Samba: Access trouble from Windows

I am trying to access an NTFS (ntfs-3g) share from a Windows machine through the Samba 3 on Debian.

I am getting this error on Windows when I try net use command:

System error 5 has occurred.

Access is denied.

, which I am sure is not due to a bad password because that would be

System error 86 has occurred.

The specified network password is not correct.

I have my /etc/samba/smb.conf setup like this under global:

   security = user

and for the share:

  valid users = @users
  force group = users
  create mask = 0777
  directory mask = 0777
  writeable = Yes
  browseable = yes
  guest ok = no

Output of "$ sudo testparm -s" command includes under the specific share:

valid users = %S
force group = users
create mask = 0700
directory mask = 0700

Any clues/hints for what could be going wrong? Please let me know if more information is needed to solve the problem. Thanks.

Solution 1:

The error seems to suggest that no user account exists on the Samba server.

A common oversight is to forget that you need to add a Samba user in addition to a unix user account. So after you've created the unix user account, you need to add the Samba account by issuing the following command:

sudo smbpasswd -a <username>

You can list your existing Samba accounts with:

sudo pdbedit -L

With security = user and Windows clients, if the Windows user account and password is not the same as the Samba user account and password, I find it a bit tricky to predict what credentials Windows will send to the server. To minimise confusion, I tend to set up accounts so that those credentials match.

Also, to minimise variables, you might want to start your troubleshooting on the Debian machine and run smbclient there:

smbclient \\\\<server>\\share --user <username>

You'll be prompted for a password for the user. If that's successful, you'll get the smb client prompt. Issue an "ls" command to get a listing of the share contents. If you can see that, then I'd say Samba is fine, and it's Windows sending unexpected credentials, in which case you can try specifying the credentials to use explicitly in the net use command.