Mike's questions

Running Debian 12, my ethernet card gets an IP using DHCP, and I want to add a VLAN config to that same interface, VLAN 30, and assign it a static IP. Here's my /etc/network/interfaces:

auto lo
iface lo inet loopback

# The primary network interface
auto enp0s25
allow-hotplug enp0s25
iface enp0s25 inet dhcp

#VLAN
auto enp0s25.30
iface enp0s25.30 inet static
  address 192.168.30.2
  netmask 255.255.255.0
  gateway 192.168.30.1
 vlan-raw-device enp0s25

No amount of restarting NetworkManager or rebooting gets it to activate the enp0s25.30 interface. The NetworkManger log shows only this line relating to the .30 VLAN:

NetworkManager[2239]: <info>  [1718593439.7242] ifupdown: guessed connection type (enp0s25.30) = 802-3-ethernet

Note that my install uses NetworkManager and dhclient to configure interfaces. I don't have ifupdown installed. I don't have anything configured in dhclient.conf because I assumed NetworkManager would notice the 'inet static' and use that.

Also note that I have the following set in my NetworkManager.conf:

[ifupdown]
managed=true

I can get the interface up if I manually run:

ip link add link enp0s25 name enp0s25.30 type vlan id 30
ip addr add 192.168.30.2/24 dev enp0s25.30
ip link set dev enp0s25.30 up

but of course that doesn't persist after a reboot

Any help getting this working would be appreciated.

Note: originally posted on StackExchange. I'm not sure which location is more appropriate, my apologies if the duplication causes issues.

TL;DR: Time Machine cannot create a new backup on my shared drive, but can add to an existing backup.

I'm running macOS Catalina and my Time Machine backs up to a Debian 10 server with NetAtalk and Avahi. Since Mavericks macOS has preferred SMB, and given SMB is marginally faster I decided to switch to using SMB for the Time Machine shares. On a fresh AFP share I can start a new Time Machine backup in System Preferences and it will create a new .sparseimage without complaint.

If I use the exact same directory (/usr/local/smb), so same permissions etc, and create a samba share, when Time Machine attempts to create a new backup it give the error: "Time Machine couldn’t complete the backup to SERVER.local. The backup disk image could not be created."

If I first connect to the share with AFP and do the initial backup, I can then connect with SMB and add subsequent incremental backups without error. I thought maybe a permissions issue, but for debugging purposes I have /usr/local/smb set to 0777 and still get the error.

ls -la showing permissions of the share point:

drwxrwxrwx  5 root smbusers 4096 Apr  3 12:35 smb

I find the following possibly helpful error in the log:

Failed to create '/Volumes/.timemachine/SERVER._smb._tcp.local/DDE06691-7411-41DD-8419-24FEFC21CE29/TimeMachine Set A - SMB/8E394711-7E3F-520B-800C-192D4F680177.sparsebundle', results: {
}, error: 13 Permission denied

afp.conf:

[Global]
; Global server settings
vol preset = default_for_all
log file = /var/log/netatalk.log
uam list = uams_dhx2.so,uams_clrtxt.so
save password = no

[default_for_all]
file perm = 0664
directory perm = 0774
cnid scheme = dbd

[Time Machine Set A - AFP]
path = /usr/local/smb
time machine = yes
vol size limit = 4000000

I'm using some smb.conf options suggested in this GitHub: https://gist.github.com/ChloeTigre/4c2022c0d1a281deedba6f7539a2e3ae

smb.conf:

[global]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of
   workgroup = WORKGROUP
   wins support = yes

#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine
# that connects
   log file = /var/log/samba/log.%m

# Cap the size of the individual log files (in KiB).
   max log size = 1000

# We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.
# Append syslog@1 if you want important messages to be sent to syslog too.
   logging = file

# Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d

###MacOS compatability stuff
guest account = smbguest
min protocol = SMB2
map acl inherit = yes
vfs objects = catia fruit streams_xattr  
fruit:metadata = netatalk
fruit:model = MacSamba
fruit:posix_rename = yes 
fruit:veto_appledouble = yes

durable handles = yes
kernel oplocks = no
kernel share modes =no
posix locking = no
smb2 leases = yes


#Turned off for testing compatability
#fruit:wipe_intentionally_left_blank_rfork = yes 
#fruit:delete_empty_adfiles = yes 

####### Authentication #######

# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller". 
#
# Most people will want "standalone server" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
   server role = standalone server

   obey pam restrictions = yes

# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
   unix password sync = yes

# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<[email protected]> for
# sending the correct chat script for the passwd program in Debian Sarge).
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
   pam password change = yes

# This option controls how unsuccessful authentication attempts are mapped
# to anonymous connections
   map to guest = bad user

######Security#######
security = user
valid users = @smbusers
username map = /etc/samba/users.map
guest ok = no

# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
   usershare allow guests = yes

#======================= Share Definitions =======================

[TimeMachine Set A - SMB]
path = /usr/local/smb
comment = SMB Time Machine Destination Set A
browsable = yes
writeable = yes
create mode = 0664     #tried turning this off, no fix
directory mode = 0777  #tried turning this off, no fix
vfs objects = catia fruit streams_xattr
fruit:aapl = yes
fruit:time machine = yes
#guest ok = yes
fruit:time machine max size = 3.9T  #tried turning this off, no fix
inherit acls = yes

I have two buster servers that get assigned static IPs via DHCP (dhclient). the DHCP server assigns all parameters including domain (mydomain.org). One server works fine, i.e. hostname -f. On this server /etc/resolv.conf is correct:

 # Generated by NetworkManager
    search mydomain.org
    nameserver x.x.x.x

hostname -f on the working server returns the FQDN as it should.

But the other server doesn't get the domain properly. hostname -f simply returns the hostname and /etc/resolv.conf isn't populated as per the DHCP settings:

# Generated by NetworkManager
search lan
nameserver x.x.x.x

If I manually run sudo dhclient -4 -v /etc/resolv.conf gets updated properly with search mydomain.org. However, after a restart or systemctl restart NetworkManager /etc/resolv.conf returns to the incorrect state.

What am I missing here? How do I get networkmanager to properly assign the search domain in /etc/resolv.conf?

My current ufw status is as follows. UFW is set to default deny.

[ 1] SSH                        ALLOW IN    10.1.0.0/16               
[ 2] DNS                        ALLOW IN    10.1.0.0/16               
[ 3] DNS                        ALLOW IN    192.168.0.0/16            
[ 4] 1900,3478,10001/udp        ALLOW IN    10.1.0.0/16                # UniFi UDP ports
[ 5] 6789,8080,8443,8843,8880,27117/tcp ALLOW IN    10.1.0.0/16                # UniFi TCP ports
[ 6] 5353/udp                   ALLOW IN    10.1.0.0/16                # Multicast DNS aka Bonjour

So incoming TCP packets to port 8080 from the 10.1.0.0/16 block should all be allowed, but in my ufw.log I see constant repeats of the following:

Mar 10 18:28:48 pi-hole kernel: [97820.380848] [UFW BLOCK] IN=eth0 OUT= MAC=b8:27:eb:ef:23:6a:b4:fb:e4:28:d2:48:08:00:45:00:00:34:52:72:40:00:40:06:d1:51 SRC=10.1.1.1 DST=10.1.1.254 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=21106 DF PROTO=TCP SPT=36656 DPT=8080 WINDOW=245 RES=0x00 ACK FIN URGP=0 
Mar 10 18:29:10 pi-hole kernel: [97841.880829] [UFW BLOCK] IN=eth0 OUT= MAC=b8:27:eb:ef:23:6a:b4:fb:e4:28:d2:48:08:00:45:00:00:34:55:42:40:00:40:06:ce:81 SRC=10.1.1.1 DST=10.1.1.254 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=21826 DF PROTO=TCP SPT=36657 DPT=8080 WINDOW=245 RES=0x00 ACK FIN URGP=0 
Mar 10 18:29:31 pi-hole kernel: [97863.530929] [UFW BLOCK] IN=eth0 OUT= MAC=b8:27:eb:ef:23:6a:b4:fb:e4:28:d2:48:08:00:45:00:00:34:87:7d:40:00:40:06:9c:46 SRC=10.1.1.1 DST=10.1.1.254 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=34685 DF PROTO=TCP SPT=36658 DPT=8080 WINDOW=245 RES=0x00 ACK FIN URGP=0 

implying it is blocking incoming TCP packets from 10.1.1.1 going to port 8080.

I tried running ufw reload to no avail. I have also tried allowing 8080 from any IP address, same problem.

I have even completely removed UFW using apt purge ufw and reinstalled and rebuilt my rules, but still get the same issue.

Any ideas?