Subject: Server closes connections after "afp_openfork: ad_open: Permission denied"

From: gismo <[email-masked]>
Date: Wed, 08 Mar 2000 16:07:58 +0100

Environment:
    Version 1.4b2+asun2.1.3 (binary RPM privided py SuSE Linux 6.3).
    Configuration: start with -c 20
        atalkd.conf: eth0 -phase 2 -net 0-65534 -addr 65280.228
        afpd.conf: "Blackbox"  -loginmesg "Welcome to BLACKBOX"
-setpassword
    SAMBA on the same machine
    OS: SuSE Linux 6.3 with kernel for IBM Raid5
    MACS: G3, G4, iMac
    MACOS: 8.6
    Software XPress
    Connection: Ethernet 100MBit

Description:
    1st Problem
    afpd - Connections to the server break after the message
afp_openfork: ad_open: Permission denied.
    Sometimes this happens while reading/writing data.

    maybe there are a view lost or corrupted .AppleDouble because we had
a damages HD and where not
    able to rescue all files

    2nd Problem
    the macs report the error-110 when we attempt to close a volume. the
error-window cant be closed -
    we have to restart the mac.

Repeated-By:
    here are the afpd related "/var/log/messages" entrys of a view
hours. i marked the lines where a
    "server_child" exited

-------------------------snip----------------------------
Mar  8 08:04:04 blackbox afpd[6819]: login strauss (uid 503, gid 105)
Mar  8 08:04:17 blackbox afpd[6820]: ASIP session:548(2) from
10.0.3.49:2048(0)
Mar  8 08:04:17 blackbox afpd[3200]: server_child[1] 6820 done
Mar  8 08:04:23 blackbox afpd[6821]: ASIP session:548(2) from
10.0.3.49:2049(0)
Mar  8 08:04:23 blackbox PAM-warn[6821]: service: netatalk [on terminal:
afpd]
Mar  8 08:04:23 blackbox afpd[6821]: login user1 (uid 507, gid 100)
Mar  8 08:11:47 blackbox afpd[6823]: ASIP session:548(2) from
10.0.3.22:2048(0)
Mar  8 08:11:47 blackbox afpd[3200]: server_child[1] 6823 done
Mar  8 08:14:35 blackbox afpd[6824]: ASIP session:548(2) from
10.0.3.50:49154(0)
Mar  8 08:14:35 blackbox afpd[3200]: server_child[1] 6824 done
Mar  8 08:14:43 blackbox afpd[6825]: ASIP session:548(2) from
10.0.3.50:49155(0)
Mar  8 08:14:43 blackbox PAM-warn[6825]: service: netatalk [on terminal:
afpd]
Mar  8 08:14:43 blackbox afpd[6825]: login user1 (uid 507, gid 100)
Mar  8 08:32:51 blackbox afpd[6825]: afp_openfork: ad_open: Permission
denied
Mar  8 09:24:40 blackbox afpd[6791]: dsi_stream_read(-1): Connection
reset by peer
Mar  8 09:24:40 blackbox afpd[6791]: dsi_stream_write: Broken pipe
Mar  8 09:24:40 blackbox afpd[6791]: 18170.71KB read, 319763.84KB
written
Mar  8 09:24:40 blackbox afpd[6791]: dsi_stream_write: Broken pipe
*Mar  8 09:24:40 blackbox afpd[3200]: server_child[1] 6791 exited 1
Mar  8 09:25:06 blackbox afpd[6933]: ASIP session:548(2) from
10.0.3.24:2048(0)
Mar  8 09:25:06 blackbox afpd[3200]: server_child[1] 6933 done
Mar  8 09:25:06 blackbox afpd[6934]: ASIP session:548(2) from
10.0.3.24:2049(0)
Mar  8 09:25:06 blackbox PAM-warn[6934]: service: netatalk [on terminal:
afpd]
Mar  8 09:25:06 blackbox afpd[6934]: login user1 (uid 507, gid 100)
Mar  8 09:36:42 blackbox afpd[6977]: ASIP session:548(2) from
10.0.3.27:2050(0)
Mar  8 09:36:42 blackbox afpd[3200]: server_child[1] 6977 done
Mar  8 09:36:42 blackbox afpd[6978]: ASIP session:548(2) from
10.0.3.27:2051(0)
Mar  8 09:36:42 blackbox afpd[3200]: server_child[1] 6978 done
Mar  8 09:36:46 blackbox afpd[6817]: warning: fixing up broken v1
header.
Mar  8 09:43:03 blackbox afpd[6817]: afp_openfork: ad_open: Permission
denied
Mar  8 09:43:56 blackbox afpd[6817]: afp_openfork: ad_open: Permission
denied
Mar  8 09:49:44 blackbox afpd[6817]: afp_openfork: ad_open: Permission
denied
Mar  8 09:51:12 blackbox afpd[6817]: afp_openfork: ad_open: Permission
denied
Mar  8 10:11:46 blackbox afpd[6817]: afp_openfork: ad_open: Permission
denied
Mar  8 10:14:35 blackbox afpd[6817]: afp_openfork: ad_open: Permission
denied
Mar  8 10:15:58 blackbox afpd[6821]: afp_openfork: ad_open: Permission
denied
Mar  8 10:57:16 blackbox afpd[6817]: afp_openfork: ad_open: Permission
denied
Mar  8 12:05:30 blackbox afpd[8563]: ASIP session:548(2) from
10.0.3.49:2050(0)
Mar  8 12:05:30 blackbox afpd[3200]: server_child[1] 8563 done
Mar  8 12:05:30 blackbox afpd[8564]: ASIP session:548(2) from
10.0.3.49:2051(0)
Mar  8 12:05:30 blackbox afpd[3200]: server_child[1] 8564 done
Mar  8 12:13:44 blackbox afpd[6817]: afp_alarm: child timed out
Mar  8 12:13:44 blackbox afpd[6817]: 2281.00KB read, 516323.61KB written

*Mar  8 12:13:44 blackbox afpd[3200]: server_child[1] 6817 exited 1
Mar  8 12:14:11 blackbox afpd[6934]: logout
Mar  8 12:14:11 blackbox afpd[6934]: 35832.05KB read, 505388.44KB
written
Mar  8 12:14:11 blackbox afpd[3200]: server_child[1] 6934 done
Mar  8 12:15:59 blackbox afpd[6746]: afp_openfork: ad_open: Permission
denied
Mar  8 12:16:25 blackbox afpd[6746]: afp_openfork: ad_open: Permission
denied
Mar  8 12:22:00 blackbox afpd[6821]: afp_alarm: child timed out
Mar  8 12:22:00 blackbox afpd[6821]: 282.65KB read, 911234.69KB written
*Mar  8 12:22:00 blackbox afpd[3200]: server_child[1] 6821 exited 1
Mar  8 12:24:19 blackbox afpd[8596]: ASIP session:548(2) from
10.0.3.27:2048(0)
Mar  8 12:24:19 blackbox afpd[3200]: server_child[1] 8596 done
Mar  8 12:24:34 blackbox afpd[8597]: ASIP session:548(2) from
10.0.3.27:2049(0)
Mar  8 12:24:34 blackbox PAM-warn[8597]: service: netatalk [on terminal:
afpd]
Mar  8 12:24:34 blackbox afpd[8597]: login lorber (uid 501, gid 105)
Mar  8 12:24:39 blackbox afpd[8597]: warning: fixing up broken v1
header.
Mar  8 12:27:15 blackbox afpd[6746]: afp_alarm: child timed out
Mar  8 12:27:15 blackbox afpd[6746]: 7276.22KB read, 76004.46KB written
*Mar  8 12:27:15 blackbox afpd[3200]: server_child[1] 6746 exited 1
Mar  8 12:30:18 blackbox afpd[8637]: ASIP session:548(2) from
10.0.3.28:2048(0)
Mar  8 12:30:18 blackbox afpd[3200]: server_child[1] 8637 done
Mar  8 12:30:25 blackbox afpd[8638]: ASIP session:548(2) from
10.0.3.28:2049(0)
Mar  8 12:30:25 blackbox PAM-warn[8638]: service: netatalk [on terminal:
afpd]
Mar  8 12:30:25 blackbox afpd[8638]: login user1 (uid 507, gid 100)
Mar  8 12:30:53 blackbox afpd[8638]: warning: fixing up broken v1
header.
Mar  8 12:35:56 blackbox afpd[8656]: ASIP session:548(2) from
10.0.3.27:2050(0)
Mar  8 12:35:56 blackbox afpd[3200]: server_child[1] 8656 done
Mar  8 12:35:56 blackbox afpd[8657]: ASIP session:548(2) from
10.0.3.27:2051(0)
-----------------------------------------------------------

Griesmayer Andreas

---

From: Patrik Schindler <[email-masked]>
Date: Wed, 8 Mar 2000 19:56:12 +0100

>    Sometimes this happens while reading/writing data.

First is not replicable here, altough I'm using the same libs as SuSe (but disabled the SuSe autoconf-crap and kicked off pam).
I compiled the same version as you mention by myself.
The disconnect while transferring data is well comprehensible when using Toast to create an image from a folder on a netatalk volume.
I'm using System 7.6.1 with OpenTransport 1.3, AppleShare 3.8.3 on a PowerMac 7600 connected via ingston 100MBit to the Server (Crossover).

>    we have to restart the mac.

Uh! Any description WHAT you are using on the Macs (Versions vom AppleShare, OpenTransport, OS, etc)

>Mar  8 09:24:40 blackbox afpd[6791]: dsi_stream_read(-1): Connection

Perhaps you are suffering from packet loss in your network?

:wq! PoC

---

From: Ove Ruben R Olsen <[email-masked]>
Date: Sun, 19 Mar 2000 23:39:06 +0100

Environment:
	Version netatalk-1.4b2+asun2.1.3
	OS: RedHat 6.2
	Permission on users home-directory: 555

In the home-directory there are 2 sub-directories:  "Private files" and
"Webfiles".

If one of the users try to drag a local directory with contents (files of
other
directories) into "Private files" or "Webfiles" they receive an error
"Can not write to Webfiles due to insuffient rights" (translated from
norwegian MacOS). The funny thing is that the name of the local directory
is indeed created in the sub-directory on the server, but there are no
files tranferred into the new sub-directory.

Trying to create a new sub-directory inside "Webfiles" or "Private files"
produce the same kind of error.

Dragin files into one of these directories produces no errors.

These error happens regardless of version of MacOS.
These error happens regardless of if the users home-directory permissions
is set to 755 instead of 555.

Those two directories ("Webfiles" and "Private files") have 755 as modes
and are owned by the respective users.

/var/log/messages gives Mar 19 23:07:09 localhost afpd[1943]: afp_openfork:
ad_open: Permission denied

The reason for this setup is that we do not want users to create or copy
files directly
into their home-directory.

What kan be done to remedy this situation?

Regards,
\Ruben.

---

From: andrew morgan <[email-masked]>
Date: Sun, 19 Mar 2000 17:07:42 -0800 (PST)

> ad_open: Permission denied

It looks like the permissions on the .AppleDouble directory inside of
Webfiles or Private files are too restrictive.  On my system, these
directories are set 711 and the files inside them are set 600.  There is
also the .AppleDesktop directory, which is in each user's home directory
and is set to 711 permissions.

> into their home-directory.

This should work fine as long as the .Apple* directories are set to allow
the owner write access, but the actual directories containing data aren't
set to allow owner write access.

	Andy

---

From: Ove Ruben R Olsen <[email-masked]>
Date: Mon, 20 Mar 2000 04:01:51 +0100

At 23:39 +0100 on 19.03.00, I wrote:

...

> is set to 755 instead of 555.

...

> ad_open: Permission denied

...

> What kan be done to remedy this situation?

I found the solution to this particular problem:

When RedHat 6.2 creates users with the "adduser" script it will also create
a group for each user (users primary group).

Lets say I have the user "ruben" with "ruben" as primary group. In my process
(automated) when the user was created I also changed ownership of the
home-directory to "ruben.users" (group: users). This is not really according
to RedHats setup.

Apperently netatalk has certain problems with this kind of setup and will give
the errormessage back to the user telling him/her that he/she does not have
the right permission (when in fact (unix-wise) he/she does).

(I even looked at the source trying to find this info.)

The solution was to either
a) Let the users home-directory also have the primary-group as GID
OR
b) Let the all the users have the same GID as their primary

Personally I do consider this a misfeature - afpd should honour the UID on a
given directory and not UID.GID unless specified.

\Ruben.

---

From: Ove Ruben R Olsen <[email-masked]>
Date: Mon, 20 Mar 2000 04:10:50 +0100

> and is set to 711 permissions.

Thank you for your insight - really appreciated. Remind me to pay you
a beer (or softdrink if you so prefeer instead) if you plan to visit the
western parts of Norway ;-)

For my solution - see my other message in  this thread.

During my initial setup I had no .AppleDesktop  in the (test-)users directory
and everything seemed fine during file-operations. The directory was
(as now) read-only for the users. When my /var/log/messages filled with
errors I did create the directory and the errors went away.

The .AppleDouble directory is indeed created by the users when the first
access (copy/create) files in the sub-directories so the permission should
be fine here (which they apparently is after changeing group-ownership).

I have one questions conserning the .AppleDesktop directory:
What is the purpose of this directory?
What is stored in this directory other thant information about
Icons (as far as I can tell)?

Thanks in advance.

\Ruben.

---

From: Makoto Fujiwara <[email-masked]>
Date: Sat, 19 Aug 2000 16:37:54 +0900

First of all, netatalk + asun version is terrific.
I am kind of Unix and Mac enthusiast and this software is
one of stuff which is can-not-live-without-this-software,
like AIR.

Thanks for folks supporting this software up-to-date.

By the way,I am using and installing 
pre-asun2.1.4-39_test.tar.gz
version onto NetBSD/macppc, NetBSD/sparc machines.
I have little problem on those. But before actually sending 
problem report, let me make sure the mailing list is alive.

Are you there ?

-- list ---
+ I needed to add -f /etc/atalkd.conf on atald starting.
+ I have no idea for the location of sytem default files.
    ./config/AppleVolumes.default
    ./config/AppleVolumes.system
  to be placed.

+ NetBSD/sparc 1.4.1  MacOS 9.0.4, MacOS 8.5
  User can mount the folder, but soon the opened folder window
  get empty screen.

+ NetBSD/macppc 1.5_ALPHA, 1.4V
  minor change required sys/netbsd/Makefile
---
(Makoto Fujiwara)

---

From: Marc Miller <[email-masked]>
Date: Sat, 19 Aug 2000 06:43:15 -0700 (PDT)

Yes; the list is most certainly alive.  I've noticed the default location
of config files seems to vary.  Try looking in /usr/local/atalk/etc for
the AppleVolumes.* files.

Could someone who has a NetBSD machine see if they can reproduce what is
reported below and add it to the bug list (at
http://sourceforge.net/projects/netatalk) if it's something that needs to
be fixed in the next release?  I figure even a non-developer can do that
much.  :)

It sounds like most of it would be taken care of by the
"configure" script when it's complete, but I don't know about the open
folder -> empty screen problem.

>   minor change required sys/netbsd/Makefile

============================================================
	/\/\arc ._|. /\/\iller ([email-masked])
	Computer Room Consultant
	Information Technology/Lab Management
============================================================
I can be contacted through the Communication Center link from
http://www.mother.com/~mjmiller/

---

From: Fred Jensen <[email-masked]>
Date: Sat, 19 Aug 2000 10:18:36 -0400

Hello,

I'm not completely sure my problem is netatalk-related, it could be an
issue with the Great Plains Software (GPS) but I'm checking here to see
if anyone has run into it before, or even if anyone else is successfully
running GPS on netatalk.

Our accounting department uses Great Plains Accounting, v7.25 on
Macintosh. The client/server version of GPS uses a client-side
application, with the data files residing on the server. There is no
server-side application. In the past, I've successfully upgraded their
server (from Mac to Mac) merely by copying all the data files to the new
server, with no problems.

I recently tried to move them to a Windows box running RedHat 6.1 with
netatalk-1.4b2+asun2.1.3-8.i386.rpm installed. All the files were copied
from the old server to the new one through the Appletalk share.
Everything works fine (much faster!) except for 'master posts' to the
'AR' module. The posting fails with a GPS error message saying 'Access
denied - you must post in a multi-user environment'. In every other way
GPS is running multi-user, and the posts work fine in the other modules.

I've tried changing the Appleshare settings to every combination I can
think of, from the default settings to specific user and group settings
for Applevolumes.default and afpd.conf. I've changed all the privileges
to 775. I've checked every data file for possible corruption and redone
the file transfer several times - I can't find anything that may be
causing this.

Is anyone out there running Great Plains Accounting successfully? If so,
can you give me any hints?

Thanks.

Fred

---

From: a sun <[email-masked]>
Date: Sat, 19 Aug 2000 15:54:11 -0700

>   User can mount the folder, but soon the opened folder window

i'm pretty sure this is happening because i tried fixing directory
ids. unfortunately, it looks like the hash i chose wasn't the
greatest. i'll look into that.

-a

---

From: Fred Jensen <[email-masked]>
Date: Thu, 24 Aug 2000 09:52:47 -0400

For what it's worth, I seem to have solved the problem by doing a clean
install with the latest of asun's versions - 'pre-asun2.1.4-39_test.tar'

-- 
Fred