Linux_post_install/reports/bug-report-smb-server-access-denied.md at 5da148ac4e48b4a948fdc75ae375d22c57c62980

Files

T

Your Name 5da148ac4e fix: share smb-server share warns on Samba-passdb gaps + blocked parent traversal

share now checks both common NT_STATUS_ACCESS_DENIED causes before writing the
config (warnings only — the share is still applied):
- --users entries missing from the Samba passdb (pdbedit -L) get a warning
  pointing at 'pos share smb-server adduser <user>' — valid users = <u> with
  no Samba password previously failed for clients with no clue why.
- every ancestor of the share path is checked for other:+x traversal (sticky
  dirs like /tmp count as traversable); a 700 home dir under the share path
  now warns with 'chmod o+x <dir>'.
Docs: howto/share.md SMB section + NT_STATUS_ACCESS_DENIED troubleshooting.
Verified with a stub-PATH suite (pdbedit/systemctl/smbcontrol/testparm stubs,
SMB_CONF seam): 16/16 green.

2026-08-13 02:14:36 -04:00

2.0 KiB

Raw Blame History

Here is a concise bug report you can hand off to the developers of pos (or use to fix the script if you maintain it yourself).

🐛 Bug Report: `pos share smb-server` Creates Inaccessible Shares

Issue Description

When adding a share with pos share smb-server share <path> --users <user>, the command successfully adds the share to /etc/samba/smb.conf and reloads smbd. However, clients receive NT_STATUS_ACCESS_DENIED upon connecting.

Root Causes

Missing Samba User Credentials (smbpasswd)

Problem: pos configures valid users = <user> in smb.conf, but fails to initialize or sync the user in Samba's passdb (passdb.tdb). Standard Linux account credentials in /etc/shadow are not recognized by Samba without smbpasswd.
Result: Samba rejects authentication or tree connection requests.

Parent Directory Permission Lockdown

Problem: When sharing a path inside a user's home directory (e.g., /home/username/shared), default Linux home permissions are set to 700 (drwx------). Samba cannot traverse /home/username to reach /home/username/shared.
Result: NT_STATUS_ACCESS_DENIED due to missing +x (traversal) permission on parent directories.

Proposed Fixes for `pos` CLI

Fix 1: Register User in Samba Database

When --users <user> is passed, check if the user exists in pdbedit -L. If missing, prompt for a Samba password or run:

sudo smbpasswd -a <user>
sudo smbpasswd -e <user>

Fix 2: Automate Parent Directory Traversal Sanity Check

Before adding a share path (e.g., /home/user/share), inspect parent directory permissions. If others lack execution rights (+x), automatically run or prompt:

chmod o+x /home/<user>

Workaround (Manual Fix)

To fix the share created by pos right now, run:

# 1. Set traversal rights on home directory
chmod o+x /home/unknown

# 2. Add user to Samba database
sudo smbpasswd -a unknown

# 3. Restart Samba daemon
sudo systemctl restart smbd

2.0 KiB Raw Blame History

🐛 Bug Report: pos share smb-server Creates Inaccessible Shares