try to get to 10.22.8.1 it still seems to want to hop out of my local internet connection:

  C:\Windows\system32>tracert 10.22.8.1
    Tracing route to 10.22.8.1 over a maximum of 30 hops
      1     1 ms     1 ms     1 ms  home.gateway [192.168.1.254]
      2  nexthop.qld.iinet.net.au [203.55.228.88]  reports: Destination net unreachable.

Can anybody advise me as to what I'm doing wrong (or alternatively, if there is an easy, more tenable way of doing what I want - note that as per solution #1 in guide 2, renaming either subnet is not possible)