Permission Denied for every share after upgrade to 2:4.7.6+dfsg~ubuntu-0ubuntu2.26

[David Thao]

Our file shares on our samba server was working until last Tuesday, when an unattended upgrade upgraded Samba to 2:4.7.6+dfsg~ubuntu-0ubuntu2.26, we are now at 2:4.7.6+dfsg~ubuntu-0ubuntu2.27 after another upgrade last night.

Environment:
OS: Ubbuntu 18.04.2 LTS
Kernel: 4.15.0-163-generic

################################################

/etc/samba/smb.conf

[global]
  workgroup = DOMAIN
  realm = DOMAIN.AD.DOMAIN
  server string = default
  fruit:aapl = yes
  log file = /var/log/samba/log.%m
  max log size = 5000
  log level = 8

  # Authentication
  server role = standalone server
  security = ADS
  passdb backend = tdbsam
  map to guest = bad user
  interfaces = 10.100.0.100
  hosts allow = 10.0.0.0/8
  dns proxy = no
  bind interfaces only = no
  client signing = yes
  client use spnego = yes
  password server = *
  encrypt passwords = yes
  kerberos method = secrets and keytab

  # Printers
  # Don't load printers
  load printers = no
  printing = bsd
  printcap name = /dev/null
  disable spoolss = yes

  include = /etc/samba/storage1_shares.conf
################################################

/etc/samba/storage1_shares.conf

[Share_one]
  comment = Share_one
  path = /mnt/zpool1/Share_one
  write list =
  create mask = 744
  directory mask = 755
  guest ok = no
  read only = no
  browseable = yes
  printable = no
  writable = yes
  inherit permissions = yes
  inherit acls = yes
  users = @"DOMAIN\group one", @"DOMAIN\group two"
  force group =
  vfs objects = catia fruit streams_xattr
  fruit:resource = xattr
  fruit:encoding = native

################################################

/etc/krb5.conf

[libdefaults]
default_realm = AD.DOMAIN.COM
ticket_lifetime = 24h
renew_lifetime = 7d

[realms]
  AD.DOMAIN.COM = {
    kdc = "dc1.ad.domain.com"
    admin_server = "dc1.ad.domain.com"
  }

[domain_realm]
.ad.domain.com = AD.DOMAIN.COM
ad.domain.com = AD.DOMAIN.COM

[logging]
  Default = FILE:/var/log/krb5.log

################################################

/etc/sssd/sssd.conf

[sssd]
services = nss, pam
config_file_version = 2
domains = AD.DOMAIN.COM

[domain/AD.DOMAIN.COM]
id_provider = ad
access_provider = ad

override_homedir = /home/%d/%u

[nss]
filter_users = user1,user2,user3,user4

################################################

Changes:
Start-Date: 2021-12-07 06:40:49
Commandline: /usr/bin/unattended-upgrade
Upgrade: python-samba:amd64 (2:4.7.6+dfsg~ubuntu-0ubuntu2.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.26), libwbclient0:amd64 (2:4.7.6+dfsg~ubuntu-0ubuntu2.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.26), samba:amd64 (2:4.7.6+dfsg~ubuntu-0ubuntu2.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.26), samba-dsdb-modules:amd64 (2:4.7.6+dfsg~ubuntu-0ubuntu2.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.26), samba-libs:amd64 (2:4.7.6+dfsg~ubuntu-0ubuntu2.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.26), samba-common:amd64 (2:4.7.6+dfsg~ubuntu-0ubuntu2.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.26), samba-vfs-modules:amd64 (2:4.7.6+dfsg~ubuntu-0ubuntu2.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.26), libsmbclient:amd64 (2:4.7.6+dfsg~ubuntu-0ubuntu2.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.26), smbclient:amd64 (2:4.7.6+dfsg~ubuntu-0ubuntu2.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.26), samba-common-bin:amd64 (2:4.7.6+dfsg~ubuntu-0ubuntu2.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.26)
End-Date: 2021-12-07 06:41:02

Problem:
No Domain Users or Administrators are able to access any of the shares any longer. All we get when trying to accessing the drives from our Windows workstations is that we do not have permissions to access the drives.

Additionally from the logs, it looks like domain users and administrators authenticate successfully, so I can see that LDAP / AD Authentication is working. But users are just not able to access files / folders from their clients to the samba shares.

[Paride Legovini (paride)]

Hello David and thanks for this bug report. Version 2:4.7.6+dfsg~ubuntu-0ubuntu2.26 had a regression with the Kerberos authentication, which is fixed in version 2:4.7.6+dfsg~ubuntu-0ubuntu2.27:

-------------------------------------------------------------------------
samba (2:4.7.6+dfsg~ubuntu-0ubuntu2.27) bionic-security; urgency=medium

  * SECURITY REGRESSION: Kerberos authentication on standalone server in
    MIT realm broken
    - debian/patches/bug14922.patch: fix MIT Realm regression in
      source3/auth/user_krb5.c.
-------------------------------------------------------------------------

Can you please try updating to this version and let us know if it fixes (or doesn't fix!) the issue you're facing? Thank you.

[David Thao (davidkongthao)]

Thanks Paride,

Yes, the issue is still occurring after the upgrade to 2:4.7.6+dfsg~ubuntu-0ubuntu2.27.

[Richard Bass (rwb192)]

We are observing the same problem as David in our office, and like David, 2:4.7.6+dfsg~ubuntu-0ubuntu2.27 did NOT fix the issue. Is someone still looking into this?

[David Thao (davidkongthao)]

Hey Paride, we're still experiencing the issue, can we get an update on the status of the fix?

[Christian Ehrhardt  (paelzer)]

As the intended fix for the update-regression by this security fix was now multiple times reported to not help (thanks David and Richard) I have assigned the security-team to have another look and tagged it as regression-update.

[renbag (renbag)]

Winbind is needed for shares to work after samba 4.8.0.
Maybe some similar fix was also introduced in samba 2:4.7.6+dfsg~ubuntu-0ubuntu2.27
See https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1952219/comments/1