在 Time Machine 中使用 samba 4.9 的问题
Issue using samba 4.9 with Time Machine
TL;DR：Time Machine 无法在我的共享驱动器上创建新 备份，但可以添加到现有 备份。
我是 运行 macOS Catalina，我的 Time Machine 使用 NetAtalk 和 Avahi 备份到 Debian 10 服务器。由于 Mavericks macOS 更喜欢 SMB，并且考虑到 SMB 速度稍快，我决定切换到使用 SMB 进行 Time Machine 共享。在新的 AFP 共享上，我可以在系统偏好设置中启动新的 Time Machine 备份，它会毫无怨言地创建一个新的 .sparseimage。
如果我使用完全相同的目录 (/usr/local/smb)、相同的权限等，并创建 samba 共享，当 Time Machine 尝试创建新备份时它会给出错误："Time Machine couldn’t complete the backup to SERVER.local. The backup disk image could not be created."
如果我先连接到 AFP 共享并进行初始备份，然后我可以连接到 SMB 并添加后续增量备份而不会出错。我以为可能是权限问题，但出于调试目的，我将 /usr/local/smb 设置为 0777，但仍然出现错误。
ls -la 显示共享点的权限：
drwxrwxrwx 5 root smbusers 4096 Apr 3 12:35 smb
我在日志中发现以下可能有用的错误：
Failed to create '/Volumes/.timemachine/SERVER._smb._tcp.local/DDE06691-7411-41DD-8419-24FEFC21CE29/TimeMachine Set A - SMB/8E394711-7E3F-520B-800C-192D4F680177.sparsebundle', results: {
}, error: 13 Permission denied
afp.conf:
[Global]
; Global server settings
vol preset = default_for_all
log file = /var/log/netatalk.log
uam list = uams_dhx2.so,uams_clrtxt.so
save password = no
[default_for_all]
file perm = 0664
directory perm = 0774
cnid scheme = dbd
[Time Machine Set A - AFP]
path = /usr/local/smb
time machine = yes
vol size limit = 4000000
我正在使用 GitHub 中建议的一些 smb.conf 选项：https://gist.github.com/ChloeTigre/4c2022c0d1a281deedba6f7539a2e3ae
smb.conf:
[global]
## Browsing/Identification ###
# Change this to the workgroup/NT-domain name your Samba server will part of
workgroup = WORKGROUP
wins support = yes
#### Debugging/Accounting ####
# This tells Samba to use a separate log file for each machine
# that connects
log file = /var/log/samba/log.%m
# Cap the size of the individual log files (in KiB).
max log size = 1000
# We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.
# Append syslog@1 if you want important messages to be sent to syslog too.
logging = file
# Do something sensible when Samba crashes: mail the admin a backtrace
panic action = /usr/share/samba/panic-action %d
###MacOS compatability stuff
guest account = smbguest
min protocol = SMB2
map acl inherit = yes
vfs objects = catia fruit streams_xattr
fruit:metadata = netatalk
fruit:model = MacSamba
fruit:posix_rename = yes
fruit:veto_appledouble = yes
durable handles = yes
kernel oplocks = no
kernel share modes =no
posix locking = no
smb2 leases = yes
#Turned off for testing compatability
#fruit:wipe_intentionally_left_blank_rfork = yes
#fruit:delete_empty_adfiles = yes
####### Authentication #######
# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller".
#
# Most people will want "standalone server" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
server role = standalone server
obey pam restrictions = yes
# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
unix password sync = yes
# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
pam password change = yes
# This option controls how unsuccessful authentication attempts are mapped
# to anonymous connections
map to guest = bad user
######Security#######
security = user
valid users = @smbusers
username map = /etc/samba/users.map
guest ok = no
# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
usershare allow guests = yes
#======================= Share Definitions =======================
[TimeMachine Set A - SMB]
path = /usr/local/smb
comment = SMB Time Machine Destination Set A
browsable = yes
writeable = yes
create mode = 0664 #tried turning this off, no fix
directory mode = 0777 #tried turning this off, no fix
vfs objects = catia fruit streams_xattr
fruit:aapl = yes
fruit:time machine = yes
#guest ok = yes
fruit:time machine max size = 3.9T #tried turning this off, no fix
inherit acls = yes
正如我得到的如此有用的信息here，问题归结为一个变量。我需要将 fruit:metadata = netatalk 更改为 fruit:metadata = stream。
我想 post 为人们提供一些额外的信息。我目前的工作 smb.conf 如下。请注意，这是在 Debian 10 (Buster) 上，因此密码更改命令之类的东西在其他发行版上会有所不同。另请注意，设置 vfs objects = catia fruit streams_xattr 中模块的顺序非常重要。
# NOTE: Whenever you modify this file you should run the command
# "testparm" to check that you have not made any basic syntactic
# errors.
[global]
workgroup = WORKGROUP
min protocol = SMB2
log file = /var/log/samba/log.%m
max log size = 5000
logging = file
security = USER
panic action = /usr/share/samba/panic-action %d
server role = standalone server
obey pam restrictions = yes
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
username map = /etc/samba/users.map
map to guest = bad user
guest account = XXXYOURGUESTACCOUNT
# Time Machine settings
vfs objects = catia fruit streams_xattr
fruit:model = MacSamba
fruit:advertise_fullsync = true
fruit:metadata = stream
fruit:veto_appledouble = no
#default is yes, not necessary to specify fruit:posix_rename = no
#default is yes, not necessary to specify fruit:zero_file_id = yes
fruit:wipe_intentionally_left_blank_rfork = yes
fruit:delete_empty_adfiles = yes
ea support = yes
#default is yes, not necessary to specify fruit:aapl = yes
# Make share visible to Windows
#Disabled for a Mac-Only network
# lanman auth = no
# ntlm auth = yes
# wins support = yes
# local master = yes
# preferred master = yes
# Allow symlinks
# follow symlinks = yes
# wide links = yes
# unix extensions = no
#======================= Share Definitions =======================
[SHARED DRIVE]
path = /PATH/TO/YOUR/SHARED/FOLDER
valid users = @YOURGUESTUSERGROUP
writable = yes
durable handles = yes
kernel oplocks = no
kernel share modes = no
posix locking = no
vfs objects = catia fruit streams_xattr
#default is yes, not necessary to specify ea support = yes
#default is yes, not necessary to specify browseable = yes
read only = no
inherit acls = yes
fruit:time machine = yes
fruit:metadata = stream
fruit:locking = netatalk
guest ok = yes
[Time Machine]
path = /PATH/TO/YOUR/SHARED/FOLDER
valid users = @YOURGUESTUSERGROUP
writable = yes
durable handles = yes
kernel oplocks = no
kernel share modes = no
posix locking = no
vfs objects = catia fruit streams_xattr
#default is yes, not necessary to specify ea support = yes
browseable = no
read only = no
inherit acls = yes
fruit:time machine = yes
fruit:metadata = stream
fruit:locking = netatalk
fruit:time machine max size = 1.9T
另请注意，使用 Debian 10 构建的 Samba 目前没有对广告 Time Machine 共享的内置支持。通常指定 fruit:time machine = yes 将触发 Samba 通过 Avahi 通告 Time Machine 目的地，但此特定支持不是由 Debian 10 中包含的 Samba 构建的。您需要在 /etc/avahi/services/ 中配置 .service 定义.我在该文件夹中创建了 time_machine_advert.service。您需要重新启动 avahi 以确保它被应用 sudo systemctl restart avahi。我有两个时间机器目的地。通过简单地复制 txt 记录并递增 dkX，即 dk1、dk2 等，可以在单个文件中公布多个
<?xml version="1.0" standalone='no'?><!--*-nxml-*-->
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
<name replace-wildcards="yes">%h</name>
<service>
<type>_adisk._tcp</type>
<txt-record>sys=waMa=0,adVF=0x100</txt-record>
<txt-record>dk0=adVN=SAMBA SHARE NAME EXACTLY,adVF=0x82</txt-record>
<txt-record>dk1=adVN=SAMBA SHARE NAME #2 EXACTLY,adVF=0x82</txt-record>
</service>
<service>
<type>_smb._tcp</type>
<port>445</port>
</service>
</service-group>
此处还有一些关于 Time Machine 的 Samba 配置的其他有用站点：
Samba 团队的 Time Machine 配置官方指南，尽管仅此一项并没有为我提供有效的配置：https://wiki.samba.org/index.php/Configure_Samba_to_Work_Better_with_Mac_OS_X
smb.conf参考：https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html
vfs_fruit（Samba 的 Apple 兼容模块）参考 https://www.samba.org/samba/docs/current/man-html/vfs_fruit.8.html
Ken Murphy 在 GitHub 上的 smb.conf 最终将我推向了边缘并让我的设置工作：https://github.com/KenMurphy/SambaConfigs/blob/master/smb.conf
关于 Debian 的通用 Samba 指南：https://www.antoneliasson.se/journal/time-machine-compatible-samba-on-debian-buster/
TL;DR：Time Machine 无法在我的共享驱动器上创建新 备份，但可以添加到现有 备份。
我是 运行 macOS Catalina，我的 Time Machine 使用 NetAtalk 和 Avahi 备份到 Debian 10 服务器。由于 Mavericks macOS 更喜欢 SMB，并且考虑到 SMB 速度稍快，我决定切换到使用 SMB 进行 Time Machine 共享。在新的 AFP 共享上，我可以在系统偏好设置中启动新的 Time Machine 备份，它会毫无怨言地创建一个新的 .sparseimage。
如果我使用完全相同的目录 (/usr/local/smb)、相同的权限等，并创建 samba 共享，当 Time Machine 尝试创建新备份时它会给出错误："Time Machine couldn’t complete the backup to SERVER.local. The backup disk image could not be created."
如果我先连接到 AFP 共享并进行初始备份，然后我可以连接到 SMB 并添加后续增量备份而不会出错。我以为可能是权限问题，但出于调试目的，我将 /usr/local/smb 设置为 0777，但仍然出现错误。
ls -la 显示共享点的权限：
drwxrwxrwx 5 root smbusers 4096 Apr 3 12:35 smb
我在日志中发现以下可能有用的错误：
Failed to create '/Volumes/.timemachine/SERVER._smb._tcp.local/DDE06691-7411-41DD-8419-24FEFC21CE29/TimeMachine Set A - SMB/8E394711-7E3F-520B-800C-192D4F680177.sparsebundle', results: {
}, error: 13 Permission denied
afp.conf:
[Global]
; Global server settings
vol preset = default_for_all
log file = /var/log/netatalk.log
uam list = uams_dhx2.so,uams_clrtxt.so
save password = no
[default_for_all]
file perm = 0664
directory perm = 0774
cnid scheme = dbd
[Time Machine Set A - AFP]
path = /usr/local/smb
time machine = yes
vol size limit = 4000000
我正在使用 GitHub 中建议的一些 smb.conf 选项：https://gist.github.com/ChloeTigre/4c2022c0d1a281deedba6f7539a2e3ae
smb.conf:
[global]
## Browsing/Identification ###
# Change this to the workgroup/NT-domain name your Samba server will part of
workgroup = WORKGROUP
wins support = yes
#### Debugging/Accounting ####
# This tells Samba to use a separate log file for each machine
# that connects
log file = /var/log/samba/log.%m
# Cap the size of the individual log files (in KiB).
max log size = 1000
# We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.
# Append syslog@1 if you want important messages to be sent to syslog too.
logging = file
# Do something sensible when Samba crashes: mail the admin a backtrace
panic action = /usr/share/samba/panic-action %d
###MacOS compatability stuff
guest account = smbguest
min protocol = SMB2
map acl inherit = yes
vfs objects = catia fruit streams_xattr
fruit:metadata = netatalk
fruit:model = MacSamba
fruit:posix_rename = yes
fruit:veto_appledouble = yes
durable handles = yes
kernel oplocks = no
kernel share modes =no
posix locking = no
smb2 leases = yes
#Turned off for testing compatability
#fruit:wipe_intentionally_left_blank_rfork = yes
#fruit:delete_empty_adfiles = yes
####### Authentication #######
# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller".
#
# Most people will want "standalone server" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
server role = standalone server
obey pam restrictions = yes
# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
unix password sync = yes
# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
pam password change = yes
# This option controls how unsuccessful authentication attempts are mapped
# to anonymous connections
map to guest = bad user
######Security#######
security = user
valid users = @smbusers
username map = /etc/samba/users.map
guest ok = no
# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
usershare allow guests = yes
#======================= Share Definitions =======================
[TimeMachine Set A - SMB]
path = /usr/local/smb
comment = SMB Time Machine Destination Set A
browsable = yes
writeable = yes
create mode = 0664 #tried turning this off, no fix
directory mode = 0777 #tried turning this off, no fix
vfs objects = catia fruit streams_xattr
fruit:aapl = yes
fruit:time machine = yes
#guest ok = yes
fruit:time machine max size = 3.9T #tried turning this off, no fix
inherit acls = yes
正如我得到的如此有用的信息here，问题归结为一个变量。我需要将 fruit:metadata = netatalk 更改为 fruit:metadata = stream。
我想 post 为人们提供一些额外的信息。我目前的工作 smb.conf 如下。请注意，这是在 Debian 10 (Buster) 上，因此密码更改命令之类的东西在其他发行版上会有所不同。另请注意，设置 vfs objects = catia fruit streams_xattr 中模块的顺序非常重要。
# NOTE: Whenever you modify this file you should run the command
# "testparm" to check that you have not made any basic syntactic
# errors.
[global]
workgroup = WORKGROUP
min protocol = SMB2
log file = /var/log/samba/log.%m
max log size = 5000
logging = file
security = USER
panic action = /usr/share/samba/panic-action %d
server role = standalone server
obey pam restrictions = yes
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
username map = /etc/samba/users.map
map to guest = bad user
guest account = XXXYOURGUESTACCOUNT
# Time Machine settings
vfs objects = catia fruit streams_xattr
fruit:model = MacSamba
fruit:advertise_fullsync = true
fruit:metadata = stream
fruit:veto_appledouble = no
#default is yes, not necessary to specify fruit:posix_rename = no
#default is yes, not necessary to specify fruit:zero_file_id = yes
fruit:wipe_intentionally_left_blank_rfork = yes
fruit:delete_empty_adfiles = yes
ea support = yes
#default is yes, not necessary to specify fruit:aapl = yes
# Make share visible to Windows
#Disabled for a Mac-Only network
# lanman auth = no
# ntlm auth = yes
# wins support = yes
# local master = yes
# preferred master = yes
# Allow symlinks
# follow symlinks = yes
# wide links = yes
# unix extensions = no
#======================= Share Definitions =======================
[SHARED DRIVE]
path = /PATH/TO/YOUR/SHARED/FOLDER
valid users = @YOURGUESTUSERGROUP
writable = yes
durable handles = yes
kernel oplocks = no
kernel share modes = no
posix locking = no
vfs objects = catia fruit streams_xattr
#default is yes, not necessary to specify ea support = yes
#default is yes, not necessary to specify browseable = yes
read only = no
inherit acls = yes
fruit:time machine = yes
fruit:metadata = stream
fruit:locking = netatalk
guest ok = yes
[Time Machine]
path = /PATH/TO/YOUR/SHARED/FOLDER
valid users = @YOURGUESTUSERGROUP
writable = yes
durable handles = yes
kernel oplocks = no
kernel share modes = no
posix locking = no
vfs objects = catia fruit streams_xattr
#default is yes, not necessary to specify ea support = yes
browseable = no
read only = no
inherit acls = yes
fruit:time machine = yes
fruit:metadata = stream
fruit:locking = netatalk
fruit:time machine max size = 1.9T
另请注意，使用 Debian 10 构建的 Samba 目前没有对广告 Time Machine 共享的内置支持。通常指定 fruit:time machine = yes 将触发 Samba 通过 Avahi 通告 Time Machine 目的地，但此特定支持不是由 Debian 10 中包含的 Samba 构建的。您需要在 /etc/avahi/services/ 中配置 .service 定义.我在该文件夹中创建了 time_machine_advert.service。您需要重新启动 avahi 以确保它被应用 sudo systemctl restart avahi。我有两个时间机器目的地。通过简单地复制 txt 记录并递增 dkX，即 dk1、dk2 等，可以在单个文件中公布多个
<?xml version="1.0" standalone='no'?><!--*-nxml-*-->
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
<name replace-wildcards="yes">%h</name>
<service>
<type>_adisk._tcp</type>
<txt-record>sys=waMa=0,adVF=0x100</txt-record>
<txt-record>dk0=adVN=SAMBA SHARE NAME EXACTLY,adVF=0x82</txt-record>
<txt-record>dk1=adVN=SAMBA SHARE NAME #2 EXACTLY,adVF=0x82</txt-record>
</service>
<service>
<type>_smb._tcp</type>
<port>445</port>
</service>
</service-group>
此处还有一些关于 Time Machine 的 Samba 配置的其他有用站点：
Samba 团队的 Time Machine 配置官方指南，尽管仅此一项并没有为我提供有效的配置：https://wiki.samba.org/index.php/Configure_Samba_to_Work_Better_with_Mac_OS_X
smb.conf参考：https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html
vfs_fruit（Samba 的 Apple 兼容模块）参考 https://www.samba.org/samba/docs/current/man-html/vfs_fruit.8.html
Ken Murphy 在 GitHub 上的 smb.conf 最终将我推向了边缘并让我的设置工作：https://github.com/KenMurphy/SambaConfigs/blob/master/smb.conf
关于 Debian 的通用 Samba 指南：https://www.antoneliasson.se/journal/time-machine-compatible-samba-on-debian-buster/