Sun Storage 7000 Unified Storage System: Some SMB (Windows) shares are inaccessible

Asset ID:	1-72-1439662.1
Update Date:	2012-07-09
Keywords:

Solution Type Problem Resolution Sure

Solution 1439662.1 : Sun Storage 7000 Unified Storage System: Some SMB (Windows) shares are inaccessible

Applies to:

Sun ZFS Storage 7320 - Version Not Applicable to Not Applicable [Release N/A]
Sun Storage 7110 Unified Storage System - Version Not Applicable to Not Applicable [Release N/A]
Sun Storage 7310 Unified Storage System - Version Not Applicable to Not Applicable [Release N/A]
Sun Storage 7210 Unified Storage System - Version Not Applicable to Not Applicable [Release N/A]
Sun ZFS Storage 7420 - Version Not Applicable to Not Applicable [Release N/A]
7000 Appliance OS (Fishworks)

Symptoms

Attempting to access one or more shares on the appliance results in failure and access denied message, other shares can be accessed without issue.

Cause

Either misconfigured Share ACL settings, or a known software issue with the display of Share ACLs that blocks access to the share even when correctly configured.

Known issue: <Sunbug:7029157> P2 kit/lookandfeel SMB share can be created with incorrect ACL type from BUI.

I don't believe the current bug description and classification is accurate. In a nutshell, the share ACL can get into an unintended restrictive state while the BUI displays the default Everyone / Full Control. I'm also not sure it is entirely fixed, despite the software solution for the above. (3/22/2012, WH)

Solution

First check the Share ACL in the Share/Protocols screen:

If this is set to anything other than Everyone / Allow / Full Control, change it to this setting. If it's already configured to these settings, do this instead:

Change settings to Named User / root / Allow / Modify

Apply changes

Change settings back to Everyone / Allow / Full Control

Apply changes

Also, you may be able to determine definitively whether you have a problem with share ACLs by checking the system log. If possible, repeat the error so that you can locate the message within the first few pages of the log. Access the log in the BUI by navigating to Maintenance/Logs and selecting System. If denied access due to the share ACL, you should see a message similar to this:

Jan 22 11:08:03 server1 smbsrv: [ID 138215 kern.notice] NOTICE: smbd[DOMAIN\user]: share1 access denied: share ACL

Better way to check/fix this issue for those with access to the Solaris shell:

check:



ls -V /export/sharename/.zfs/shares



example of non-optimal result:



nas-server# ls -V .zfs/shares

total 1

-rwx------+ 1 root root 0 Dec 19 23:02 sharename

owner@:rwxpd-aARWc--s:-------:allow



example of optimal result:



nas-server# ls -V .zfs/shares

total 1

-rwxrwxrwx+ 1 root root 0 Dec 19 23:02 sharename

everyone@:rwxpdDaARWcCos:-------:allow



fix:



chmod A=everyone@:full_set:fd:allow /export/sharename/.zfs/shares/sharename

Attachments

This solution has no attachment