Help with accessing Samba shares on external (non-domain) webserver(s)

[mjgreen81]

Hi all,

 

First of all let me say that I am a UNIX newbie, so I am learning as I go!

 

I have recently been getting some samba shares to work on a new Solaris server. This new server is replacing a retiring server with the same setup, so I know this can work!

 

Now that these samba shares are working (and browsable), I move on to the next hurdle!

 

We have a few externally hosted (Windows Server 2008 R2) web servers which are not on our domain, but can still communicate with our network.

 

I can successfully browse to the samba shares on the existing (soon to be retired) solaris server from these webservers, so as I said a bove, I know that this can work.

 

These web servers can successfully ping the new solaris server, but I cannot browse to the shares whether I use the server name or the IP address. This morning I turned on some deeper Samba logging details and the problem looks like an authentication issue:

 

Example log when connecting as me from my PC (on the domain)

 

[color=#0B374D][font=Courier][2014/09/30 09:37:50.140615,  2] auth/auth.c:309(check_ntlm_password)[/font][/color]  check_ntlm_password:  authentication for user [myusername] -> [myusername] -> [myusername] succeede

 

Example log when connecting from the webserver (MYWEBSERVER) while logged on as user WEBUSER

[/font][color=#0B374D][font=Courier]check_ntlm_password:  Authentication for user [WEBUSER] -> [WEBUSER] FAILED with error NT_STATUS_NO_SUCH_USER[2014/09/30 10:12:21.161315,  0] auth/auth_domain.c:331(domain_client_validate)  domain_client_validate: unable to validate password for user WEBUSER in domain MYWEBSERVER to Domain controller MY.INTERNAL.DOMAIN.COM. Error was NT_STATUS_NO_SUCH_USER.[2014/09/30 10:12:21.161877,  2] auth/auth.c:319(check_ntlm_password)  check_ntlm_password:  Authentication for user [WEBUSER] -> [WEBUSER] FAILED with error NT_STATUS_NO_SUCH_USER[/font][/color][font=Open Sans]

 

So the problem is quite obvious, Samba cannot authenticate the user as they are not on the domain.

 

As I understand it, on the existing Solaris server the webservers 'bypass' the authentication and connect to the shares as the guest user “web”. However, this doesn’t seem to be working on the new server.

 

I did read about adding the line “map untrusted to domain = yes” to the smb.conf, but this doesn’t seem to have made any difference.

 

Is anyone able to help - I am tearing my hair out over this!

[adambot]

What is your client connect string (if you put the password on the command line, please sanitize it)

 

I use the following:

smbclient //hostname/share -U DOMAIN\\username

 

I am then prompted for the password.

 

One thing that you may need to look at is with the offsite hosting, is the ip address of the remote server in the same range as yours

ex:

local ip range: 172.16.9.x

remote ip range: 192.168.1.x

 

samba will not normally be able to hop the network translation. Remember, the SMB protocol is non-routable so it is limited to your network only