mounting CIFS share failure (cifs_mount failed w/return code = -2)

[Alexander Fieroch]

HOST: Kubuntu 16.04.3 LTS
LOCALHOST: Kubuntu 17.10

The system is in an working Active Directory environment (realm, sssd). But mounting on commandline using a kerberos ticket is failing:

mount -t cifs -o user=USER,domain=DOMAIN,cruid=USER,sec=krb5 //HOST/share /mnt/tmp
mount error(2): No such file or directory
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

journalctl/syslog:
CIFS VFS: Send error in SessSetup = -2
CIFS VFS: cifs_mount failed w/return code = -2

smbclient -k -U USER //HOST/share
is working and I can list all files in the share.

smbclient -U USER //HOST/share
is working too (without kerberos!) and I can list all files in the share.

using a filemanager with cifs like dolphin is working!
I can open smb://HOST/share with dolphin without a password (SSO).

Using mount.cifs without kerberos is not working too (in contrast to dolphin and smbclient):

mount -t cifs -o user=USER,domain=DOMAIN //HOST/share /mnt/tmp
Password for USER@//HOST/share: *************
mount error(5): Input/output error
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

journalctl/syslog:
Status code returned 0xc000005e STATUS_NO_LOGON_SERVERS
CIFS VFS: Send error in SessSetup = -5
CIFS VFS: cifs_mount failed w/return code = -5

Additional tests show me that it is working the other way round:
mounting Kubuntu 17.10 from Kubuntu 16.04.3 with kerberos (same machines) is working!
There has to be a change, that is not working anymore with a newer Ubuntu than 16.04.
Mounting on commandline without kerberos is not working too and I get the same error as above in syslog:
CIFS VFS: Send error in SessSetup = -5
CIFS VFS: cifs_mount failed w/return code = -5

Anyway, cifs mounting with kerberos stops working in newer distributions, which has to be fixed!

LOCALHOST: Kubuntu 17.10
========================
# dpkg -l | grep -e krb5 -e samba -e smb -e sssd
ii krb5-config 2.6 all Configuration files for Kerberos Version 5
ii krb5-locales 1.15.1-2 all internationalization support for MIT Kerberos
ii krb5-user 1.15.1-2 amd64 basic programs to authenticate using MIT Kerberos
ii libgssapi-krb5-2:amd64 1.15.1-2 amd64 MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
ii libkrb5-26-heimdal:amd64 7.4.0.dfsg.1-2 amd64 Heimdal Kerberos - libraries
ii libkrb5-3:amd64 1.15.1-2 amd64 MIT Kerberos runtime libraries
ii libkrb5support0:amd64 1.15.1-2 amd64 MIT Kerberos runtime libraries - Support library
ii libsmbclient:amd64 2:4.6.7+dfsg-1ubuntu3.1 amd64 shared library for communication with SMB/CIFS servers
ii libsmbios2v5 2.3.1-0ubuntu2 amd64 Provide access to (SM)BIOS information -- dynamic library
ii python-samba 2:4.6.7+dfsg-1ubuntu3.1 amd64 Python bindings for Samba
ii samba 2:4.6.7+dfsg-1ubuntu3.1 amd64 SMB/CIFS file, print, and login server for Unix
ii samba-common 2:4.6.7+dfsg-1ubuntu3.1 all common files used by both the Samba server and client
ii samba-common-bin 2:4.6.7+dfsg-1ubuntu3.1 amd64 Samba common files used by both the server and the client
ii samba-dsdb-modules 2:4.6.7+dfsg-1ubuntu3.1 amd64 Samba Directory Services Database
ii samba-libs:amd64 2:4.6.7+dfsg-1ubuntu3.1 amd64 Samba core libraries
ii samba-vfs-modules 2:4.6.7+dfsg-1ubuntu3.1 amd64 Samba Virtual FileSystem plugins
ii smb4k 2.0.1-1 amd64 Samba (SMB) share advanced browser
ii smbclient 2:4.6.7+dfsg-1ubuntu3.1 amd64 command-line SMB/CIFS clients for Unix
ii sssd 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- metapackage
ii sssd-ad 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- Active Directory back end
ii sssd-ad-common 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- PAC responder
ii sssd-common 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- common files
ii sssd-dbus 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- D-Bus responder
ii sssd-ipa 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- IPA back end
ii sssd-krb5 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- Kerberos back end
ii sssd-krb5-common 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- Kerberos helpers
ii sssd-ldap 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- LDAP back end
ii sssd-proxy 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- proxy back end
ii sssd-tools 1.15.3-2ubuntu1 amd64 System Security Services Daemon -- tools

HOST: Kubuntu 16.04.3 LTS
=========================

# dpkg -l | grep -e krb5 -e samba -e smb -e sssd
ii krb5-config 2.3 all Configuration files for Kerberos Version 5
ii krb5-locales 1.13.2+dfsg-5ubuntu2 all Internationalization support for MIT Kerberos
ii krb5-user 1.13.2+dfsg-5ubuntu2 amd64 Basic programs to authenticate using MIT Kerberos
ii libgssapi-krb5-2:amd64 1.13.2+dfsg-5ubuntu2 amd64 MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
ii libkrb5-26-heimdal:amd64 1.7~git20150920+dfsg-4ubuntu1.16.04.1 amd64 Heimdal Kerberos - libraries
ii libkrb5-3:amd64 1.13.2+dfsg-5ubuntu2 amd64 MIT Kerberos runtime libraries
ii libkrb5support0:amd64 1.13.2+dfsg-5ubuntu2 amd64 MIT Kerberos runtime libraries - Support library
ii libsmbclient:amd64 2:4.3.11+dfsg-0ubuntu0.16.04.12 amd64 shared library for communication with SMB/CIFS servers
ii python-samba 2:4.3.11+dfsg-0ubuntu0.16.04.12 amd64 Python bindings for Samba
ii samba 2:4.3.11+dfsg-0ubuntu0.16.04.12 amd64 SMB/CIFS file, print, and login server for Unix
ii samba-common 2:4.3.11+dfsg-0ubuntu0.16.04.12 all common files used by both the Samba server and client
ii samba-common-bin 2:4.3.11+dfsg-0ubuntu0.16.04.12 amd64 Samba common files used by both the server and the client
ii samba-dsdb-modules 2:4.3.11+dfsg-0ubuntu0.16.04.12 amd64 Samba Directory Services Database
ii samba-libs:amd64 2:4.3.11+dfsg-0ubuntu0.16.04.12 amd64 Samba core libraries
ii samba-vfs-modules 2:4.3.11+dfsg-0ubuntu0.16.04.12 amd64 Samba Virtual FileSystem plugins
ii smb4k 1.1.2-1 amd64 Samba (SMB) share advanced browser for KDE
ii smbclient 2:4.3.11+dfsg-0ubuntu0.16.04.12 amd64 command-line SMB/CIFS clients for Unix
ii sssd 1.13.4-1ubuntu1.9 amd64 System Security Services Daemon -- metapackage
ii sssd-ad 1.13.4-1ubuntu1.9 amd64 System Security Services Daemon -- Active Directory back end
ii sssd-ad-common 1.13.4-1ubuntu1.9 amd64 System Security Services Daemon -- PAC responder
ii sssd-common 1.13.4-1ubuntu1.9 amd64 System Security Services Daemon -- common files
ii sssd-ipa 1.13.4-1ubuntu1.9 amd64 System Security Services Daemon -- IPA back end
ii sssd-krb5 1.13.4-1ubuntu1.9 amd64 System Security Services Daemon -- Kerberos back end
ii sssd-krb5-common 1.13.4-1ubuntu1.9 amd64 System Security Services Daemon -- Kerberos helpers
ii sssd-ldap 1.13.4-1ubuntu1.9 amd64 System Security Services Daemon -- LDAP back end
ii sssd-proxy 1.13.4-1ubuntu1.9 amd64 System Security Services Daemon -- proxy back end
ii sssd-tools 1.13.4-1ubuntu1.9 amd64 System Security Services Daemon -- tools

[Alexander Fieroch (fieroch)]

After some more tests I found that package
keyutils
is not installed anymore on my newer systems > 16.04. After installing package keyutils mount.cifs is mounting via kerberos ticket again! So there is a dependency for package keyutils in relevant packages missing and should be added!

For those who want to know how to get to the missing package:
On 16.04 where mount.cifs is working with krb5 I got messages with cifs.upcall in syslog. The manpage for cifs.upcall showed me a reference to request-key.conf. That file or manpage was not installed in newer systems and is located in keyutils.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[gustavo_l_walker (gustavo-l-walker)]

In my case, I resolve using param "vers=1.0"

mount.cifs //server_ip/folder_shared /mounting_point -o rw,user=user,pass=mypass,iocharset=utf8,sec=ntlm,vers=1.0

[Andreas Hasenack (ahasenack)]

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822841 is what downgraded keyutils from a Recommends to a Suggests

[Jhair Tocancipa Triana (jhair-tocancipa-j)]

Suddenly mounting a cifs partition fails:

$ mount.cifs //de1-user-2/c$ -o x-systemd.automount,noauto,iocharset=utf8,uid=user,gid=user,credentials=/root/.cifscredentials,file_mode=0775,dir_mode=0775,noserverino,nobrl,vers=3.0 /home/user/Windows/

mount error(2): No such file or directory
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)

$ dmesg
[ 1410.023973] CIFS: Attempting to mount //de1-user-2/c$
[ 1410.026724] CIFS VFS: BAD_NETWORK_NAME: \\de1-user-2\c$
[ 1410.027049] CIFS VFS: cifs_mount failed w/return code = -2

ProblemType: Bug
ApportVersion: 2.20.11-0ubuntu27
Architecture: amd64
CasperMD5CheckResult: skip
CurrentDesktop: ubuntu:xfce
Date: Fri Apr 24 08:52:16 2020
Dependencies:
 adduser 3.118ubuntu2
 apt 2.0.2
 apt-utils 2.0.2
 ca-certificates 20190110ubuntu1
 debconf 1.5.73
 debconf-i18n 1.5.73
 dpkg 1.19.7ubuntu3
 gcc-10-base 10-20200411-0ubuntu1
 gpgv 2.2.19-3ubuntu2
 krb5-locales 1.17-6ubuntu4
 libacl1 2.2.53-6
 libapt-pkg6.0 2.0.2
 libaudit-common 1:2.8.5-2ubuntu6
 libaudit1 1:2.8.5-2ubuntu6
 libbsd0 0.10.0-1
 libbz2-1.0 1.0.8-2
 libc6 2.31-0ubuntu9
 libcap-ng0 0.7.9-2.1build1
 libcom-err2 1.45.5-2ubuntu1
 libcrypt1 1:4.4.10-10ubuntu4
 libdb5.3 5.3.28+dfsg1-0.6ubuntu2
 libffi7 3.3-4
 libgcc-s1 10-20200411-0ubuntu1
 libgcrypt20 1.8.5-5ubuntu1
 libgmp10 2:6.2.0+dfsg-4
 libgnutls30 3.6.13-2ubuntu1
 libgpg-error-l10n 1.37-1
 libgpg-error0 1.37-1
 libhogweed5 3.5.1+really3.5.1-2
 libidn2-0 2.2.0-2
 libk5crypto3 1.17-6ubuntu4
 libkeyutils1 1.6-6ubuntu1
 libkrb5-3 1.17-6ubuntu4
 libkrb5support0 1.17-6ubuntu4
 liblocale-gettext-perl 1.07-4
 liblz4-1 1.9.2-2
 liblzma5 5.2.4-1
 libnettle7 3.5.1+really3.5.1-2
 libp11-kit0 0.23.20-1build1
 libpam-modules 1.3.1-5ubuntu4
 libpam-modules-bin 1.3.1-5ubuntu4
 libpam0g 1.3.1-5ubuntu4
 libpcre2-8-0 10.34-7
 libseccomp2 2.4.3-1ubuntu1
 libselinux1 3.0-1build2
 libsemanage-common 3.0-1build2
 libsemanage1 3.0-1build2
 libsepol1 3.0-1
 libssl1.1 1.1.1f-1ubuntu2
 libstdc++6 10-20200411-0ubuntu1
 libsystemd0 245.4-4ubuntu3
 libtalloc2 2.3.0-3ubuntu1
 libtasn1-6 4.16.0-2
 libtevent0 0.10.1-4
 libtext-charwidth-perl 0.04-10
 libtext-iconv-perl 1.7-7
 libtext-wrapi18n-perl 0.06-9
 libudev1 245.4-4ubuntu3
 libunistring2 0.9.10-2
 libwbclient0 2:4.11.6+dfsg-0ubuntu1
 libzstd1 1.4.4+dfsg-3
 openssl 1.1.1f-1ubuntu2
 passwd 1:4.8.1-1ubuntu5
 perl-base 5.30.0-9build1
 tar 1.30+dfsg-7
 ubuntu-keyring 2020.02.11.2
 update-motd 3.6-0ubuntu6
 zlib1g 1:1.2.11.dfsg-2ubuntu1
DistroRelease: Ubuntu 20.04
InstallationDate: Installed on 2014-12-01 (1970 days ago)
InstallationMedia: Xubuntu 14.04.1 LTS "Trusty Tahr" - Release amd64 (20140723)
Package: cifs-utils 2:6.9-1
PackageArchitecture: amd64
ProcCpuinfoMinimal:
 processor : 3
 vendor_id : GenuineIntel
 cpu family : 6
 model : 142
 model name : Intel(R) Core(TM) i7-7600U CPU @ 2.80GHz
 stepping : 9
 microcode : 0xffffffff
 cpu MHz : 2903.999
 cache size : 4096 KB
 physical id : 0
 siblings : 4
 core id : 3
 cpu cores : 4
 apicid : 3
 initial apicid : 3
 fpu : yes
 fpu_exception : yes
 cpuid level : 21
 wp : yes
 flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 s...

[Andreas Hasenack (ahasenack)]

> mount error(2): No such file or directory
> Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)

> $ dmesg
> [ 1410.023973] CIFS: Attempting to mount //de1-user-2/c$
> [ 1410.026724] CIFS VFS: BAD_NETWORK_NAME: \\de1-user-2\c$
> [ 1410.027049] CIFS VFS: cifs_mount failed w/return code = -2

This usually means the share doesn't exist. "c$" in this case. Have you tried with smbclient? Also maybe try the full hostname, and not the netbios name, just in case it's contacting the wrong server.

[Jhair Tocancipa Triana (jhair-tocancipa-j)]

Please find the syslog output if cifs debug enabled below. The share was accessible on Monday 20 at least, I was running focal already, but I've been upgrading regularly. Not sure which package update broke it (I've changed the name of the share below manually):

[ 3555.871083] fs/cifs/cifsfs.c: Devname: //machine/c$ flags: 0
[ 3555.871095] fs/cifs/connect.c: iocharset set to utf8
[ 3555.871109] fs/cifs/connect.c: Domain name set
[ 3555.871111] fs/cifs/connect.c: Username: User
[ 3555.871113] fs/cifs/connect.c: file mode: 0775 dir mode: 0775
[ 3555.871115] fs/cifs/connect.c: CIFS VFS: in mount_get_conns as Xid: 24 with uid: 0
[ 3555.871116] fs/cifs/connect.c: UNC: \\machine\c$
[ 3555.871123] fs/cifs/connect.c: Socket created
[ 3555.871124] fs/cifs/connect.c: sndbuf 16384 rcvbuf 131072 rcvtimeo 0x6d6
[ 3555.872928] fs/cifs/fscache.c: cifs_fscache_get_client_cookie: (0x00000000daf5d217/0x00000000b00cbe0a)
[ 3555.872932] fs/cifs/connect.c: CIFS VFS: in cifs_get_smb_ses as Xid: 25 with uid: 0
[ 3555.872933] fs/cifs/connect.c: Existing smb sess not found
[ 3555.872935] fs/cifs/connect.c: Demultiplex PID: 5488
[ 3555.872937] fs/cifs/smb2pdu.c: Negotiate protocol
[ 3555.872970] fs/cifs/transport.c: Sending smb: smb_len=106
[ 3555.873494] fs/cifs/connect.c: RFC1002 header 0xf8
[ 3555.873498] fs/cifs/smb2misc.c: SMB2 data length 120 offset 128
[ 3555.873499] fs/cifs/smb2misc.c: SMB2 len 248
[ 3555.873531] fs/cifs/transport.c: cifs_sync_mid_result: cmd=0 mid=0 state=4
[ 3555.873537] fs/cifs/misc.c: Null buffer passed to cifs_small_buf_release
[ 3555.873539] fs/cifs/smb2pdu.c: mode 0x3
[ 3555.873540] fs/cifs/smb2pdu.c: negotiated smb2.0 dialect
[ 3555.873543] fs/cifs/asn1.c: OID len = 10 oid = 0x1 0x3 0x6 0x1
[ 3555.873545] fs/cifs/asn1.c: OID len = 7 oid = 0x1 0x2 0x348 0xbb92
[ 3555.873546] fs/cifs/asn1.c: OID len = 7 oid = 0x1 0x2 0x348 0x1bb92
[ 3555.873547] fs/cifs/asn1.c: OID len = 8 oid = 0x1 0x2 0x348 0x1bb92
[ 3555.873548] fs/cifs/asn1.c: OID len = 10 oid = 0x1 0x3 0x6 0x1
[ 3555.873550] fs/cifs/connect.c: Security Mode: 0x3 Capabilities: 0x300001 TimeAdjust: 0
[ 3555.873551] fs/cifs/smb2pdu.c: Session Setup
[ 3555.873552] fs/cifs/smb2pdu.c: sess setup type 4
[ 3555.873559] fs/cifs/transport.c: Sending smb: smb_len=124
[ 3555.873783] fs/cifs/connect.c: RFC1002 header 0x14e
[ 3555.873785] fs/cifs/smb2misc.c: SMB2 data length 262 offset 72
[ 3555.873786] fs/cifs/smb2misc.c: SMB2 len 334
[ 3555.873812] fs/cifs/transport.c: cifs_sync_mid_result: cmd=1 mid=1 state=4
[ 3555.873815] Status code returned 0xc0000016 STATUS_MORE_PROCESSING_REQUIRED
[ 3555.873819] fs/cifs/smb2maperror.c: Mapping SMB2 status code 0xc0000016 to POSIX err -5
[ 3555.873820] fs/cifs/misc.c: Null buffer passed to cifs_small_buf_release
[ 3555.873822] fs/cifs/smb2pdu.c: rawntlmssp session setup challenge phase
[ 3555.873859] fs/cifs/transport.c: Sending smb: smb_len=444
[ 3555.874370] fs/cifs/connect.c: RFC1002 header 0x48
[ 3555.874372] fs/cifs/smb2misc.c: SMB2 data length 0 offset 72
[ 3555.874373] fs/cifs/smb2misc.c: SMB2 len 73
[ 3555.874374] fs/cifs/smb2misc.c: Calculated size 73 length 72 mismatch mid 2
[ 3555.874400] fs/cifs/transport.c: cifs_sync_mid_result: cmd=1 mid=2...

[Jhair Tocancipa Triana (jhair-tocancipa-j)]

Hm. Nevermind I checked with smbclient and the share was actually removed from the Windows box... Maybe by one of the Microsoft upgrades. After sharing it the mounting worked properly. Thanks for the smbclient hint and sorry for the noise.

[Andreas Hasenack (ahasenack)]

Thanks for getting back to us with this info.

I'll close the bug.

[Xavee (xavee)]

Problem is still present in ubuntu 20.04.1 fresh install : keyutils is missing and triggers this error when mounting with cifs:

CIFS VFS: cifs_mount failed w/return code = -2

This error is not explicit at all. It cannot be guessed that a package / software is missing.

Can you please re-open the bug to make keyutils as a dependency of mount.cifs ?

[Andreas Hasenack (ahasenack)]

@xavee, what kind of authentication are you using when mounting the cifs share? Can you also share the last entries of dmesg when you attempted mount fails, and ubuntu details (release, cifs-utils package version, etc).

[Manraj Singh (manrajsingh)]

I can confirm that cifs-utils has a dependency on keyutils package.

I was doing a CIFS mount over NTLM auth and I ran into the following error code on Ubuntu 18.04.5 LTS.

CIFS VFS: cifs_mount failed w/return code = -2

I installed keyutils package and bingo!

[Sebastian Marsching (sebastian-marsching)]

I can also confirm that installing the keyutils package fixes the problem (on Ubuntu 20.04).

[Rosivaldo Correa (rosivaldo-correa)]

In my case the keyutils package did not resolve the issue. I still getting the erro below:

--
CIFS: Attempting to mount //pof-fs08/pgbackups
No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3 (or SMB2.1) specify vers=1.0 on mount.
CIFS VFS: Error connecting to socket. Aborting operation.
CIFS VFS: cifs_mount failed w/return code = -2
--

Any idea how can I fix that?

OS: Ubuntu 20.04
Commands that I tried to mount the share:
1. mount -t cifs -o username=<user>,password=<pwd> //<remove-server/<share-name> <local-directory>
2. mount -t cifs -o vers=1.0,username=<user>,password=<pwd> //<remove-server/<share-name> <local-
2. mount -t cifs -o vers=2.0,username=<user>,password=<pwd> //<remove-server/<share-name> <local-
2. mount -t cifs -o vers=2.1,username=<user>,password=<pwd> //<remove-server/<share-name> <local-
2. mount -t cifs -o vers=3.0,username=<user>,password=<pwd> //<remove-server/<share-name> <local-directory>

I tried to add the options 'sec=ntlm, domain=' without success.

[Rosivaldo Correa (rosivaldo-correa)]

More details about the version of the package that I have installed on my system.
--
cifs-utils 2:6.9-1ubuntu0.1
keyutils 1.6-6ubuntu1

[Rosivaldo Correa (rosivaldo-correa)]

I found the issue in my case. Our network firewall was blocking cifs communication between my server and my storage.