RPi4 Samba Share Sorta Works - My Linux based CNC cannot connect - Page 1
Forum section: electronics / general

author: rx8pilot
author_rank: Super Contributor
timestamp: September 11, 2020, 05:07:18 am
content: Setup:RPi4 Running headlessSAMBA installed and configured for a basic shareWindows 10 machines on network can connect to share - create and edit filesHaas CNC machine (Linux kernel, but zero user access to console)Synology NAS (Linux kernel)Goal:CNC machine needs to connect to the RPi4 Samba share.Current status:CNC machine can connect to the Synology NAS, no problem. CNC machine FAILS to connect to RPi4 share.Windows machines and other Linux machines are able to connect to the RPi4 Samba share.Trying to figure out why the CNC machine connects to the Synology but not the RPi4 Samba share. From the windows and Linux machines, I can connect to the CNC for all other services - just not the share.I have come to the end of my troubleshooting ability on this one. Guessing I do not have Samba configured correctly since the CNC has no issues connecting to the Synology NAS.Anyone have a guess where I should swing my hammer next? Stumped.

author: olkipukki
author_rank: Frequent Contributor
timestamp: September 11, 2020, 07:45:21 pm
content: Are there same SAMBA version and protocol on RPi4 and NAS?

author: rx8pilot
author_rank: Super Contributor
timestamp: September 11, 2020, 08:31:13 pm
content: Good question....I will dig around the NAS to see if I can figure that out.Mostly interested in reviewing the smb.conf (or equivalent) on the NAS to see how Samba is configured. Not sure if the Synology system will allow access to that file or not.

author: olkipukki
author_rank: Frequent Contributor
timestamp: September 11, 2020, 08:48:49 pm
content: /etc/samba/smb.confor quick check Min/Max SMB protocols in Control Panel -> File Service -> SMB -> Advanced Settings

author: Monkeh
author_rank: Super Contributor
timestamp: September 11, 2020, 08:52:18 pm
content: Quote from: rx8pilot on September 11, 2020, 08:31:13 pmSure. See /etc/samba/Synology set min protocol to NT1, which is deprecated and probably suffers more security issues than so far discovered. All modern versions of samba will default to SMB2_02.

author: rx8pilot
author_rank: Super Contributor
timestamp: September 11, 2020, 09:21:21 pm
content: Now I know I can SSH into that box.MAX: SMB2MIN: SMB1smb.conf seem straightforward - image attached.Maybe winbind enum users=yes?

author: Monkeh
author_rank: Super Contributor
timestamp: September 11, 2020, 09:23:13 pm
content: That's actually a default setting anyway..On your Pi, check if you have min protocol set. If you do not, it's set to SMB2_02. Most likely the problem. Haas are only 14 years behind the curve if so..

author: rx8pilot
author_rank: Super Contributor
timestamp: September 11, 2020, 09:33:52 pm
content: Quote from: Monkeh on September 11, 2020, 09:23:13 pmHaas is indeed in the dark ages. Operating these 2020 machines is a trip back to 1990. :-)is the syntax:Code:min protocol = SMB2_02??

author: Monkeh
author_rank: Super Contributor
timestamp: September 11, 2020, 09:37:55 pm
content: Quote from: rx8pilot on September 11, 2020, 09:33:52 pmYes. Set it to NT1 and see if things work.

author: rx8pilot
author_rank: Super Contributor
timestamp: September 11, 2020, 09:57:36 pm
content: No luck......Connects to the Synology, but not the Pi4.I have since installed and configured Open Media Vault on the Pi. Like earlier, it works fine with Windows, Linux, and Mac but the Haas CNC cannot connect.Not sure what the secret is in the Synology configuration that allows the Haas CNC to connect without issue.

author: Monkeh
author_rank: Super Contributor
timestamp: September 11, 2020, 10:33:45 pm
content: Are you willing to share both configs?

author: rx8pilot
author_rank: Super Contributor
timestamp: September 11, 2020, 10:42:17 pm
content: Sure thing - nothing special or secret.Driving home now and will post the configs as soon as I get to my desk. Thank you VERY much for taking the time to consider this challenge.

author: rx8pilot
author_rank: Super Contributor
timestamp: September 11, 2020, 11:37:50 pm
content: Synology NAS (The device that the Haas CNC will successfully connect)smb.confCode:printcap name=cupswinbind enum groups=yesinclude=/var/tmp/nginx/smb.netbios.aliases.confsecurity=userlocal master=norealm=*passdb backend=smbpasswdprinting=cupsmax protocol=SMB2winbind enum users=yesload printers=yesworkgroup=WORKGROUPsmb.share.confCode:recycle bin admin only=noftp disable modify=noftp disable download=nowrite list=nobody,nobodybrowseable=yesmediaindex=nohide unreadable=yeswin share=yesenable recycle bin=noinvalid users=nobody,nobodyread list=nobody,nobodyftp disable list=noedit synoacl=yesvalid users=nobody,nobodywriteable=yesguest ok=yespath=/volume1/backup_alphaskip smb perm=yescomment="holding"recycle bin admin only=noftp disable modify=noftp disable download=nowrite list=nobody,nobodybrowseable=yesmediaindex=nohide unreadable=nowin share=yesenable recycle bin=noinvalid users=nobody,nobodyread list=nobody,nobodyftp disable list=noedit synoacl=yesvalid users=nobody,nobodywriteable=yesguest ok=yespath=/volume1/NetBackupskip smb perm=yescomment="System default shared folder"recycle bin admin only=noftp disable modify=noftp disable download=nowrite list=nobody,nobodybrowseable=yesmediaindex=nohide unreadable=yeswin share=yesenable recycle bin=yesinvalid users=nobody,nobodyread list=nobody,nobodyftp disable list=noedit synoacl=yesvalid users=nobody,nobodywriteable=yesguest ok=yespath=/volume1/SCIskip smb perm=yescomment="Data"recycle bin admin only=noftp disable modify=noftp disable download=nowrite list=nobody,nobodybrowseable=yesmediaindex=nohide unreadable=yeswin share=yesenable recycle bin=yesinvalid users=nobody,nobodyread list=nobody,nobodyftp disable list=noedit synoacl=yesvalid users=nobody,nobodywriteable=yesguest ok=yespath=/volume1/SGAskip smb perm=yescomment="DATA"Samba config from the RPi4:smb.confCode:# This file is auto-generated by openmediavault (https://www.openmediavault.org)# WARNING: Do not edit this file, your changes will get lost.#======================= Global Settings =======================workgroup = WORKGROUPserver string = %h serverdns proxy = nolog level = 10log file = /var/log/samba/log.%mmax log size = 1000logging = syslogpanic action = /usr/share/samba/panic-action %dencrypt passwords = truepassdb backend = tdbsamobey pam restrictions = nounix password sync = nopasswd program = /usr/bin/passwd %upasswd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .pam password change = yessocket options = TCP_NODELAY IPTOS_LOWDELAYguest account = nobodyload printers = nodisable spoolss = yesprinting = bsdprintcap name = /dev/nullunix extensions = yeswide links = nocreate mask = 0777directory mask = 0777map to guest = Bad Useruse sendfile = yesaio read size = 16384aio write size = 16384time server = nowins support = nomulticast dns register = no# Special configuration for Apple's Time Machinefruit:aapl = yes# Extra optionssecurity = usermin receivefile size = 16384write cache size = 524288getwd cache = yessocket options = TCP_NODELAY IPTOS_LOWDELAYmin protocol = NT1win share = yesskip smb perm = yes#======================= Share Definitions =======================path = /srv/dev-disk-by-label-CNC/CNC/guest ok = yesguest only = noread only = nobrowseable = yesinherit acls = yesinherit permissions = noea support = yesstore dos attributes = yesvfs objects =printable = nocreate mask = 0664force create mode = 0664directory mask = 0775force directory mode = 0775hide special files = yesfollow symlinks = yeshide dot files = yesread list =write list = "CNC",@"CNC"The last three lines in the  section are just experiments that I added. They do not appear to have made a difference.

author: Monkeh
author_rank: Super Contributor
timestamp: September 12, 2020, 12:06:25 am
content: And down the rabbit hole we go. Let's see about auth, then.Add 'log level = auth:5' to the Pi's global config, try and access it with the CNC, then post up the relevant chunks of /var/log/samba/log.smbdYou may need to dispense with the automagickery of openmediavault, or see if it lets you configure that.

author: rx8pilot
author_rank: Super Contributor
timestamp: September 12, 2020, 12:13:15 am
content: Copy that....Open Media Vault does allow some control over smb.conf - but not infinite.Going for the verbose logs now.

author: rx8pilot
author_rank: Super Contributor
timestamp: September 12, 2020, 12:19:17 am
content: This does not look good......but it is a far more clear place to start looking. Samba cannot understand the password?Code:Sep 11 17:15:44 MFG01 smbd: making blobs for CNC's user_info structSep 11 17:15:44 MFG01 smbd: [2020/09/11 17:15:44.251583, 3] ../source3/auth/auth.c:189(auth_check_ntlm_password)Sep 11 17:15:44 MFG01 smbd: check_ntlm_password: Checking password for unmapped user []\@[192.168.198.225] with the new password interfaceSep 11 17:15:44 MFG01 smbd: [2020/09/11 17:15:44.251673, 3] ../source3/auth/auth.c:192(auth_check_ntlm_password)Sep 11 17:15:44 MFG01 smbd: check_ntlm_password: mapped user is: []\@[192.168.198.225]Sep 11 17:15:44 MFG01 smbd: [2020/09/11 17:15:44.253897, 5] ../source3/auth/auth.c:251(auth_check_ntlm_password)Sep 11 17:15:44 MFG01 smbd: auth_check_ntlm_password: sam_ignoredomain authentication for user  FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1Sep 11 17:15:44 MFG01 smbd: [2020/09/11 17:15:44.254182, 2] ../source3/auth/auth.c:334(auth_check_ntlm_password)Sep 11 17:15:44 MFG01 smbd: check_ntlm_password: Authentication for user  ->  FAILED with error NT_STATUS_WRONG_PASSWORD, authoritative=1

author: Monkeh
author_rank: Super Contributor
timestamp: September 12, 2020, 12:29:04 am
content: As bad as it sounds.. how sure are you the password is right?Get the log for a working connection as well.

author: greenpossum
author_rank: Frequent Contributor
timestamp: September 12, 2020, 12:33:36 am
content: It sounds like your CNC machine is set to use NTLM authentication which is disabled by default in Samba packages due to insecurity. So you need to allow this on the Samba server in smb.conf:Code:ntlm auth = YesI ran into this using Samba to serve an XP (virtual) machine. Sure, the Linux in the CNC machine can probably use more secure authentication methods but probably chose NTLM to allow it to be compatible with older Windows servers and NAS servers.

author: Monkeh
author_rank: Super Contributor
timestamp: September 12, 2020, 12:40:40 am
content: NTLMv2 auth is still enabled by default and there's no indication from this level of logging whether it's v1 or v2. The Synology does probably have v1 enabled, though - they're a bit behind the times, too.Add auth_audit:5 to that (forgot that one). Again try both working and non-working.

author: greenpossum
author_rank: Frequent Contributor
timestamp: September 12, 2020, 12:42:55 am
content: Quote from: Monkeh on September 12, 2020, 12:40:40 amWell all I can say is my XP wouldn't connect until I allowed NTLM Auth so it wasn't enabled by default in my Linux distro's Samba (which is quite up to date, like RPi's Samba).

author: rx8pilot
author_rank: Super Contributor
timestamp: September 12, 2020, 12:50:19 am
content: Quote from: greenpossum on September 12, 2020, 12:33:36 amFor the WIN! We are connected.That was the problem and I was definitely not going to guess that one on my own.This seems like an ancient relic of a method, but in this case it does not matter.The CNC machines and the Pi4 will be very well isolated from the internet and the other networks in the building.AWESOME troubleshooting success - Thank you all.

author: Monkeh
author_rank: Super Contributor
timestamp: September 12, 2020, 12:58:38 am
content: I will admit, fair catch. I was just about to post up and say a failed NTLMv1 attempt without auth_audit looks just like a wrong password (I tested). Synology's so old they still allow NTLMv1 by default.If I were you I'd be in touch with Haas and suggest they update themselves to protocols we've been using since before the turn of the century.Quote from: greenpossum on September 12, 2020, 12:42:55 amNTLMv2 is and always has been enabled by default. XP does not try NTLMv2 by default, but it can be enabled. Even Windows 95 supported NTLMv2.

author: greenpossum
author_rank: Frequent Contributor
timestamp: September 12, 2020, 01:07:24 am
content: I also notice that Samba has expanded the list of values NTLM Auth can take since I fixed my issue, now differentiating between v1/v2 and other use cases.

author: greenpossum
author_rank: Frequent Contributor
timestamp: September 12, 2020, 01:30:40 am
content: Quote from: Monkeh on September 12, 2020, 12:58:38 amIt looks like at the time I fixed my problem NTLM Auth = yes in smb.conf meant enable v1, so I could have fixed it at the XP end as you say, if I had known, but it was and is easier to fix it at the Samba end, and this is my home LAN anyway.

author: rx8pilot
author_rank: Super Contributor
timestamp: September 12, 2020, 01:44:24 am
content: Quote from: Monkeh on September 12, 2020, 12:58:38 amLol....I could make the argument that Haas is proud of their ancient technology.These are 2017 thru 2020 manufactured machines if you can believe it.

author: Monkeh
author_rank: Super Contributor
timestamp: September 12, 2020, 01:45:33 am
content: Quote from: rx8pilot on September 12, 2020, 01:44:24 amSadly, I can. And such is how security never advances: "Oh, it's not important for our application"