This section describes some troubleshooting issues for the Oracle Solaris SMB service. For related troubleshooting information, see the following:
To authenticate users from a Windows domain, the Oracle Solaris SMB service must locate a domain controller, authenticate, and then add a computer account to the domain.
Users from the domain are not able to establish a connection to the Oracle Solaris SMB service unless this process succeeds.
The Oracle Solaris SMB service must be running for the smbadm join command to succeed.
If Active Directory (AD) is configured, the Oracle Solaris SMB service attempts to locate the domain controller by means of DNS. If the service cannot locate the domain controller, you must use SMF to configure DNS properly.
The following configuration issues might prevent you from configuring the Oracle Solaris SMB service in domain mode:
Missing DNS domain. Ensure that the fully qualified AD domain name has been added to the search list or as the local domain.
If your configuration is incorrect, you might see the Failed to join domain domain-name (INVALID_PARAMETER) error when attempting to join the domain.
Missing DNS server. Ensure that the IP address of the AD DNS server is added as the name server.
If your configuration is incorrect, you might see the Failed to find any domain controllers error when attempting to join the domain.
DNS host lookup not used. Ensure that DNS is used for host lookup.
Use the svccfg command to update properties for system/name-service/switch and network/dns/client. See the svccfg(1M) man page.
The user that you specify on the smbadm join command line must have the correct password and the authority to create computer accounts.
The following error message appears if you supply the wrong password for the administrative user:
Failed to find any domain controllers for domain-name
Some firewall software might filter out certain ports, which will prevent a Oracle Solaris SMB server from successfully joining a domain.
For example, the following error message appears if the Kerberos Change & Set Password port is filtered out:
smbd[446]: [daemon.error] smbns_kpasswd: KPASSWD protocol exchange failed ...
The following network protocols are used by the smbd service during a domain join operation, and must be available for the Oracle Solaris SMB service:
53
88
464
749
389
138
137
139
445
Port assignment settings appear in the /etc/services file. For more information, see the services(4) man page.
Much of the Oracle Solaris SMB service configuration uses the sharectl(1M) command to set properties. Before you change property values, you should view the current property settings by running the sharectl get smb command.
When using WINS/NetBIOS, Windows domain controllers (DC) do not automatically respond to the host from which they received a request. They perform a WINS or NetBIOS cache lookup and for multihomed servers, the DC can respond to different network interfaces belonging to the server. If the IP address is not accessible to the DC, it will appear as if the DC has not responded to the server. Therefore, you might have to exclude specific network interfaces from WINS registration.
The following example shows how to configure the Oracle Solaris SMB service as a WINS client. The primary WINS server is set to IP address 192.0.2.20, the secondary WINS server is set to IP address 192.0.2.21, and network interfaces bge0 and bge1 are excluded from WINS resolution.
# sharectl set -p wins_server_1=192.0.2.20 smb # sharectl set -p wins_server_2=192.0.2.21 smb # sharectl set -p wins_exclude=bge0,bge1 smb
Windows clients use an access token to assign user data and group membership. This token is assigned when the client connects to the SMB service. Any changes made to this token are not reflected until the next time the user connects.
To force changes to take effect immediately, the user must disconnect from the SMB service by logging out of all connected workstations.
A master browser is a server that is configured to manage SMB browse lists and to respond to client requests for them. A Windows server is configured as a master browser by default.
The Oracle Solaris SMB service is not configured as a master browser. The Oracle Solaris SMB service dedicates all of its resources to file sharing.
For browsing to function correctly, each subnet or physical network segment must have a master browser. To make the Oracle Solaris SMB service available through browse lists, the system on which it runs should be located on the same segment and subnet as a Windows server.
Configuring a Windows server improves the performance of browsing and might compensate for the lack of a master browser on some segments.
The security implementation of the Oracle Solaris SMB service secures only files and directories. The effective security of a SMB share is always the security of the directory to which it points.
You might see this problem if your client is running Windows 2000 or an older version of Windows.
If you are running a Windows 2000 client, apply the latest service pack.
If you are running a version older than Windows 2000, you might be able to work around the problem by using the Windows backup utility or by using a similar third-party product.
To map a drive or to connect to a share, you must have read access to the directory to which the share points.
If the Oracle Solaris SMB service is in domain mode, you must also be logged in to the domain.
To ensure that a user can connect to a share, do the following steps to check and modify permissions:
Log in to the system that is running the Oracle Solaris SMB service.
Become superuser.
Obtain the user name and group name of the owner.
# ls -l pathname
For example, the following output indicates that the share is a directory with 750 permissions. The owner is root and the group is sys.
# ls -ld /vol1/data drwxr-x--- 41 root sys 1024 Jan 2 23:19 /vol1/data
Determine the permissions necessary for the user to access the directory.
Use the chmod command to change the permissions of the directory.
Applications can send SMB echo requests periodically to keep idle sessions open or to reconnect, as required, if a session times out due to inactivity. If an application appears unable to deal with an idle session timeout, the SMB service keep_alive property can be set to 0 to disable the session inactivity timer.
# sharectl set -p keep_alive=0 smb
You cannot use Windows local groups to assign security on remote systems. You can use local group only on the individual computer on which it is created. A local group is not stored in the domain SAM database.
Windows domain controllers are an exception to this behavior. Domain controllers share a set of local groups that can be shared only with other domain controllers. To make security assignments to the Oracle Solaris SMB service, use global groups.
The Oracle Solaris SMB service has its own set of local groups that are provided for Windows compatibility purposes. These local groups permit a limited set of privileges, and they can also be used for security assignments to individual files and folders.
If you have a ZFS pool with datasets and you run the zfs set share.smb=on command on the pool, the pool and all its datasets are shared but unavailable for browsing by Windows systems.
To work around this problem:
Determine whether your ZFS pool and dataset versions support SMB shares.
# zpool get version pool # zfs get version dataset
Support for SMB shares requires that ZFS pools be at least Version 9 and that ZFS datasets be at least Version 3.
If your ZFS pool or dataset version are out of date, upgrade your ZFS pools and datasets.
# zpool upgrade pool # zfs upgrade dataset
For more information, see the zpool(1M) and zfs(1M) man pages.
Either map the shares directly or run the zfs set share.smb=on command on any of the lower-level datasets instead of the pool.
Errors will occur if you attempt to run both the Samba service svc:/network/samba:default and the Oracle Solaris SMB service svc:/network/smb/server:default simultaneously.
The Samba and Oracle Solaris SMB services are mutually exclusive because they both attempt to listen on the same ports. Only one service should be enabled at any time.
To disable the Samba service, use the svcadm disable svc:/network/samba command.
To disable the Oracle Solaris SMB service, use the svcadm disable smb/server command.
SMB shares on a ZFS file system might be inaccessible to SMB clients if you reboot the Oracle Solaris SMB server.
Run the following command to reshare the ZFS shares:
# share -F smb -a zfs
When you map a drive or browse computers in your workgroup, you might see invalid password errors. If you see these errors, check whether the /var/smb/smbpasswd file includes information for the appropriate users.
Also, ensure that the pam_smb_passwd.so.1 entry is in the /etc/pam.d/other file and that you use the passwd command to set your password.
For more information, see How to Configure the SMB Server in Workgroup Mode.
Access control list (ACL) behavior differs between Windows systems and ZFS file systems on Oracle Solaris systems. You might experience Windows ACL inheritance problems because of the access control entry (ACE) ordering used by the default ZFS ACL.
The default ZFS ACL is designed to comply with POSIX, which results in the interleaving of allow and deny ACEs. Windows expects all deny ACEs to precede all allow ACEs.
You can override the default ZFS behavior by changing the ACL on the root directory to provide the equivalent of Everyone:FullControl as follows:
# chmod 777 /pool-name # chmod A=everyone@:rwxpdDaARWcCos:fd:allow /pool/dataset
For information about the chmod options, see the chmod(1) man page.
You can verify the ACL by viewing it on Windows or by running the following command on an Oracle Solaris system:
# ls -V -d /pool/dataset
You can apply this ACL recursively to all subdirectories and files for existing file systems from Windows or from the Oracle Solaris OS.
If you apply the ACL when the file system is first created, the ACL will be propagated according to the normal inheritance rules.
If a directory has a default ZFS ACL, when a file or folder is created in this directory from Windows, it has two ACEs: one for the owner and one for SYSTEM. To change this behavior, update the root directory's ACL by running the chmod commands.
Some Windows clients do not show the security tab unless you have permission to view or change security.
For information about how to view and modify share permissions, see Cannot Use SMB to Map Drives.
You might not see the security tab for a file or folder when using an XP client for the following reasons:
You do not have enough permissions to see the security settings of the file or folder
Simplified file sharing is enabled on your client
To disable simplified file sharing, choose Control Panel→Folder Options→View, and deselect Use Simple File Sharing (Recommended), and click Apply.
For more information about disabling simplified file sharing and setting permissions on a shared folder, see Microsoft knowledge base article 307874, How to disable simple file sharing and how to set permissions on a shared folder in Windows XP.