CIFS and Samba: Connection to the General Windows folders

August

2022

16:00

CIFS and Samba: Connection to the General Windows folders

Linux

25 August 2022 16:00

For work, it is necessary to connect from Linux to the common Windows folder to pick up or transfer files. Organizations in 99% use computers running Windows, so you have to connect from Linux to Windows.

Samba installation of a client in Linux

sudo apt-get update
sudo apt-get install samba-client
sudo apt-get install cifs-utils

For the convenience of viewing the network environment in GUI, the file manager nautilus with the addition nautilus-lure is convenient

sudo apt-get install nautilus nautilus-share

View common network resources using a command line

Calling the Samba client for viewing server resources from the command line:

1) View common folders provided for general access on the network for local server users

smbclient -L //192.168.100.10 -U Username%Password

smbclient -L //servername -U Username%Password

Where: 192.168.100.10 - IP server address, servername - server name, USERNAME - local server user, password - user's password

2) viewing common folders provided for general access to the domain users

smbclient -L //192.168.100.10 -U Domain/Username%Password

smbclient -L //192.168.100.10 -U Username%Password -W Domain

or by name

smbclient -L //servername -U Username%Password -W Domain

Where Domain is the name of the Active Directory domain.

Or (so as not to report the password in the command parameters every time) Create a file ~/.SmbCredentials
With the entrance data:

username=User_name
password=Password
domain=standalone_server_or_domain_name

Then, joining the network catalog:

smbclient //server/share --authentication-file=/home/vladimir/.smbcredentials

Connecting to a common Samba folder in interactive mode

The same thing, but without a key -l, but with the parameter - the name of the general folder, in this case "share"

smbclient //192.168.100.10/share -U Domain/Username%Password

smbclient //servername/share -U Domain/Username%Password

smbclient //servername/share -U Username%Password -W Domain

After a successful entrance, an invitation will appear

smb: \>

You can enter commands, for example, HELP or DIR. The SMBClient interface using commands resembles a FTP client.

Connection to general folders using the Nautilus file manager

After the launch of Nautilus, select "+ other places" on the left side of the window ** - viewing the local network will open, where you can view computers on the network that have common folders.

Solving the problem with the connection: Getting rid of the error -13 Access Denied, or nt_status_access_denied

Error:CIFS: VFS: cifs_mount failed w/return code = -13"

This error can only be solved by setting up rights on the server. To open the overall viewing folder, you need three conditions:
1) The user is indicated among the users of the server Il domain (or access type Guest is allowed)
2) provided (not limited) access to the file system.
3) Dan access to a particular network folder - for example, the user is included in the user group, to which it is given access to the common folder.

The last, third condition is the most strict. It is necessary that the server administrator grant the right to the user (include it in a group of users of a common folder).

The most interesting thing is that the administrator’s rights do not guarantee it, he will be full rights to access to a common folder, because It is necessary that the user "Administrator" be included in the group, which is granted the rights to the danu network folder. In this regard, the administrator does not differ from the OTER/NOBODY group: it will receive Mount Error (13): Permission Denied because it is not included in the group of users of the network folder.

Using the Mount command

Instead of smbclient you can use the command mount.

First you need to create mount points and give the right to access the folder, for example:

sudo mkdir /mnt/cifs
sudo chmod 0777 /mnt/cifs

Examples of using the Mount team with network folders:

sudo mount -t cifs //192.168.20.222/share /mnt/cifs -o user=Vlad,pass=Str0ngPa$$word
ls  /mnt/cifs
sudo umount //192.168.20.222/share
ls  /mnt/cifs

Or the same thing with the .SmbCredientials file:

sudo mount -t cifs //192.168.20.222/share /mnt/cifs -o credentials=/home/vladimir/.smbcredentials

If the name of the network folder contains gaps ("Share with Spaces in Name"), you need to enter as follows:

sudo mount -t cifs //192.168.20.222/share\ with\ spaces\ in\ name /mnt/cifs -o credentials=/home/vladimir/.smbcredentials

Note: So that after executing the mount commanded folder, it would work not only for reading, but also to write to the remote oven, you need to compare the remote user with the Linux local user, using the parameters UID = 1000, Gid-1000 . Where 1000 is to replace Linux with a UID and GID user (displayed by the command id).
Or add to the parameters -o noperm, iOCHARSET = UTF8 .
In the key keys, you can set the Samba version, which we use to connect. For example,
for SMB2: Vers = 2.0 or for smb3 Vers = 3.0 .

Examples:

sudo mount -t cifs //192.168.20.222/share\ with\ spaces\ in\ name /mnt/cifs -o user=username,pass=password,uid=1000,gid=1000

sudo mount -t cifs //192.168.20.222/share\ with\ spaces\ in\ name /mnt/cifs -o credentials=/home/vladimir/.smbcredentials,vers=2.0,noperm

If the specified version of Samba (for example, SMB3) is not supported by the server, an error will be displayed "mount error(95): Operation not supported.".

Adding the Nofail parameter is useful when it is not known whether the remote computer (server) is turned on or not.

Mounting a network folder during download (file /etc /fstab)

Line syntax in /etc /fstab:

//[URL]/[sharename] /mnt/[mountpoint] cifs vers=3.0,credentials=/home/username/.sharelogin,iocharset=utf8,file_mode=0777,dir_mode=0777,uid=[username],gid=[username],nofail 0 0

Where:
//[URL]/[sharename] - server and network folder name
/mnt/[mountpoint] - mount point on the local computer
vers=3.0 - force installation of the SMB3 protocol version (or vers=2.0 - if the client and server only support SMB2)
credentials=/home/username/.sharelogin - specifying a file with the username, password and login domain
iocharset=utf8 - direct indication of the utf8 character set (not necessary if it works without it)
file_mode=0777,dir_mode=0777 - access rights when executing mount
uid=[username],gid=[username] - uid and gid data from the output of the command cat /etc/passwd | grep username
nofail - OS loading will continue even if the URL server is unavailable.

Other parameters:
defaults - includes the options rw, suid, dev, exec, auto, nouser, and async. Usually goes first, because you can override individual options on the line later, for example: defaults, noexec, ro - no execution, read only.
rw is obviously read-write on the client side (which is the opposite of ro - read-only (write protected).
suid - prohibits the use of the SUID (Set-User-IDentifier) or SGID (Set-Group-IDentifier) authority bits. Roughly speaking, it prohibits the transfer of some rights using the SUID and SGID bits - the rights must be set explicitly.
auto - used in /etc/fstab - allows automatic mounting of network resources when executing the mount -a command
noauto - prevents fstab from automatically mounting the folder when executing the mount -a command.
nouser - direct prohibition on “manual” mounting by all users except root (does not affect mounting during OS boot)
guest - for accessing "guest" shared folders that are accessible over the network without specifying a username and password.
async - data is written to the network folder whenever possible - the default value. Improves productivity.
sync - immediate recording to a remote computer (without using buffers), not recommended.
noperm - disables the client's built-in rights checking. They use noperm if they seem to have rights, but it is not possible to create a file for writing, for example, programmatically, due to incompatibility in the implementation of CIFS on the client and server.
noexec - direct prohibition of launching executable files from a network folder
noatime - do not update the file creation time (improves performance, but reduces information content)
nounix - disable Linux extensions: do not use symbolic links. Used to disable symbolic links for Windows compatibility.
mfsymlinks - key for Minshall+French style symbolic links. This link style is supported on Windows and Mac.

Examples of the line in FSTAB (where the entry data are indicated in the /etc/.SmbCredientials file):

//192.168.20.222/share_name rw,auto,nofail,credentials=/etc/.smbcredentials 0 0

If in/etc/hosts or the local DNS server the names of the machines are spelled out, instead of IP addresses, you can connect a general folder named: // Server/Share.

FSTAB -based installation team:

sudo mount -a

All discs based on /etc /fstab will be changed with the exception of the "Noauto" parameter.

Brief Samba settings in Windows (protocols SMB1, SMB2, SMB3)

Samba Protocol has three versions 1, 2 and 3.
The SMB1 protocol is included if the organization has cars for Windows XP. In other cases, they try to turn off SMB1 as unsafe.

On and off in Windows 7 and Windows Server 2008R2 is made using a registry, parameters
HKEY_LOCAL_MACHINE \ System \ CurrentControlset \ Services \ Lanmanserver \ Parameters
Dword type parameters
SMB1 = 0
SMB2 = 1

In Windows 8, Windows 10, 11, Windows Server 2012, 2016 and above the PowerShell command is used

GET-SMBSERVERCONFIGURATION | Select Enablesmb1Protocol, Enablesmb2Protocol

SET -SMBSERVERCONFIGURATION -ENABLESMB2PROTOCOL $ TRUE

These commanders do not work in the early versions of Windows 7 and Windows Server 2008R2.
Also, SMB3 does not work in Win7 - for more details see.Here is WinitPro.ru.

Links:

man mount.cifs

Blog about Radio and Linux