Can access Samba shares but cannot list shares

Question

I have Samba configured with a couple of shares (still testing) and from a Windows machine I can access the shares if I write the whole path (e.g. \testserver\publicshare) but if I access \testserver\ I get a permissions error and I can't see all the shares in that samba server.

What's wrong?

This is my config file:

# Samba configuration -- Managed by Ansible, please don't edit manually
# vim: ft=samba
#
# Ansible managed

[global]
  # Server information
  netbios name = testserver
  workgroup = WORKGROUP
  server string = Fileserver %m

  fruit:aapl = yes

  # Logging
  logging = syslog

  # Authentication
  security = user
  passdb backend = tdbsam
  map to guest = Never
  guest account = server

  # Name resolution: make sure \\NETBIOS_NAME\ works
  wins support = yes
  local master = yes
  domain master = yes
  preferred master = yes

  # Don't load printers
  load printers = no
  printing = bsd
  printcap name = /dev/null
  disable spoolss = yes

  # Fix for CVE-2017-7494 in Samba versions from 3.5.0 and before 4.6.4
  # https://access.redhat.com/security/cve/cve-2017-7494
  nt pipe support = no


## Make home directories accessible
[homes]
  comment = Home Directories
  browseable = no
  writable = yes


## Shared directories
[publicshare]
  comment = Public share, writeable by all members of group ‘users’
  path = /home/server/samba/shares/public
  public = yes
  write list = +users
  force group = users
  browseable = yes
  create mode = 0664
  force create mode = 0664
  directory mode = 0775
  force directory mode = 0775

[TimeMachine]
  comment = Share useable as a TimeMachine backup target on MacOS
  vfs objects = fruit streams_xattr 
  fruit:time machine = yes
  path = /home/server/samba/shares/tm
  public = no
  write list = server
  force group = server
  guest ok = no
  browseable = no
  create mode = 0664
  force create mode = 0664
  directory mode = 0775
  force directory mode = 0775

I am actually using Ansible to deploy Samba. Here's my yaml file:

---

# samba.yml

- name: Samba
  hosts: localhost
  connection: local
  become: true

  roles:
    - role: "bertvv.samba"
      tags: ["system"]
  vars:
      samba_apple_extensions: "yes"
      samba_guest_account: "server"
      samba_load_homes: true
      samba_netbios_name: "testserver"
      samba_shares:
      - name: publicshare
        comment: 'Public share, writeable by all members of group ‘users’'
        public: 'yes'
        write_list: +users
        group: users
        setype: public_content_t
        browseable: 'yes'
        path: /home/server/samba/shares/public
      - name: TimeMachine
        comment: 'Share useable as a TimeMachine backup target on MacOS'
        vfs_objects:
          - name: fruit
            options:
              - name: time machine
                value: 'yes'
          - name: streams_xattr
        path: /home/server/samba/shares/tm
        write_list: server
        owner: server
        group: server
        public: 'no'
        guest_ok: 'no'
        browseable: 'no'
      samba_map_to_guest: Never
      samba_users:
      - name: server
        password: -----

Edit: Found it! It is this parameter:

nt pipe support = no

Answer 1

The problem is the following parameter:

nt pipe support = no

This is extracted from the Ansible samba role I am using (https://galaxy.ansible.com/bertvv/samba)

CVE-2017-7494 A remote code execution vulnerability may affect your Samba server installation. Samba versions 3.5.0 and before 4.6.4 are affected. If SELinux is enabled on your system, it is NOT vulnerable.

This role will check if the installed version of Samba is affected by the vulnerability and apply the proposed workaround: adding nt pipe support = no to the [global] section of the configuration. Remark that this disables share browsing by Windows clients.

You can explicitly disable the fix if necessary, by setting the role variable samba_mitigate_cve_2017_7494 to false.