Bug 123899 - permission denied for browsing SMB shares
Summary: permission denied for browsing SMB shares
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Fedora
Classification: Fedora
Component: gnome-vfs2-extras
Version: 2
Hardware: i686
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Alexander Larsson
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2004-05-21 14:38 UTC by Bryan Cole
Modified: 2007-11-30 22:10 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2006-06-01 14:26:23 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Bryan Cole 2004-05-21 14:38:50 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 Galeon/1.2.5 (X11; Linux i686; U;) Gecko/20020618

Description of problem:
No browsing of SMB Shares is possible from Gnome for cases where
domain authorisation is required.

When browsing a Win2K host for shares, nautilus does no prompt for a
username/password. the error message is:

"You do not have the permissions necessary to view the contents of
"Windows Network: <Windows Server>"."

However ... If you enter a URL directly in Nautilus like
smb://user@<servername>/<share>
things seem to work OK: you get prompted for a username/passwd and
gnome-keyring seems to work well.

Thus, it looks like gnome-vfs-smb isn't passing the correct
authorisation stuff when it request the share list (equivalent to
'smbclient -L'). However, authorisation proceeds normally when
actually accessing a share.

Version-Release number of selected component (if applicable):
gnome-vfs-extras-0.2.0-8.1

How reproducible:
Always

Steps to Reproduce:
1. Open "Windows Networks" in Nautilus
2. Select a host which requires Domain authorisation to access it
3. 
    

Actual Results:  No share browsing possible: Error message as noted above

Expected Results:  Nautilus should have asked for username/password,
if required, then displayed the list of available shares

Additional info:

Comment 1 Bryan Cole 2004-05-24 09:17:46 UTC
I see the following in my Sys-log after attempting to browse a
smb-server from nautilus:

May 24 09:52:56 bryan smbd[31179]: [2004/05/24 09:52:56, 0]
auth/auth_domain.c:domain_client_validate(199) 
May 24 09:52:56 bryan smbd[31179]:   domain_client_validate: unable to
validate password for user Vinny in domain TERAVIEWHQ to Domain
controller \\TERAVIEW-W2KS1. Error was NT_STATUS_NO_SUCH_USER. 

Now the question is ... who the hell is Vinny?????????????????????
(it's not me or anyone else in this company, by the way)

Has someone has hard-coded a user name, perhaps?

Bryan



Comment 2 David Bentley 2004-06-12 19:46:50 UTC
I can't find any log entries but can confirm that same problem exists
when trying to look for shares on a Windows XP Pro machine.

The error message is a dialog box titled ERROR DISPLAYING FOLDER
and contains a error icon and the following text :-

The folder contents could not be displayed
You do not have the permissions neccessary to view the contents of
"Windows Network: machine name"

Comment 3 Matthew Ross 2004-06-13 01:25:35 UTC
*** Bug 125336 has been marked as a duplicate of this bug. ***

Comment 4 Bryan Cole 2004-06-14 09:09:38 UTC
Sorry, I think my previous post about the log messages was bogus.
Please disregard it. It was just coincidence that the log-msg arrived
just as I tried getting smb-share browsing to work. It's not
reproducible on my machine.

Why would share browsing contact the local smbd anyway? However,
share-browsing authentication is definitely broken, so the problem is
real.

(& I've still no idea who Vinny is)

Comment 5 Don Himelrick 2004-06-24 16:44:37 UTC
O.K., something funny is going on here.  AFAIK, there is no
gnome-vfs2-extras component (no package by that name, no source
package by that name), which this bug is filed under.  I believe that
the correct component would be gnome-vfs2, which is the source package
for gnome-vfs2-smb.   Second, I'm not convinced that Bug 125336 is a
duplicate of this bug.  That bug, and Bug 122292, state that no
servers show up in the windows network (smb:///) while this bug states
that:

Steps to Reproduce:
1. Open "Windows Networks" in Nautilus
2. Select a host which requires Domain authorisation to access it

Maybe 125336 and 122292 are related to this bug, but to me they seem
different.  Also those 2 bugs are (I think incorrectly) assigned to
nautilus/Alexander Larsson (alexl), while this one is
assigned to Jonathan Blandford (jrb).

I hope this helps :)


Comment 6 bednar 2004-06-30 21:23:23 UTC
I confirm this bug. What is interesting I think (I remember but cannot
check) this problem become lately. After fresh install (from CDs) FC2
the SMB browsing worked wery well. Now, after few distro upgrade smb
browsing is broken.

Comment 7 Colin Kuskie 2004-07-07 05:04:43 UTC
When I upgraded from FC1 to FC2, I could see machine names but
couldn't browse the shares on them (although it was using 3.0.4-5,
and not the version that comes with FC2 due to a bug in the updater).
On a machine that I installed (as opposed to upgraded), I can't see
machines or shares.


Comment 8 Carlos 2004-08-05 01:40:52 UTC
I also have this issue using FC2 final.  I have all the updates 
installed.  I can browse other Samba servers, but I get the 
permission denied when trying to browse shares on an NT server.  I 
can connect via mount -t cifs and also I can smbclient -L to the NT 
boxes.  It is only when trying to browse the network.

Comment 9 David A. Cafaro 2004-08-23 15:16:06 UTC
I can confirm this as well.  I upgraded to samba 3.0.6-1 from
samba.org and still get this error. 

I can browse and see other windows computers from nautilus, but I can
not browse the shares on any of those machines.  On the command line
smbclient --list servername works fine, asks for a password and shows
the shares.  Nautilus just gives the:

   The folder contents could not be displayed.
You do not have the permissions necessary to view the contents of
"Windows Network: servername". 

error message and never prompts for the user authentication information.

Comment 10 Chris Forsyth 2004-09-30 15:00:58 UTC
Wow,
I had all of this typed, copied it 'just in case', closed out of the
Printer stuff, and FireFox Crashed. -- Then I came back, and could not
paste it back.
Any Hoo
                                                                     
                                                      
                                                                     
                                                      
Hi,
     I am having the same problems, but I'll give my side of the issues.
                                                                     
                                                      
    I can not access my "workgroup" using Nautilus. There are 5
computers that I will be referring to.
                                                                     
                                                      
1 Windows 2k
1 Windows XP with SP2, but I am about to redo it because of SP2 (can't
access unvalid signed java scripts [out of date certs])
1 Fedroa Core 1 with UpDates
1 Fedora Core 2 Origional off the CD's
1 Fedora Core 2 with Updates, many of them, and kernel hacks.
                                                                     
                                                      
The 3 machines W2k, WXP, and the Fedora Core 1 are all in the same
category because they all work properly.
                                                                     
                                                      
The Fedora Core 2's are different. Using Samba versions 3.0.6-1, and
3.0.7-2 hand configured, and neither one of them can use Nautilus to
access shares just by
                                                                     
                                                      
"smb:///" or "smb://WindowsMachine"
---
- But I can "smb://WindowsMachine/Share" <-- So I'm not completly screwed
______________
In Naulilus
To rotate the scenerio a bit;
"smb://FedoraCore1Machine" --- I can browse shares?? YES
                                                                     
                                                      
"smb://FedoraCore1Machine/Share" works as well...
                                                                     
                                                      
###########################
                                                                     
                                                      
So this means that the Samba Machines communicate well with one another.
                                                                     
                                                      
As well, The other machines in the network can access the "Fedora core
2 Boxes" without a problem. All shares, and I don't have a printer
connected to the Linux Boxes directly.
                                                                     
                                                      
_______________________
                                                                     
                                                      
Printers, and Smaba Printing... -=Interesting situation=-
                                                                     
                                                      
I have 2 printers connected to a w2k box; The w2k box is a print and
log server. The "3" computers work fine with file and print sharing,
but the Fedora Core 2 Boxes, act a little different.
                                                                     
                                                      
In order for me to print I have to do the following:
                                                                     
                                                      
1:) Initially establish the printer within "Gnome print Manager" (one
time setup)
2:) Restart the computer, or wait a bit... (for it to drop the
authentication)
3:) Now I want to print a Document...
__________
-=The troubles, and temp resolution=-
                                                                     
                                                      
1:) I have to run "tryprint.pl %F" which tells me "No printers found.
 Run the printer configuration tool?"
2:) I click "Ok"
3:) I "root" in
4:) I double click on the Printer I want to use so I can edit the
properties, then I click on the "Queue type" tab and check to make
sure everything is well (and it is)
5:) click "Ok"
6:) click "Apply" - Which is whereFireFox crashed last time, as I
mentioned at the beginning
                                                                     
                                                      
Final:) Print!
                                                                     
                                                      
                                                                     
                                                      
I would not be supprised if these 2 things (File and Print sharing
using Samba-3.0.6-1 & Samba-3.0.7-2) are related. It does seem to have
a problem with "permissions" on the windows side, but because of this
version of samba, and it's probabily a default setting somewhere that
should be disabled... lol
                                                                     
                                                      
The only resolution  I see is to not install samba from the get go,
and build samba from Fedora Core 1, or Redhat 9 from src.rpm to fit
your machine. or to deal with the problems.
                                                                     
                                                      
Apparently Samba-3.0.6-1 does work or they would have fixed it in the
3.0.7-2 release for Fedora Core 2 Auto-UpDates. I would like to know
in what Network Scenerio does it work well with? As a Domain
Comtroller perhaps? I have recognised that Fedora Core 2 does work
well as a "Server Side" machine, after all the other machines do not
have a problem accessing shares on the "Fedora Core 2's"
                                                                     
                                                      
--skimp.

Comment 11 Chris Forsyth 2004-09-30 15:25:52 UTC
[user@FedoraCore2 samba]$ smbclient -NL WindowsXP-Box
timeout connecting to 66.14.xxx.xxx:445
timeout connecting to 66.14.xxx.xxx:139
Error connecting to 66.14.xxx.xxx (Operation already in progress)
Connection to WindowsXP-Box failed

This is strange.

We are natted behind a router, why would it be attempting to go
through the WAN port. Why not just stay on the local subnet??

-- I would not think that this would happen. I had seen it before, but
since I just posted I thought I would share a bit more...

BTW: When I "smbclient -NL FedoraCore1-Box" it all works fine.

**Refer to my previous post.

Comment 12 Tom Bast 2004-10-13 20:57:36 UTC
I have the same problem and have not yet figured out a way to solve it. 

If I try to access other linux boxes using SAMBA shares, it works fine
- it will prompt you for the username and password. It will not prompt
when accessing any windows machine.  

Comment 13 Gordon Banks 2004-10-27 20:36:54 UTC
I have the same problem which appeared when I upgraded to FC2 from
FC1, which worked perfectly.  I can ping the Windows machines and see
the Linux machine from Windows machines (provided I set security to
SHARE), but can't logon to the Windows machines.

Comment 14 Gordon Banks 2004-10-30 20:52:45 UTC
Further information: the Linux machine CAN browse XP machines on the
network.  It is the Win2000 machines that are inaccessible. 
Apparently XP has something setup differently that allows SAMBA to browse.

Comment 15 Nick Hills 2004-11-15 10:27:27 UTC
Just to mention that this issue is still apparent in FC3. I Can't
comment on whether it affects XP, but it is certainly a problem with
Win2K Pro and Server in an ADS setup.

I know XP implements 'simple file sharing' which for our mainly NT
network is a pain in the tail, so we turn this feature off. Is it
possible that the default install of XP with the feature turned on is
whats allowing the browsing?

Comment 16 Gordon Banks 2004-11-15 17:11:08 UTC
If you will tell me how to turn off the "simple file sharing" in XP,
I'll do it and let you know if it stops SMB browsing.

Comment 17 Nick Hills 2004-11-16 12:21:35 UTC
From Explorer goto the tools menu.
Folder Options
View Tab
In Advanced settings scroll all the way to the bottom
(i think its the last item)
Use Simple File sharing

I'm not sure if it will need a reboot, but its windows - so probably!

I'll be interested to hear how you get on.


Comment 18 Luca Bruera 2004-11-16 15:23:38 UTC
I'm experiencing the same problem (client fc3 and server win XP). On
the server "Use Simple File sharing" is enabled, so this is not the
problem.
The problem anyway seems just related to shares listing, using
smb://user@<servername>/<share> it works fine.

Comment 19 Sean McCorkell 2005-02-11 16:24:47 UTC
I have exactly the same problem - I can use Nautilus to browse for
various SMB Machine Names on our network, but when selecting the
machine to view the shares I receive the message "You do not have the
permissions necessary to view the contents of "Windows Network: XXXXX".

There is no prompt for a username / password.

If I use Nautilus and type smb://hostname/sharename, I am prompted for
a username and password, and things work as expected. However browsing
shares with Nautilus is broken.

Oddly enough - if I am logged in as "root", everything works just fine
- no errors and SMB browsing just works.

Any further ideas - logging in as root all the time SUCKS.

Comment 20 Bryan Cole 2005-02-11 16:34:26 UTC
I discovered I can get nautilus SMB browsing to work if ---

1) I configure the NT kerberos realm in krb5.conf
2) Specify ADS security in smb.conf
3) as root, join the domain using 'net ADS join <domain>
-U<AdminUser>' and give an administrator password for the Window
domain controller. Joining using RPC, as a normal user doesn't work.
It's got to be full ADS authentication.
4) get a kerberos ticket (I use gnome-kerberos) from the domain
controller.

Without a kerberos ticket, browsing doesn't work.

N.B. smbclient always works with simple user+password authentication. 

Comment 21 Dragos Maciuca 2005-02-28 19:34:49 UTC
I would also like to add that browsing does not work between FC3 
client and Win2K server.  I can browse all the way to the Win2K 
machine but I cannot see the shared folder or printer.  It says that 
I don't have the right permissions.

I recently switch from Xandros (Debian Linux and KDE) and the 
browsing worked fine in that OS.

Comment 22 Matthew Miller 2005-04-26 16:00:21 UTC
Fedora Core 2 is now maintained by the Fedora Legacy project for
security updates only. If this problem is a security issue, please
reopen and reassign to the Fedora Legacy product. If it is not a
security issue and hasn't been resolved in the current FC3 updates or
in the FC4 test release, reopen and change the version to match.

Comment 23 John Thacker 2006-06-01 14:26:23 UTC
Closing due to lack of response by reporter.  If the original problem
still occurs in FC4 or FC5, please reopen and give information per
previous comment.


Note You need to log in before you can comment on or make changes to this bug.