Phantom SMB Mount

[jasnw]

This problem is driving me crazy, and I’m hoping someone has seen this before and knows what’s going on. My main system is an old iMac running El Cap, and a few days ago I noticed that a home directory on another computer on my network (running Mojave) was being mounted by some unknown process. After lots of digging I found that whatever is doing the mounting is either the screensaver process or something associated with it. I unmount the directory and it stays unmounted until I start the screensaver, at which point it is immediately (as far as I can tell) remounted. When I first noticed this I was using photos from iPhoto (not Photos) for the screensaver. I switched to one of the Apple-provided image sets, but that didn't change any of this behavior.

As nearly as I can tell, the following four entries from the system.log file are connected with this process. These entries are not found in older system.log files from several months ago when this was not a problem.

Nov 15 09:53:51 XXXX NetAuthSysAgent[33614]: CLIENT SecIdentityCreateWithCertificate(), cert=CERT:"com.apple.idms.appleid.prd.55446c446154517a74733975705567696730564e78513d3d" #2661158395379267918  returned error #-25300 (__AppleIDCopySecIdentityForAppleIDAccount()/AppleIDAuthenticationClient.cpp #1753) com.apple.root.default-qos.overcommit
Nov 15 09:53:51 XXXX NetAuthSysAgent[33614]: NAHSelectionAcquireCredential complete: iakerb BD009603-939D-C840-D5A0-4CAA2C842547 - YYYY: GSSCred: 0x7fd9f0e0cd30 <MC: iakerb YYYY@WELLKNOWN:COM.APPLE.LKDC>
Nov 15 09:53:51 XXXX kernel[0]: smb2fs_smb_cmpd_query: smb2fs_smb_ntcreatex failed 13
Nov 15 09:53:51 XXXX mds[71]: (Volume.Error:880) Root store set to FSOnly with matching create! (loaded:1)

I’ve replaced my computer name with XXXX and the name of the directory being mounted from the other computer with YYYY. The filesystem is mounted as YYYY@ZZZZ._smb._tcp.local/YYYY where ZZZZ is the name of the other computer, which is why I tagged this as a possible SMB issue.

My system.log.X.gz files don’t go back far enough to tell when this started, but initially the attempt to mount failed:

Nov 10 12:13:29 XXXX NetAuthSysAgent[33830]: NAHSelectionAcquireCredential complete: iakerb 1606659A-1C8A-07B7-70D5-84494549F63F - MYEMAIL: GSSCred: 0x7ff11ac25f50 <MC: iakerb com.apple.idms.appleid.prd.LONGSTRING@WELLKNOWN:COM.APPLE.LKDC>
Nov 10 12:13:30 XXXX NetAuthSysAgent[33830]: smb_mount: mount failed to ZZZZ._smb._tcp.local/YYYY, syserr = No such file or directory

Here I’ve replaced my email address by MYEMAIL and a long string by LONGSTRING. This attempt to mount repeated every second or so for about 90 seconds and then quit. For some (other) unknown reason, the mount suddenly started working on 12 November.

Any ideas? My current kludge-around is to run a background job that unmounts this interloper whenever it’s found to be mounted.

Reloaded or upgrading the OS is not an option. I’m trying to hang in there with this old beast until Apple deigns to provide us with a 27” (or larger) Mx iMac.

 

[jasnw]

For whatever it's worth, I believe I fixed this. Assuming ScreenSaver was the problem I looked at my Pictures directory since I use images from iPhoto for this purpose. I do not use Photos, but I found a bloated (almost 1GB) Photos package that had been recently modified. I deleted that package, and deleted the iPhoto preference file for good measure. Screensaver runs fine, iPhoto runs fine, and there's no longer an attempt to mount a directory on a remote machine. Something got crosswise somewhere, but at least I know what to look for should it happen again.