2

I have a Synology NAS that uses Samba 3.6.9. I also have a Windows Domain Controller (Server 2012 R2) that I'm using Windows Server Backup on to backup the System State to the Synology NAS. When using SMB1, I have no issues, however, when using SMB2, I run into the following:

smbd/service.c:636: [2014/01/04 14:56:11.044645, all 2, pid=20301] create_connection_session_info
user 'NAUPLIUS\dc01$' (from session setup) not permitted to access this share (Backup)
smbd/service.c:847: [2014/01/04 14:56:11.045532, all 1, pid=20301] make_connection_snum
create_connection_session_info failed: NT_STATUS_ACCESS_DENIED
smbd/service.c:1453: [2014/01/04 14:56:20.283879, all 1, pid=20301] close_cnum
DC01 (10.10.20.8) closed connection to service Backup
smbd/connection.c:35: [2014/01/04 14:56:20.284802, all 3, pid=20301] yield_connection
Yielding connection to Backup
smbd/smb2_server.c:3120: [2014/01/04 14:56:20.289760, all 2, pid=20301] smbd_smb2_request_incoming
smbd_smb2_request_incoming: client read error NT_STATUS_CONNECTION_RESET
smbd/server_exit.c:181: [2014/01/04 14:56:20.293909, all 3, pid=20301] exit_server_common
Server exit (NT_STATUS_CONNECTION_RESET)

As you can see, Windows Server Backup in this case is attempting to access the share with the Computer Account. Now, if this was a Windows Server, Computer accounts can be added to a Windows Share just as easily as a User account. From what I gather, that is not the case with Samba. Can someone correct me if I'm wrong, is it possible to add a Domain Computer account to the Samba Share permissions?

One thing to note is I did add "NAUPLIUS\Domain Controllers" (which DC01 is a member of), but that does not appear to have resolved the issue. The NT_STATUS_ACCESS_DENIED errors continue.

Improve this question
  • Can you explain what SMB1 and SMB2 are? – slm♦ Jan 4 '14 at 23:46
  • samba.org/samba/docs/man/Samba-HOWTO-Collection/… – slm♦ Jan 4 '14 at 23:53
  • Note this has nothing to do with adding a machine to a Samba domain, so that link is a bit irrelevant. The Synology NAS is a domain member of Active Directory. SMB1 is the original SMB protocol, SMB2 is an update that was released with Vista/Server 2008, and Samba followed on with support at a later date. en.wikipedia.org/wiki/Server_Message_Block#SMB_2_and_3 – Trevor Seward Jan 4 '14 at 23:56
  • Your comment: "Can someone correct me if I'm wrong, is it possible to add a Domain Computer account to the Samba Share permissions" would seem to make that link very relevant. – slm♦ Jan 5 '14 at 0:20
  • I don't see how it is relevant. It doesn't speak to adding Computer Accounts to a Samba share. Just joining computer accounts to a domain, something I do not need to do. – Trevor Seward Jan 5 '14 at 0:23
0

As of DSM 6.2, this is still not implemented directly. However, you can workaround this by browsing to the server in Windows Explorer, right click on the share, and set permissions using the security tab. When you add a computer account to the list, it seems to work the same as adding it from the DSM interface, in that the permission tends to propagate throughout the share. This is in contrast to Windows, where a true share-level permission does not propagate to the NTFS structure.

Improve this answer
  • Both «NTFS» and share permission are possible, what you describe would set ACL bits on the filesystem and not the share permission, that are by default read/write to everyone, meaning only filesystem ACLs are used. – Zulgrib Nov 28 '20 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.