Cifs mount fails when DFS referrals are used by server, keyutils needed

[Karsten Schwinne]

I am trying to mount a Windows server 2003 share using a command like this in our enterprise network:

mount.cifs //winserver/someshare/somedirectory /mymount -o user=myuser,dom=ourdomain

However I get the following error code on the command line:

mount error(11): Resource temporarily unavailable

In the syslog I see

Dec 7 12:34:20 pc1471 kernel: [ 5442.667417] CIFS VFS: dns_resolve_server_name_to_ip: unable to resolve: server323
Dec 7 12:34:20 pc1471 kernel: [ 5442.667423] CIFS VFS: cifs_compose_mount_options: Failed to resolve server part of \\server323\fsfds to IP: -11
Dec 7 12:34:20 pc1471 kernel: [ 5442.667831] CIFS VFS: cifs_mount failed w/return code = -11

Browsing the share with smbclient works fine, mounting via gnome desktop does not work either.

After doing a

apt-get install keyutils

the mount command works ok (now cifs.upcall is used for DNS resolving).

So one solution would be to add a dependency for keyutils to the cifs packages.

[Etienne Goyer (etienne-goyer-outlands)]

It is worth noting that smbfs already Suggests keyutils. I am not sure it should be made a Depends, tough. Kerberos authentication is only one possible mechanism, and already requires setting up Kerberos.

Maybe the requirement for keyutils could be documented in a README.Debian?

[Chuck Short (zulcss)]

Which version of samba is this with?

Regards
chuck

[Karsten Schwinne (kschwinne)]

Here is some version information

kschwinne@pc1471:~$ uname -a
Linux pc1471 2.6.31-15-generic-pae #50-Ubuntu SMP Tue Nov 10 16:12:10 UTC 2009 i686 GNU/Linux
kschwinne@pc1471:~$ mount.cifs --version
mount.cifs version: 1.12-3.4.0
kschwinne@pc1471:~$ smbclient --version
Version 3.4.0
kschwinne@pc1471:~$

[Se6 (se6astien)]

I also think that package smbfs should depend on keyutils. Suggesting it is not enough. Many people installing smbfs will connect to DFS, and that won't work without keyutils installed. That is the cause of bug#134080:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/134080

Seb.

[Thierry Carrez (ttx)]

I think keyutils should be recommended.

@Etienne: re: "Kerberos authentication is only one possible mechanism, and already requires setting up Kerberos.". What are the other mechanisms ? Should we recommend a virtual that would be provided by keyutils ? What would be the downside of having keyutils installed ?

[Etienne Goyer (etienne-goyer-outlands)]

Thierry: I cannot think of a downside to having keyutils installed.

mount.cifs can authenticate using NTLM. In fact, this is the default. Kerberos authentication for CIFS mount is only really used in Active Directory context. In that use-case, the administrator of the machine mounting a CIFS share already had to do something (join the AD and/or configure Kerberos), hence my earlier comment.

However, making keyutils a Recommends of smbfs make sense to me. I would go for that, as it would simplify the process. Here's for a Server paper cut right there!

[Launchpad Janitor (janitor)]

This bug was fixed in the package samba - 2:3.4.3-2ubuntu2

---------------
samba (2:3.4.3-2ubuntu2) lucid; urgency=low

  * debian/rules, debian/samba.if-up: allow "NetworkManager" as a recognized address
    family... it's obviously /not/ an address family, but it's what gets
    sent when using NM, so we'll cope for now. (LP: #462169). Taken from karmic-proposed.
  * debian/control: Recommend keyutils for smbfs (LP: #493565)
  * debian/patches/series, debian/patches/fix-too-many-open-files.patch: Windows 7 needs
    the Windows server open file handle number of 16384 handles. (LP: #462172)
 -- Chuck Short <email address hidden> Tue, 19 Jan 2010 12:54:46 -0500