Originally posted by: captain AM

on AIX 7.1 TL4 SP6  - via latest yum updated all rpms and installed samba-4.6.15-1 packages without any errors.  set up smb.conf file and launched smbd samba process - fails with following messages:

[2018/09/14 15:14:12.668302,  0] ../lib/util/charset/convert_string.c:391(convert_string_talloc_handle)
  convert_string_talloc: Conversion not supported.
[2018/09/14 15:14:12.668584,  0] ../source3/auth/auth_util.c:1114(copy_session_info)
  copy_session_info(): ndr_pull_auth_session_info failed: Character Conversion Error
[2018/09/14 15:14:12.668660,  0] ../source3/printing/nt_printing_migrate_internal.c:221(nt_printing_tdb_migrate)
  Couldn't create session_info: NT_STATUS_NO_MEMORY
[2018/09/14 15:14:12.668785,  0] ../source3/rpc_server/srv_pipe_register.c:222(rpc_srv_register)
  rpc_srv_register: Failed to call the spoolss init function!
[2018/09/14 15:14:12.668856,  0] ../lib/util/become_daemon.c:111(exit_daemon)
  STATUS=daemon failed to start: Samba cannot setup ep pipe, error code 13

per messages .. verified no libiconv rpm package installed so as to use standard AIX bos.rte.iconv library /usr/lib/libiconv.a

and per ldd /opt/freeware/sbin/smbd  verified all resolves and ref is to /usr/lib for libiconv.a.

hopefully something simple I've missed or incompatibility?

Originally posted by: AyappanP

Paste your smb.conf file here.

Originally posted by: captain AM

Attachment(s)

samba.4.6.15-1_smb.conf   2 KB 1 version

Originally posted by: AyappanP

"unix charset" setting in the smb.conf seems to be causing this issue. Do you really need this ?

Please remove this and try running smbd again.

Originally posted by: captain AM

That allows it to start - I will have to verify if any charset issues per old legacy data files.

BUT that elevates a new show stopper.. the DFS links appear to be broken now .. sigh.

[2018/09/18 09:50:04.811895,  0] ../source3/smbd/msdfs.c:617(is_msdfs_link_internal)
  is_msdfs_link_read_target: Error reading msdfs link share1: A return value of a math subroutine is not within machine precision.
 

per the smb.conf file supplied --  this works in previous versions of Samba & haven't seen that this is an issue anywhere specifically per googling .. 

[global]

  host msdfs              = Yes

[data]
        msdfs root      = Yes
        path            = /var/lib/samba/data
        browseable      = Yes
 

# ls -l /var/lib/samba/data
lrwxrwxrwx    1 root     system           41 Jun 25 13:11 share1 -> msdfs:sgnfs.corp.com\data_share1
 

This connects ok as a dfs link via command line per any windows machine:   net use * \\sgnfs.corp.com\data_share1 

so I know the MS DFS path / share is available and good. ??

Originally posted by: captain AM

BTW per the unix charset .. why wouldn't a samba built for AIX accept the default AIX charset:

ISO8859-1  English (United States) [en_US]
with out this it appears many file names just vanish and are not displayed via samba ??

we have many legacy CATIA v4 model files where the 'blank' char is a special character ± that ISO8859-1 appears to still allow vie samba 3

ENG±SYMBOLS±±±TEST±NT_COMPAT.model

This file doesn't show up in the listing now .. nor does it 'mangle' if mangle = Yes

Originally posted by: captain AM

** Found a solution **  set  ...   unix charset = ISO-8859-1    

instead of old Samba3 setting of ISO8859-1 and all file names with special characters are visible again!

And set  "mangle = No"  to allow one to at least see the full filename even if Windows will not allow it to be accessed per invalid Windows characters.

Originally posted by: AyappanP

Good to see you have found a solution.

Originally posted by: captain AM

Any thoughts/suggestions on how to resolve the remaining DFS link 'read' errors?  as that's a showstopper 

[2018/09/18 09:50:04.811895,  0] ../source3/smbd/msdfs.c:617(is_msdfs_link_internal)
  is_msdfs_link_read_target: Error reading msdfs link share1: A return value of a math subroutine is not within machine precision.

Originally posted by: AyappanP

Identified the root cause of this issue. This needs a small change in the code and recompilation. 

We are in the process of updating samba to 4.6.16 because of recent security vulnerabilites. This fix will be integrated in that release. 

I don't see a temporary workaround for this. 

Originally posted by: captain AM

Great!  -- any ETA on availability?  or if you need an early adopter/verification?

Originally posted by: AyappanP

We are waiting for legal approval for the new release 4.6.16 .

Since Samba is GPL licensed, this is going to take some time. You can probably expect it in first week of September.

Originally posted by: captain AM

I can live with that if it all works, as long as you meant the 1st week of October vs next year in September! 

that'll give us a target.

Originally posted by: AyappanP

My mistake. Yeah , 1st week of next month 

Originally posted by: jcruz

Hi, you mention a release of 4.6.16 (which i believe addresses CVE-2018-10858), any further updates on this?

Originally posted by: AyappanP

Legal approval is still pending. Seems like this is going to take some more time, couple more weeks.

Originally posted by: jcruz

Thank you

Originally posted by: AyappanP

We have uploaded Samba-4.6.16 which addresses the latest CVEs and the msdfs links issue.

Originally posted by: jcruz

Thank you again.  I have installed it and currently testing.

Originally posted by: captain AM

Success - Tested & verified that DFS links & 4.6.15-1 working great!  Thanks!

But I've run into a problem now trying to implement multiple instances of samba on the same host server.  I can start both instances with unique smb.conf's, netbios defs, socket address, /var/run's, & DNS & AD entries, etc, as previously defined & working with 3.5 & 3.0.30 versions ..   and can connect via PC to 1 instance but 2nd never connects as pops up a 'enter network credentials' panel for that instance ('username/passwd incorrect) & nothing in logs for that instance even w/debug 5.   doesn't matter which order they are started, just that which ever one is used/connected to 1st always 'wins' and locks the other out even from different PC's.   Need multiple capability.  Any knowledge if a new parm/switch setting is needed vs version 3 samba?  each AIX server host has one interface 'en0' defined with a primary netaddr & then one or more alias4 IP's defined.   

example:   > ifconfig -a en0:flags=1e084863,814c0<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST,GROUPRT,64BIT,CHECKSUM_OFFLOAD(ACTIVE),LARGESEND,CHAIN>
        inet 10.xxx.yy.128 netmask 0xffffff00 broadcast 10.xxx.yy.255
        inet 10.xxx.yy.140 netmask 0xffffff00 broadcast 10.xxx.yy.255
         tcp_sendspace 262144 tcp_recvspace 262144 rfc1323 1

> lsattr -El en0

alias4        10.xxx.yy.140,255.255.255.0 IPv4 Alias including Subnet Mask              True

netaddr     10.xxx.yy.128               Internet Address                             True

netmask    255.255.255.0             Subnet Mask                                   True

I do see this oddity now .. in the PC/IP client connected samba log for the working instance an error messager with 2nd instance host name:

[2018/12/07 11:17:18.582831,  5] ../auth/gensec/gensec_start.c:681(gensec_start_mech)
  Starting GENSEC submechanism gse_krb5
[2018/12/07 11:17:18.583467,  1] ../source3/librpc/crypto/gse.c:646(gse_get_server_auth_token)
  gss_accept_sec_context failed with [ Miscellaneous failure (see text): Failed to find cifs/smb-2@CORP.domain.COM(kvno 3) in keytab MEMORY:cifs_srv_keytab (arcfour-hmac-md5)]
[2018/12/07 11:17:18.583513,  1] ../auth/gensec/spnego.c:569(gensec_spnego_parse_negTokenInit)
  SPNEGO(gse_krb5) NEG_TOKEN_INIT failed: NT_STATUS_LOGON_FAILURE
[2018/12/07 11:17:18.583605,  2] ../auth/gensec/spnego.c:768(gensec_spnego_server_negTokenTarg)
  SPNEGO login failed: NT_STATUS_LOGON_FAILURE

ideas?   thx

Originally posted by: AyappanP

Never tried multiple instances of Samba on same host. 

From the error message it seems like some problem with keytab file.

You can cross-check your smb conf file with the one mentioned here ->  https://wiki.samba.org/index.php/Multiple_Server_Instances