Centrify

Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-2139: Access denied when browsing symlinks outside the Samba share.

12 April,16 at 11:02 AM

Applies to:
Centrify-Enabled samba 3.5.5-cdc-4.5.0-450 or above on Redhat Linux

Problems:
After upgrading to Centrify-Enabled Samba, the user cannot browse any symlinks outside the share and the prompt returns "Access Denied".

The following can be found in the samba log:

===

    [2011/09/07 11:18:29.204622,  2] smbd/vfs.c:967(check_reduced_name)
    [2011/09/07 11:18:29.204627, 10] ../lib/util/util.c:278(_dump_data)
      smb_vwv[ 2]=    0 (0x0)
      smb_vwv[ 3]=    2 (0x2)
      check_reduced_name: Bad access attempt: log/desktop.ini is a symlink outside the share pat
    seems like the wide links parameter does not work
.
.
.
    [2011/09/07 11:18:54.722166,  0] param/loadparm.c:9924(widelinks_warning)
      Share 'public' has wide links and unix extensions enabled. These parameters are incompatible. Wide links will be disabled for this share.

===

Cause:
This is caused by a security release where the "wide links" parameter is conflicting with the "unix extensions" parameter.

Resolution:
In /etc/samba/smb.conf, set:

unix extensions = no

And set:

wide links = yes

under the share section.

Restart samba with:

/etc/init.d/centrifydc-samba restart


Reference:
https://bugzilla.samba.org/show_bug.cgi?id=7756

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.

Related Articles

 articleKB-20210: Common Questions Regarding Centrify DirectControl and CoreOS articleKB-6041: How to show current license type in use by adclient articleKB-6040: How to change the license type in use after adclient successful joined to the AD? article[How To] Enable Symantec VIP MFA for Centrify Server Suite on Linux Part I articleKB-6073: How to join the Linux/Unix Centrify Server to Active Directory with specific Computer Role? articleKB-6056: How to report the group policy settings that are in effect for the local computer? articleKB-1570: Access Denied to samba share when 'force user' defined articleKB-6038: How to specify the license type to use when joining the server to AD using adjoin? articleKB-10577: Get NT_STATUS_ACCESS_DENIED error when try to list files after connecting to samba share