0

Suppose the following setup:

  • VPN: VPN server (docker + openVPN)
  • FS: File storage (cifs share)
  • Application, Load Balancer, Database, ...

Both servers are root access ubuntu server virtual machines hosted in some third party company.

When the php7 app writes to CIFS share, I get Permission denied error. All files on share (as checked and set on APP server) are chmod 777 and chown www-data which is the php-fpm user. When i open the website via VPN, there is no such error, all changes are OK.

I was able to narrow the error down to the file system layer. The CIFS share is not accessible from other servers when not connected via VPN.

I'm guessing this has something to do with the iptables config. Though I ran iptables -F to disable the firewall, no help. I might have misconfigured the nginx to pass along the User's IP onto the CIFS.

Config:

FS:

root@filestore:~# iptables -L -n

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

/etc/samba/smb.conf

#======================= Share Definitions =======================
[static-fs]
path = /home/storage/
browsable = yes
guest ok = no
writeable = yes
create mask = 0777
valid users = storage
write list = storage

Client:

root@ubuntuVM:~# smbclient -L \\filestore -U storage
Connection to filestore  failed (Error NT_STATUS_IO_TIMEOUT)
root@ubuntuVM:~# ping filestore 
PING filestore (1.2.3.4) 56(84) bytes of data.
64 bytes from xxx.ip-1.2.3.4.eu (1.2.3.4): icmp_seq=1 ttl=52 time=24.2 ms
...

It's not a DNS problems, the domains are valid and I have the same problems using IPs.

  • I tried to echo hello | telnet filestore but that's also timing out (again, unless I connect through the VPN) – Asmodiel Jun 23 '17 at 20:12
  • It seems that accessing the website through mobile internet (3G, LTE etc.) also doesn't throw the error. – Asmodiel Jun 23 '17 at 21:16
0

I just got an answer from my hosting company (OVH). It turns out, CIFS and NFS are blocked outside their network. They are suggesting the usage of SSHFS, we solved the problem with FTP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.