Samba: WinXP gets "access denied" from LMDE, prints anyway

[dhfx]

I have 2 printers on my LMDE box, networked with a WinXP machine. Originally the XP machine was unable to print via the LMDE. After reading a few forum posts I got my smb.conf to the point where the XP machine can print on both printers, even though it gets "Access denied" when it tries to check if the printer is ready. Printing locally on the LMDE box works fine.

Has anyone else had this? I gather that Samba is all messed up on LMDE, but possibly someone knows of a workaround. Below is my testparm output.

_____________________________________________
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[homes]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[DATASHARE]"
Loaded services file OK.
Server role: ROLE_STANDALONE
[global]
workgroup = HOMENET
server string = %h server
interfaces = 192.168.1.0/24
map to guest = Bad User
syslog = 0
log file = /var/log/samba/log.%m
max log size = 1000
name resolve order = bcast host lmhosts wins
printcap name = cups
dns proxy = No
remote announce = 192.168.1.255
remote browse sync = 192.168.1.255
usershare allow guests = Yes
panic action = /usr/share/samba/panic-action %d
idmap config * : backend = tdb
hosts allow = 192.168.1.

[homes]
comment = Home Directories
read only = No
create mask = 0775
directory mask = 0700

[printers]
comment = All Printers
path = /var/spool/samba
force user = homeuser
create mask = 0700
guest ok = Yes
printable = Yes
print ok = Yes
browseable = No

[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
guest ok = Yes

[DATASHARE]
path = /datashare
force user = homeuser
read only = No
guest ok = Yes
___________________________________

Oh, and until I added the "force user" line under [DATASHARE] , I got "permission denied" when I tried to see DATASHARE from the XP box, although the permissions on /datashare are drwxrwxrwx. Now it works.

Any help with the printer problem would be appreciated.

[soup-n-sandwich]

After smashing my skull against the wall for a day and a half to try and get three printers that are attached to my LM KDE administrative machine shared out and working with all the other machines on this network, I resolve my issue. My senerio is, I have 7 machines connected to this network, plus the admin machine that has these printers connected too. Two of these machines are Windows XP and the rest are LM KDE. On the XP machine when setting up a printer it would see the printers being shared from my Admin (LM KDE) machine but when I actually went to install this as a network printer on XP it would tell me that the printer name was incorrect or the printer couldn't connect to the server. On the rest of the LM machines they printed...however I discover that the LM machines printed because they all were using Linux printing share protocal...NOT samba. So it turns out that the samba sharing didn't work on any of my machines despite the fact that all the settings that I could check were all correct. I went so far as to strip out everything int the smb.conf file and only leave what I was using...nothing more. Still it didn't work.

As I understand it, when you send a print job from a Windows machine (or a Samba equipped Linux machine) it gets sent to the print spool directory of the machine acting as the print server. In the case of most Linux distros that is /var/spool/samba. The print job is stored there and then the samba print service will process that and send it out to the printer. I started looking at everything and found some very important. After all the samba config stuff that I checked and rechecked I never looked at the actual print spool directory's permissions. It turns out that the var/spool/samba needs to have proper permissions so that the machines trying to send print jobs to it will have access. All the Samba configurations in the world doesn't seem to matter if the spool directory on the Linux side isn't set to allow read/write capabilities. After I adjusted the permissions of /var/spool/samba all the issues went away. It turns out that this permission issue was also responsible for not being able to install the printer on each of these machines

It would make a lot of sense to rewrite the spec file on this samba package so that it runs a script or something to make sure that the /var/spool/samba directory has the correct permissions right from the start.

[NissanNut]

I have the same issue. A printer connected to Mint 13. A win 7 and Win xp finds the printer and added the drivers. I do run \\192.168.0.110 then I see HP printer. It prints fine but, get "access denied" in the status all the time. I will try editing that spool file.

Thanks, I never would have known about that file.

[soup-n-sandwich]

Hey glad this information is valuable to somebody. Over the years I've had lots of Samba issues. All of them to lots of time to figure out but none of them were complex...after you understand what is happening. I still don't understand why samba isn't more of a priority when it comes to all Linux distros.

Also remember that /var/spool/samba is a directory not a file. I haven't tried this but I'm almost certain if you view this directory while your sending a print job from the other machines you should see the print file go into this /var/spool/samba directory and then disappear as the print job is executed.

If Samba is working correctly and you have the proper permissions set for the spools and driver directories you shouldn't need to manually enter a local IP in the printer config. The automatic search for network and local printers should find your printer.

If either of you guys need a copy of my smb.conf file and any more help with this let me know. I'll try to help as best as I can.

[NissanNut]

Well mine went from one windows box printing to none. So I setup CUPs and added host files to both windows boxs and now everything works perfect. No users or guests defined on linux. I did this instead:

The best way is to use "Connect to a printer on the Internet or on a home or office network" ( or "Add a network, wireless or Bluetooth Printer" in Win7 ) with this type of format:

http://linuxname:631/printers/LinuxPrinterName
631 is the ipp port number that Linux uses for the CUPS server.

in host file in all windows boxs

192.168.0.100 linuxname

I read windows 7 and xp has issues using IPs. I guess thats why it would sometimes print.

[soup-n-sandwich]

Ahhh I see.
The more information we have about this stuff the better off we are. So thanks for your methods. I'll add that to my toolbox and do a mental archive on it.
The weird thing that I found is that every distro has different issue despite that fact that we are using the same "systems"...meaning Samba, CUPS, etc. I think the only distro that I didn't have an issue with samba shares and samba printing was way back in 2007 with PCLOS. Other than that, I've had some issue with this kind of stuff every time I used something other than that particular distro. I guess it's up to the devel and what they feel is important. There are lots of distros that don't consider Samba as being important but for us it's everything when it comes to network and printer sharing. For every customer that has one of our machines with a Linux bases OS installed on it, there are at least 1 or 2 more computers in the same household that has Windows installed on them...so playing nice with a Windows machine is a must.
Thanks again for your take of the resolution for printer sharing.

[altair4]

On the Ubuntu / Main Mint side of things the Samba-to-Cups process is broken: https://bugs.launchpad.net/ubuntu/+sour ... bug/967410
Not sure if the problem is with cups or moving to the 3.6 branch of samba but the solution is to bypass samba as NissanNut suggested above.

Any of these should work:
http://192.168.0.100:631/printers/LinuxPrinterName
http://linuxname:631/printers/LinuxPrinterName
http://linuxname.local:631/printers/LinuxPrinterName

The last one ( linuxname.local ) is make possible by adding mDNS ( aka Bonjour, Zeroconfig, Avahi ) to the WinXP box. I'm not recommending this to anyone since you might consider adding a foreign networking protocol to a Windows product as creepy but it can be done and it does work on a WinXP test box I have set up for this kind of abuse. You can find it here: http://support.apple.com/kb/DL999 . Actually if you have iTunes installed on that WInXP box you may already have it installed since I think they slip it in for unknown reasons.

On the Linux end of this avahi should already be installed and running ( run "sudo service avahi-daemon status" to find out ) so it should be accessible by anything similarly equipped. On my network OSX, iPads, and all the other iStuff automatically connects to a Printer attached to my ( Xubuntu 12.04 ) system without any configuration necessary on their part.

I read windows 7 and xp has issues using IPs.

I haven't see that before. If we start having issues with connecting to a Linux box by ip address we need to pack it in and start using OSX or one of those iThings

[NissanNut]

I used your how to Altair, but still had issues with windows finding the linux with IP. It would find the printer. But say access denied or just not print. It would print ONCE in win 7. Then never again. So I added host files to both of my Windows boxs. Linux is the print server. I used the new http: way and its awesome. All three PCs have unique usernames and no guests.

Here is what I found on windows issues.

http://ubuntuforums.org/showthread.php?t=1621089

I have been fighting print share issues for years. Even sharing windows vista with win xp. win 7 and win 7 was un reliable. My current setup is the best so far ever. My scanner works also in linux. First time in 12 years (I used mandrake for years). I have never had any of my scanners work in any linux. I am super happy with linux mint! My son is getting a laptop soon. It will get linux mint. He loves it too.

[soup-n-sandwich]

altair4 thanks for the input. Why is it that I didn't need to do this? I wrote up very basic (didn't use the default) smb.conf file, configured the permissions on the spool samba dir. and it worked. I'm sharing with Samba on both LM and Windows. Any idea why it worked for me?

[altair4]

Don't know. You are in the Debian section of the forum and running KDE so it could be that the problem is Ubuntu / Gnome specific. I also have never seen /var/spool/samba have any permissions other than 1777 which should have been set that way at install.

Philosophically though Samba represents an unnecessary overhead since all it is a pass-though to cups. It would only make sense in a work environment which has strict rules about who can access what and if it's also being used as a File server then the users are already set up. Connecting to CUPS directly though does make it harder for a Windows client to set up since they can't do it by browsing to it.

EDIT: BTW, none of this seems to have helped the original poster who has either resolved the issue with what you all have provided but chooses not to respond or has given up and is now the proud owner of a brand new MacBook

[soup-n-sandwich]

Opps..yeah...this is starting to feel more and more like a post hijackin'. Sorry about that guys. I got carried away.
Just for the record I'm using the KDE version of Mint 13 and I know for sure that the permissions of /var/spool/samba were not 777. Weird stuff.
Without Samba you would be able to print remotely...but not file share with windows right?

[altair4]

If you are running Mint13 and the only difference is that you are using KDE then by all means post the output of the following command:

Code: Select all

testparm -s

The bug I referenced above in my earlier post needs a workaround for those who are forced to use Samba to share printers and if it's something that Gnome is doing that KDE is not it would be a real kicker.

[soup-n-sandwich]

Oh I see where you going with this.
Ok here is the result of the command. Keep in mind that I'm not using the default smb.conf file...because at the time I was trying to narrow down what the problem was so I made a custom, bear minimum smb.conf file.

Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[printers]"
Processing section "[NetShare]"
Processing section "[print$]"
WARNING: The security=share option is deprecated
Loaded services file OK.
Server role: ROLE_STANDALONE
[global]
workgroup = WORKGROUP
server string = Default Workgroup
security = SHARE
printcap name = cups
disable spoolss = Yes
show add printer wizard = No
idmap config * : backend = tdb

[printers]
comment = Printer spool in Mint
path = /var/spool/samba
read only = No
guest ok = Yes
printable = Yes
print ok = Yes
use client driver = Yes
browseable = No

[NetShare]
comment = publicly shared folder
path = /home/NetShare
read only = No
guest ok = Yes

[print$]
comment = printer drivers
path = /var/lib/samba/printers
guest ok = Yes

Oh btw I just installed a fresh copy of the same OS Mint13 KDE. I checked our the permissions of /var/spool/samba. I don't know what happened in the past three or four installs on other computers but on this one machine the permissions are what they should be, 777. This was not the case with the other installs. No clue what happened and why it didn't happen on this last install.

[altair4]

Keep in mind that I'm not using the default smb.conf file...because at the time I was trying to narrow down what the problem was so I made a custom, bear minimum smb.conf file.

You may already know this but smb.conf does not represent the full configuration of samba. It only represents additions or overrides to the default setting of samba so you are running with far more than this. If you want to see the total configuration ( and please don't post this ) run the following:

Code: Select all

testparm -sv

Let me play with this for a while when I get a chance. You've disabled guest access for Samba Usershares ( which I believe comes from kdenetwork-filesharing - not a KDE user I'm afraid so the package name was a guess ) because of a missing line. That in itself shouldn't have an impact on printing. And no one living remembers how Share level security works so I've got tinkering to do

Thanks.

EDIT: This is an interesting choice:

disable spoolss = Yes

What version of Windows are you using in your LAN?

[soup-n-sandwich]

Yeah let me know how you make out. I could trying loading the orignal smb.conf file an see what happens.

Right now I only have some XP machines. I had a couple of Win7 machines here but the were new builds for a customer and have been delivered...so we don't have them right now. Tomorrow I'm going to load up another machine with Win7 just to make sure things will work the same way with 7 as it does XP.
I'll keep you posted on that outcome.

Yeah this line "disable spoolss = Yes" I didn't consciously mean to leave that line in there. I think I found it in a posting on the forum or a search in Google. I didn't mean to keep that line in there. It was there when I was trying everything and anything to fix the issues of not printing...but it works very well.

Where do you see the disablement of the Usershare? The fact that it's not there in the conf file? I assume you mean the sharing of the user's Home directory?

If that's what you mean it was there but I removed it and have never used it. Instead for our customers use and our we just use a public folder shared out to swap files between machine. When this config is used in a small office we usually denie access to all but one, shared public folders on just one machine. But this default configuration means that any new install on a new machine has everything set up to work as a stand alone "share" machine. Like I said, if there is more than one machine setup like this we just disable all but one.

I'll let you know on the win 7 machines outcome.
Thanks again for your efforts.

[altair4]

Where do you see the disablement of the Usershare? The fact that it's not there in the conf file? I assume you mean the sharing of the user's Home directory?

No it's not the [homes] section. Samba usershares are implemented in Gnome with a package nautilus-share. It allows the user to right click a file he owns and select "share this thing" ( I'm paraphrasing ). In fact I wrote a howto on it a while back: viewtopic.php?f=42&t=23169

It's not that you disabled it it's that you removed the ability to create a share that allows guest access because of a missing line:

usershare allow guests = yes

In dolphin ( again this is from memory ) you have to install kdenetwork-fileshare. Then when you right click a file you have a "Share" tab. This is KDE's implementation of Usershares. You seem to be using what is now referred to as a Classic share where the share definition is in smb.conf itself so it's no big deal. It's just that most Gnome users create samba shares from Nautilus in much the same way you create a "Simple Share" in WinXP.

[soup-n-sandwich]

Oh yeah. I see what you talking about now. I didn't notice that before. Yes in KDE you can right click on a folder in Dolphin get the same results. Yeah I would definitely want to have that in our default configuration...although nothing would be shared out be default in the user home, but having the capability is important. Yeah the "classic" share has been something that we have always used and our customers have used since before Win XP. On XP we used to call it a MasterShare. It was put into place for home user and small businesses to be able to share "Publicly". It was a "standard" for our systems. I do remember some clients also sharing out folders in their Home..but the NetShare was always there on every machine..mostly for temp transfers of data. Nothing would stay in that folder. Just for transfers of data.

You are correct about the package kdenetwork-fileshare. It's installed by default on most KDE 4.5 or newer distros. I almost forgot about that package needing to be installed manually...but it's in there. Thanks for point that out btw. I'll have to add it.

I got the Win7 machine loading up now. I'll let you know how it turns out with the printer and file sharing.

UPDATE
Finished installing Win7. Set it up for the Home Network. Printer sharing was perfect and file sharing to the public NetShare was also perfect. No issues with that.

[altair4]

@dhfx:
I have no idea if this will fix your problem but you might want to add the following line to the [printers] section of your smb.conf as soup-n-sandwich suggested:

Code: Select all

use client driver = Yes

From the man pages it describes exactly what you are experiencing:

The differentiating factor is that under normal circumstances, the NT/2000 client will attempt to open the network printer using MS-RPC. The problem is that because the client considers the printer to be local, it will attempt to issue the OpenPrinterEx() call requesting access rights associated with the logged on user. If the user possesses local administator rights but not root privilege on the Samba host (often the case), the OpenPrinterEx() call will fail. The result is that the client will now display an "Access Denied; Unable to connect" message in the printer queue window (even though jobs may successfully be printed).
If this parameter is enabled for a printer, then any attempt to open the printer with the PRINTER_ACCESS_ADMINISTER right is mapped to PRINTER_ACCESS_USE instead. Thus allowing the OpenPrinterEx() call to succeed.

It also comes with a warning however:

This parameter MUST not be enabled on a print share which has valid print driver installed on the Samba server.

It seems to work for soup-n-sanwich so it may for you as well.

@soup-n-sanwich:
I tried to incrementally alter my own smb.conf to match yours and at one point just replaced it with yours and it did not resolve the problem. If this problem isn't going to be fixed by Ubuntu then a workaround has to be found that doesn't deviate so far from the default like setting security to share. THat isn't a criticism against what you posted since it seems to work for you but I don't want to advise people to so do something that Samba says is deprecated and has threatened to remove ( although the've said that for 6 years now )

@anyone else who is following what has become a bifurcated topic:
In reading the bug report again the workaround has already been found it's just hard to follow so for the benefit of anyone else who is running Main Mint with Gnome or someone like me who is running Xubuntu I offer the workaround here: viewtopic.php?f=42&t=28397&p=618065#p618065