ads' corner

Our laptops all have a semi-public Samba share configured which allows us to share files with each other. After upgrading the laptops from Ubuntu to Manjaro, this suddenly stopped working. It was no longer possible to connect to the share as anonymous user.

Both Ubuntu and Manjaro run the same Samba version:

1
2
3

Manjaro:
# smbd --version
Version 4.20.2

1
2
3

Debian:
# smbd --version
Version 4.20.2

Not only is it no longer possible to connect from the other laptops, it’s also no longer possible to connect from Android devices.

Must be something with the configuration.

Debugging the issue

As a first step I enabled logging in /etc/samba/smb.conf and deployed the changes:

1

log level = 5

That turned out to be quite noisy, and the first error I found threw me into the wrong direction:

1
2
3
4
5
6
7

[2024/07/29 21:34:35.672375,  3] ../../source3/smbd/smb2_negprot.c:1156(smb2_multi_protocol_reply_negprot)
  Requested protocol [NT LM 0.12]
[2024/07/29 21:34:35.672497,  3] ../../source3/smbd/smb2_negprot.c:1203(smb2_multi_protocol_reply_negprot)
  smb2_multi_protocol_reply_negprot: No protocol supported !
[2024/07/29 21:34:35.672927,  3] ../../source3/smbd/server_exit.c:229(exit_server_common)
  Server exit (no protocol supported
  )

Why is there no supported protocol? By now all systems here use SMB v3, and certainly the Android devices which were working before haven’t changed at all.

What else is in the logfile?

1
2
3
4
5
6
7
8
9

[2024/07/29 21:34:35.616306,  2] ../../source3/auth/auth.c:353(auth_check_ntlm_password)
  check_ntlm_password:  Authentication for user [guest] -> [guest] FAILED with error NT_STATUS_NO_SUCH_USER, authoritative=1
[2024/07/29 21:34:35.616344,  2] ../../auth/auth_log.c:858(log_authentication_event_human_readable)
  Auth: [SMB2,(null)] user []\[guest] at [Mo, 29 Jul 2024 21:34:35.616324 CEST] with [NTLMv2] status [NT_STATUS_NO_SUCH_USER] workstation [] remote host [ipv4:192.168.0.57:54774] mapped to []\[guest]. local host [ipv4:192.168.0.20:445]
  {"timestamp": "2024-07-29T21:34:35.616387+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 3}, "eventId": 4625, "logonId": "0", "logonType": 3, "status": "NT_STATUS_NO_SUCH_USER", "localAddress": "ipv4:192.168.0.20:445", "remoteAddress": "ipv4:192.168.0.57:54774", "serviceDescription": "SMB2", "authDescription": null, "clientDomain": "", "clientAccount": "guest", "workstation": "", "becameAccount": null, "becameDomain": null, "becameSid": null, "mappedAccount": "guest", "mappedDomain": "", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "NTLMv2", "clientPolicyAccessCheck": null, "serverPolicyAccessCheck": null, "duration": 8401}}
[2024/07/29 21:34:35.616484,  3] ../../auth/gensec/spnego.c:1443(gensec_spnego_server_negTokenTarg_step)
  gensec_spnego_server_negTokenTarg_step: SPNEGO(ntlmssp) login failed: NT_STATUS_NO_SUCH_USER
[2024/07/29 21:34:35.616529,  3] ../../source3/smbd/smb2_server.c:4036(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_LOGON_FAILURE] || at ../../source3/smbd/smb2_sesssetup.c:147

Why is this logging NT_STATUS_NO_SUCH_USER? I want to use the anonymous guest user, not an existing user account on the system. This anonymous account doesn’t need authentication.

The configuration file for Samba is the same on Ubuntu and Manjaro, rolled out using the same Ansible role. But maybe it’s something in the default values. Let’s get a full configuration dump:

1

testparm -s -v /etc/samba/smb.conf > /tmp/smb-config.txt 2>&1

The -v option for testparm will output all the default values in addition of the values set in smb.conf. This allows me to compare the config from an Ubuntu and a Manjaro system:

1

diff -ruN /tmp/smb-config-ubuntu.txt /tmp/smb-config-manjaro.txt

And I found (among some other minor details) the following change:

1
2
3
4
5
6
7
8
9

@@ -177,7 +179,7 @@
        machine password timeout = 604800
        mangle prefix = 1
        mangling method = hash2
-       map to guest = Bad User
+       map to guest = Never
        max disk size = 0
        max log size = 1000
        max mux = 50

Seems relevant. What is this setting?

smb.conf Documentation

The smb.conf documentation is helpful:

This parameter can take four different values, which tell smbd(8) what to do with user login requests that don’t match a valid UNIX user in some way.

The four settings are:

• Never - Means user login requests with an invalid password are rejected. This is the default.
• Bad User - Means user logins with an invalid password are rejected, unless the username does not exist, in which case it is treated as a guest login and mapped into the guest account.
• Bad Password - Means user logins with an invalid password are treated as a guest login and mapped into the guest account. Note that this can cause problems as it means that any user incorrectly typing their password will be silently logged on as “guest” - and will not know the reason they cannot access files they think they should - there will have been no message given to them that they got their password wrong. Helpdesk services will hate you if you set the map to guest parameter this way :-).
• Bad Uid - Is only applicable when Samba is configured in some type of domain mode security (security = {domain|ads}) and means that user logins which are successfully authenticated but which have no valid Unix user account (and smbd is unable to create one) should be mapped to the defined guest account. This was the default behavior of Samba 2.x releases. Note that if a member server is running winbindd, this option should never be required because the nss_winbind library will export the Windows domain users and groups to the underlying OS via the Name Service Switch interface.

Note that this parameter is needed to set up “Guest” share services. This is because in these modes the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client so the server cannot make authentication decisions at the correct time (connection to the share) for “Guest” shares.

Default: map to guest = Never

Example: map to guest = Bad User

Default value changes in Ubuntu and Debian

It turns out that this is a deviation in Debian. Ubuntu changed this default value first, in order to ease creating public shares. Debian then later adopted it, despite critical voices warning against changing defaults.

Fixing the issue

This deviation from the default is not adapted by other distributions. Which means that the template in my samba role needs an additiona line:

1

map to guest = Bad User

After deploying the new config and restarting the service, everything is working now.

Summary

Ubuntu and Debian introduced a changed default value in smb.conf, seemingly in order to ease creation of public shares. Given that shares require additional configuration anyway, updating the documentation and the examples should have been the way to go.

I was bit by this, because I first used Ubuntu and tried deploying the same configfile to a laptop with a different distribution.

It also adds another point to my list why I’m no longer using Ubuntu.

Header image

Image by Leonid Altman from Pixabay, modifications by me.