Unable to mount windows share as administrator

Unable to mount windows share as administrator

[Jon Scott]

I'm able to mount a share from Windows 10 without problems if my
.smbcredentials file contains a username and password of a regular
user on the Windows system.  However, if I change the credentials to
an administrator on the Windows system, I get:

mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

Here's the relevant /etc/fstab entry:
//RONE/Users/fran /rone_users cifs
credentials=/home/jon/.smbcredentials,ro,iocharset=utf8 0 0

4.4.0-71-generic
mount.cifs version: 6.4

Re: Unable to mount windows share as administrator

[Germano Percossi]

Hi,

Before the right guys would answer more appropriately than me:

1) are the 2 users credentials stored in the same domain?
2) what is the difference in the packet trace between the successful
   one and the failing one?
3) what does the kern.log (or dmesg) says when the cifs module verbosity
   is increased?

Cheers,
Germano

On 04/02/2017 11:39 PM, Jon Scott wrote:
> I'm able to mount a share from Windows 10 without problems if my
> .smbcredentials file contains a username and password of a regular
> user on the Windows system.  However, if I change the credentials to
> an administrator on the Windows system, I get:
> 
> mount error(13): Permission denied
> Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
> 
> Here's the relevant /etc/fstab entry:
> //RONE/Users/fran /rone_users cifs
> credentials=/home/jon/.smbcredentials,ro,iocharset=utf8 0 0
> 
> 4.4.0-71-generic
> mount.cifs version: 6.4
> --
> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: Unable to mount windows share as administrator

[Aurélien Aptel]

Germano Percossi <germano.percossi-Sxgqhf6Nn4DQT0dZR+AlfA@public.gmane.org> writes:
> Before the right guys would answer more appropriately than me:
>
> 1) are the 2 users credentials stored in the same domain?
> 2) what is the difference in the packet trace between the successful
>    one and the failing one?
> 3) what does the kern.log (or dmesg) says when the cifs module verbosity
>    is increased?

Also, does it work using smbclient?

-- 
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97  8C99 03C8 A49B 521B D5D3
SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)

Re: Unable to mount windows share as administrator

[Jon Scott]

1) Same domain.

2) Packet trace on successful one:

 11 0.025874817  192.168.1.4 -> 192.168.1.2  TCP 66 60038 → 445 [ACK]
Seq=83 Ack=410 Win=30336 Len=0 TSval=534260 TSecr=1048034385
 12 0.025925659  192.168.1.4 -> 192.168.1.2  SMB 276 Session Setup
AndX Request, NTLMSSP_NEGOTIATE
 13 0.026379329  192.168.1.2 -> 192.168.1.4  SMB 321 Session Setup
AndX Response, NTLMSSP_CHALLENGE, Error:
STATUS_MORE_PROCESSING_REQUIRED
 14 0.026477102  192.168.1.4 -> 192.168.1.2  SMB 450 Session Setup
AndX Request, NTLMSSP_AUTH, User: RONE\fred
 15 0.027490596  192.168.1.2 -> 192.168.1.4  SMB 193 Session Setup AndX Response
 16 0.027539762  192.168.1.4 -> 192.168.1.2  SMB 146 Tree Connect AndX
Request, Path: \\RONE\Users
 17 0.027830569  192.168.1.2 -> 192.168.1.4  SMB 132 Tree Connect AndX Response
 18 0.027869958  192.168.1.4 -> 192.168.1.2  SMB 138 Trans2 Request,
QUERY_FS_INFO, Query FS Device Info
 19 0.028056566  192.168.1.2 -> 192.168.1.4  SMB 134 Trans2 Response,
QUERY_FS_INFO
 20 0.028093720  192.168.1.4 -> 192.168.1.2  SMB 138 Trans2 Request,
QUERY_FS_INFO, Query FS Attribute Info
 21 0.028242894  192.168.1.2 -> 192.168.1.4  SMB 146 Trans2 Response,
QUERY_FS_INFO
 22 0.028282004  192.168.1.4 -> 192.168.1.2  SMB 158 Tree Connect AndX
Request, Path: \\192.168.1.2\IPC$
 23 0.028427268  192.168.1.2 -> 192.168.1.4  SMB 126 Tree Connect AndX Response
 24 0.028467215  192.168.1.4 -> 192.168.1.2  SMB 164 Trans2 Request,
GET_DFS_REFERRAL, File: \RONE\Users
 25 0.028585940  192.168.1.2 -> 192.168.1.4  SMB 105 Trans2 Response,
GET_DFS_REFERRAL, Error: STATUS_FS_DRIVER_REQUIRED
 26 0.028625329  192.168.1.4 -> 192.168.1.2  SMB 144 Trans2 Request,
QUERY_PATH_INFO, Query File All Info, Path:
 27 0.028863338  192.168.1.2 -> 192.168.1.4  SMB 214 Trans2 Response,
QUERY_PATH_INFO
 28 0.028900213  192.168.1.4 -> 192.168.1.2  SMB 144 Trans2 Request,
QUERY_PATH_INFO, Query File All Info, Path:
 29 0.029113359  192.168.1.2 -> 192.168.1.4  SMB 214 Trans2 Response,
QUERY_PATH_INFO
 30 0.029179566  192.168.1.4 -> 192.168.1.2  SMB 144 Trans2 Request,
QUERY_PATH_INFO, Query File All Info, Path:
 31 0.029390198  192.168.1.2 -> 192.168.1.4  SMB 214 Trans2 Response,
QUERY_PATH_INFO
 32 0.029428470  192.168.1.4 -> 192.168.1.2  SMB 144 Trans2 Request,
QUERY_PATH_INFO, Query File Internal Info, Path:

and from the unsuccessful one:

 22 3.000713055  192.168.1.4 -> 192.168.1.2  TCP 74 60028 → 445 [SYN]
Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=515405 TSecr=0 WS=128
 23 3.000913071  192.168.1.2 -> 192.168.1.4  TCP 74 445 → 60028 [SYN,
ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
TSval=1047958967 TSecr=515405
 24 3.000953577  192.168.1.4 -> 192.168.1.2  TCP 66 60028 → 445 [ACK]
Seq=1 Ack=1 Win=29312 Len=0 TSval=515405 TSecr=1047958967
 25 3.001067552  192.168.1.4 -> 192.168.1.2  SMB 148 Negotiate Protocol Request
 26 3.001643576  192.168.1.2 -> 192.168.1.4  SMB 475 Negotiate Protocol Response
 27 3.001672349  192.168.1.4 -> 192.168.1.2  TCP 66 60028 → 445 [ACK]
Seq=83 Ack=410 Win=30336 Len=0 TSval=515405 TSecr=1047958967
 28 3.001726264  192.168.1.4 -> 192.168.1.2  SMB 276 Session Setup
AndX Request, NTLMSSP_NEGOTIATE
 29 3.002076572  192.168.1.2 -> 192.168.1.4  SMB 321 Session Setup
AndX Response, NTLMSSP_CHALLENGE, Error:
STATUS_MORE_PROCESSING_REQUIRED
 30 3.002505936  192.168.1.4 -> 192.168.1.2  SMB 450 Session Setup
AndX Request, NTLMSSP_AUTH, User: RONE\root
 31 3.003142299  192.168.1.2 -> 192.168.1.4  SMB 105 Session Setup
AndX Response, Error: STATUS_LOGON_FAILURE
 32 3.006003702  192.168.1.4 -> 192.168.1.2  SSH 150 Server: Encrypted
packet (len=96)
 33 3.006105106  192.168.1.4 -> 192.168.1.2  SSH 118 Server: Encrypted
packet (len=64)
 34 3.006198689  192.168.1.4 -> 192.168.1.2  SSH 166 Server: Encrypted
packet (len=112)


3)  Using --verbose, dmesg produces:
[19192.774047] Status code returned 0xc000006d NT_STATUS_LOGON_FAILURE
[19192.774065] CIFS VFS: Send error in SessSetup = -13
[19192.774277] CIFS VFS: cifs_mount failed w/return code = -13

Thank you very much!

On Mon, Apr 3, 2017 at 6:09 AM, Germano Percossi
<germano.percossi-Sxgqhf6Nn4DQT0dZR+AlfA@public.gmane.org> wrote:
> Hi,
>
> Before the right guys would answer more appropriately than me:
>
> 1) are the 2 users credentials stored in the same domain?
> 2) what is the difference in the packet trace between the successful
>    one and the failing one?
> 3) what does the kern.log (or dmesg) says when the cifs module verbosity
>    is increased?
>
> Cheers,
> Germano
>
> On 04/02/2017 11:39 PM, Jon Scott wrote:
>> I'm able to mount a share from Windows 10 without problems if my
>> .smbcredentials file contains a username and password of a regular
>> user on the Windows system.  However, if I change the credentials to
>> an administrator on the Windows system, I get:
>>
>> mount error(13): Permission denied
>> Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
>>
>> Here's the relevant /etc/fstab entry:
>> //RONE/Users/fran /rone_users cifs
>> credentials=/home/jon/.smbcredentials,ro,iocharset=utf8 0 0
>>
>> 4.4.0-71-generic
>> mount.cifs version: 6.4
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
>> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>

Re: Unable to mount windows share as administrator

[Jon Scott]

smbclient works great as a regular user, but fails as root (which is
the name of an administrator on the Windows 10 machine).

Thank you very much!

On Mon, Apr 3, 2017 at 7:14 AM, Aurélien Aptel <aaptel-IBi9RG/b67k@public.gmane.org> wrote:
> Germano Percossi <germano.percossi-Sxgqhf6Nn4DQT0dZR+AlfA@public.gmane.org> writes:
>> Before the right guys would answer more appropriately than me:
>>
>> 1) are the 2 users credentials stored in the same domain?
>> 2) what is the difference in the packet trace between the successful
>>    one and the failing one?
>> 3) what does the kern.log (or dmesg) says when the cifs module verbosity
>>    is increased?
>
> Also, does it work using smbclient?
>
> --
> Aurélien Aptel / SUSE Labs Samba Team
> GPG: 1839 CB5F 9F5B FB9B AA97  8C99 03C8 A49B 521B D5D3
> SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
> GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)

Re: Unable to mount windows share as administrator

[Germano Percossi]

On 04/04/2017 02:22 AM, Jon Scott wrote:
> 
> and from the unsuccessful one:
> 
[cut]
> AndX Request, NTLMSSP_NEGOTIATE
>  29 3.002076572  192.168.1.2 -> 192.168.1.4  SMB 321 Session Setup
> AndX Response, NTLMSSP_CHALLENGE, Error:
> STATUS_MORE_PROCESSING_REQUIRED
>  30 3.002505936  192.168.1.4 -> 192.168.1.2  SMB 450 Session Setup
> AndX Request, NTLMSSP_AUTH, User: RONE\root
>  31 3.003142299  192.168.1.2 -> 192.168.1.4  SMB 105 Session Setup
> AndX Response, Error: STATUS_LOGON_FAILURE

Does Windows understand "root" as administrator?

> 
> On Mon, Apr 3, 2017 at 6:09 AM, Germano Percossi
> <germano.percossi-Sxgqhf6Nn4DQT0dZR+AlfA@public.gmane.org> wrote:
>> Hi,
>>
>> Before the right guys would answer more appropriately than me:
>>
>> 1) are the 2 users credentials stored in the same domain?
>> 2) what is the difference in the packet trace between the successful
>>    one and the failing one?
>> 3) what does the kern.log (or dmesg) says when the cifs module verbosity
>>    is increased?
>>
>> Cheers,
>> Germano
>>
>> On 04/02/2017 11:39 PM, Jon Scott wrote:
>>> I'm able to mount a share from Windows 10 without problems if my
>>> .smbcredentials file contains a username and password of a regular
>>> user on the Windows system.  However, if I change the credentials to
>>> an administrator on the Windows system, I get:
>>>
>>> mount error(13): Permission denied
>>> Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
>>>
>>> Here's the relevant /etc/fstab entry:
>>> //RONE/Users/fran /rone_users cifs
>>> credentials=/home/jon/.smbcredentials,ro,iocharset=utf8 0 0
>>>
>>> 4.4.0-71-generic
>>> mount.cifs version: 6.4
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
>>> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
>>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>>

Re: Unable to mount windows share as administrator

[Shirish Pargaonkar]

If authentication works for a regular domain user, it should work for
another domain user albeit with more privileges, do not think
authentication is affected by privileges, just the credentials.
Can you mount this share from another Windows box for user RONE/root?

On Mon, Apr 3, 2017 at 8:26 PM, Jon Scott <jonzanscott-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> smbclient works great as a regular user, but fails as root (which is
> the name of an administrator on the Windows 10 machine).
>
> Thank you very much!
>
> On Mon, Apr 3, 2017 at 7:14 AM, Aurélien Aptel <aaptel-IBi9RG/b67k@public.gmane.org> wrote:
>> Germano Percossi <germano.percossi-Sxgqhf6Nn4DQT0dZR+AlfA@public.gmane.org> writes:
>>> Before the right guys would answer more appropriately than me:
>>>
>>> 1) are the 2 users credentials stored in the same domain?
>>> 2) what is the difference in the packet trace between the successful
>>>    one and the failing one?
>>> 3) what does the kern.log (or dmesg) says when the cifs module verbosity
>>>    is increased?
>>
>> Also, does it work using smbclient?
>>
>> --
>> Aurélien Aptel / SUSE Labs Samba Team
>> GPG: 1839 CB5F 9F5B FB9B AA97  8C99 03C8 A49B 521B D5D3
>> SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
>> GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
> --
> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html