Mount CIFS - permission denied

I try to mount a folder shared by Windows 10. The Win10 client is part of a corporate domain. The user login is also part of the domain (local users are forbidden by domain policy). Using smbclient , the folder can be accessed without problem:

user@NAS:~$ smbclient //server/folder -A /logincred
Domain=[DOMAIN] OS=[] Server=[]
smb: \>

The login credentials file has the following format:

username=USER
password=********
domain=DOMAIN

When trying to mount the same folder, using the same credentials file I get a permission error:

fd_admin@FDNAS:~$sudo mount -t cifs //server/folder /mnt/smbshare -o vers=3.0,credentials=/.logincred --verbose
Password:
domain=DOMAIN
mount.cifs kernel mount options: ip=[IP],unc=\\server\folder,vers=3.0,user=USER,,domain=DOMAIN,pass=********
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

The kernel log is not giving more information:

NAS kernel: [2513666.498825] CIFS VFS: Send error in SessSetup = -13
NAS kernel: [2513666.504632] CIFS VFS: cifs_mount failed w/return code = -13

user, domain and password are correctly displayed in the mount.cifs printout. I also tried the sec parameter with all posibilities. SMB v1 is blocked on the server.

• Kernel Version - 3.10.105
• mount.cifs version: 5.5

Any ideas why smbclient works but mounting fails?

[UPDATE]

SMBclient version : 4.4.16

I don't know if the server requires SMB encrytion. How can I find out if it does?

Here is the requested verbose printout. -d auth:7 does not work for me so I did the -d 7 as below:

admin@NAS:~$ smbclient //server/folder -d 7 -A /logincred
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Cannot opendir for custom conf
Processing section "[global]"
Can't find include file /var/tmp/nginx/smb.netbios.aliases.conf
/etc/samba/smb.reserved.conf not found
Cannot opendir for custom conf
find syno address: [0]: XXX.YYY.196.21 [1]: VVV.ZZZ.126.36 [2]: VVV.ZZZ.3.29 [3]: VVV.ZZZ.19.246
added interface ovs_eth0 ip=XXX.YYY.196.21 bcast=XXX.YYY.199.255 netmask=255.255.252.0
added interface ovs_eth2 ip=VVV.ZZZ.3.29 bcast=VVV.ZZZ.255.255 netmask=255.255.0.0
added interface ovs_eth3 ip=VVV.ZZZ.19.246 bcast=VVV.ZZZ.255.255 netmask=255.255.0.0
added interface ovs_eth1 ip=VVV.ZZZ.126.36 bcast=VVV.ZZZ.255.255 netmask=255.255.0.0
Client started (version 4.4.16).
tdb(/run/samba/gencache.tdb): tdb_open_ex: could not open file /run/samba/gencache.tdb: Permission denied
resolve_hosts: Attempting host lookup for name SERVER<0x20>
Connecting to XXX.YYY.200.189 at port 445
Doing spnego session setup (blob length=120)
got OID=1.3.6.1.4.1.311.2.2.30
got OID=1.2.840.48018.1.2.2
got OID=1.2.840.113554.1.2.2
got OID=1.2.840.113554.1.2.2.3
got OID=1.3.6.1.4.1.311.2.2.10
got principal=not_defined_in_RFC4178@please_ignore
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
gensec_update [NT_STATUS_MORE_PROCESSING_REQUIRED]
Got challenge flags:
Got NTLMSSP neg_flags=0x62898215
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088215
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088215
gensec_update [NT_STATUS_MORE_PROCESSING_REQUIRED]
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088215
gensec_update [NT_STATUS_OK]
Domain=[DOMAIN] OS=[] Server=[]
smb: \>

1 Answer

It took quite some time, but it turned out that this behavior is linked to the fact that //server is infact a DFS-Namespace. Mount-CIFS obviously cannot handle this.

The solution is to only mount "folders with targets" as described in this Microsoft document, and then use the actual folder targets directly. In Windows they can be viewed in the folder properties at "DFS". Just select an active one from the list.