title: Issue using samba 4.9 with Time Machine
body: <p>TL;DR: Time Machine cannot create a <em>new</em> backup on my shared drive, but can add to an <em>existing</em> backup.</p>
  
  <p>I'm running macOS Catalina and my Time Machine backs up to a Debian 10 server with NetAtalk and Avahi. Since Mavericks macOS has preferred SMB, and given SMB is marginally faster I decided to switch to using SMB for the Time Machine shares. On a fresh AFP share I can start a new Time Machine backup in System Preferences and it will create a new .sparseimage without complaint. </p>
  
  <p>If I use the exact same directory (/usr/local/smb), so same permissions etc, and create a samba share, when Time Machine attempts to create a new backup it give the error: "Time Machine couldn’t complete the backup to SERVER.local. The backup disk image could not be created."</p>
  
  <p>If I first connect to the share with AFP and do the initial backup, I can then connect with SMB and add subsequent incremental backups without error. I thought maybe a permissions issue, but for debugging purposes I have /usr/local/smb set to 0777 and still get the error.</p>
  
  <p><code>ls -la</code> showing permissions of the share point:</p>
  
  <pre><code>drwxrwxrwx  5 root smbusers 4096 Apr  3 12:35 smb
  </code></pre>
  
  <p>I find the following possibly helpful error in the log:</p>
  
  <pre><code>Failed to create '/Volumes/.timemachine/SERVER._smb._tcp.local/DDE06691-7411-41DD-8419-24FEFC21CE29/TimeMachine Set A - SMB/8E394711-7E3F-520B-800C-192D4F680177.sparsebundle', results: {
  }, error: 13 Permission denied
  </code></pre>
  
  <p>afp.conf:</p>
  
  <pre><code>[Global]
  ; Global server settings
  vol preset = default_for_all
  log file = /var/log/netatalk.log
  uam list = uams_dhx2.so,uams_clrtxt.so
  save password = no
  
  [default_for_all]
  file perm = 0664
  directory perm = 0774
  cnid scheme = dbd
  
  [Time Machine Set A - AFP]
  path = /usr/local/smb
  time machine = yes
  vol size limit = 4000000
  </code></pre>
  
  <p>I'm using some smb.conf options suggested in this GitHub: <a href="https://gist.github.com/ChloeTigre/4c2022c0d1a281deedba6f7539a2e3ae" rel="nofollow noreferrer">https://gist.github.com/ChloeTigre/4c2022c0d1a281deedba6f7539a2e3ae</a></p>
  
  <p>smb.conf:</p>
  
  <pre><code>[global]
  
  ## Browsing/Identification ###
  
  # Change this to the workgroup/NT-domain name your Samba server will part of
     workgroup = WORKGROUP
     wins support = yes
  
  #### Debugging/Accounting ####
  
  # This tells Samba to use a separate log file for each machine
  # that connects
     log file = /var/log/samba/log.%m
  
  # Cap the size of the individual log files (in KiB).
     max log size = 1000
  
  # We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.
  # Append syslog@1 if you want important messages to be sent to syslog too.
     logging = file
  
  # Do something sensible when Samba crashes: mail the admin a backtrace
     panic action = /usr/share/samba/panic-action %d
  
  ###MacOS compatability stuff
  guest account = smbguest
  min protocol = SMB2
  map acl inherit = yes
  vfs objects = catia fruit streams_xattr  
  fruit:metadata = netatalk
  fruit:model = MacSamba
  fruit:posix_rename = yes 
  fruit:veto_appledouble = yes
  
  durable handles = yes
  kernel oplocks = no
  kernel share modes =no
  posix locking = no
  smb2 leases = yes
  
  
  #Turned off for testing compatability
  #fruit:wipe_intentionally_left_blank_rfork = yes 
  #fruit:delete_empty_adfiles = yes 
  
  ####### Authentication #######
  
  # Server role. Defines in which mode Samba will operate. Possible
  # values are "standalone server", "member server", "classic primary
  # domain controller", "classic backup domain controller", "active
  # directory domain controller". 
  #
  # Most people will want "standalone server" or "member server".
  # Running as "active directory domain controller" will require first
  # running "samba-tool domain provision" to wipe databases and create a
  # new domain.
     server role = standalone server
  
     obey pam restrictions = yes
  
  # This boolean parameter controls whether Samba attempts to sync the Unix
  # password with the SMB password when the encrypted SMB password in the
  # passdb is changed.
     unix password sync = yes
  
  # For Unix password sync to work on a Debian GNU/Linux system, the following
  # parameters must be set (thanks to Ian Kahan &lt;&lt;kahan@informatik.tu-muenchen.de&gt; for
  # sending the correct chat script for the passwd program in Debian Sarge).
     passwd program = /usr/bin/passwd %u
     passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
  
  # This boolean controls whether PAM will be used for password changes
  # when requested by an SMB client instead of the program listed in
  # 'passwd program'. The default is 'no'.
     pam password change = yes
  
  # This option controls how unsuccessful authentication attempts are mapped
  # to anonymous connections
     map to guest = bad user
  
  ######Security#######
  security = user
  valid users = @smbusers
  username map = /etc/samba/users.map
  guest ok = no
  
  # Allow users who've been granted usershare privileges to create
  # public shares, not just authenticated ones
     usershare allow guests = yes
  
  #======================= Share Definitions =======================
  
  [TimeMachine Set A - SMB]
  path = /usr/local/smb
  comment = SMB Time Machine Destination Set A
  browsable = yes
  writeable = yes
  create mode = 0664     #tried turning this off, no fix
  directory mode = 0777  #tried turning this off, no fix
  vfs objects = catia fruit streams_xattr
  fruit:aapl = yes
  fruit:time machine = yes
  #guest ok = yes
  fruit:time machine max size = 3.9T  #tried turning this off, no fix
  inherit acls = yes
  </code></pre>