Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I was recently interested in allowing the guest account network access as related to a research project I was doing.

This was on a Windows Server OS.

The outcry was amazing....people freaking out and saying how insecure it is and how there just had to be a better way regardless of my needs or wants.

Apparently it's such a bad idea that under no circumstances should the question even be asked.

This seems like FUD

Looking around on the net the solution given when other people have asked around was to make a limited user account instead. Now, this seems like a worse solution.

If for whatever reason (and there are many, trying to answer for a specific reason does not help anyone, nor the community) someone is determined to have a guest account for anonymous access on a Server OS, is it not better that they use the built in guest account?

A limited account created for the exact same purpose will be used the exact same way, except that the built in guest account is already locked down to a far greater degree. Indeed, using the built in guest account with network access would seem to be more secure than creating a limited account for the same purpose.

So, why is trying to enable network access for the built in guest account considered so insecure, and why does it evoke such panic and FUD?

edit: To be clear I am referring to having the guest account initiate network connection from the machine while logged in, not using the guest account to access anything remotely

share|improve this question
    
What exactly do you mean? A guest accessible a shared folder? –  The Digital Ninja Nov 12 '10 at 2:44
    
To be fair - your previous two deleted questions were about giving the Guest account the ability to join arbitrary wireless networks. That's a vastly different ballgame than just allowing Guest network access as you state above. Once again, I understand your frustration, but please try and be open and honest when making complaints about the community. –  EEAA Nov 13 '10 at 1:49
1  
ErikA, no, I never mentioned arbitrary wireless networks anywhere in my question. I simply asked how to allow the guest account to join a network, any network wireless or cabled. If the comments read join a network as 'arbitrary wireless network' that would explain the behavior I described. Even so, there is no excuse for marking a clearly on-topic question as off-topic because you disagree with it. People could have provided an answer and the community could have benefited from the discussion. Closing it accomplishes nothing. –  user47587 Nov 13 '10 at 7:37
    
Okay, well then I must be remembering incorrectly. I view the fact that it was closed as "off-topic" as an unfortunate consequence of a limited number of of options to pick from when voting to close. Off-topic gets used as a de-facto catch-all at times when none of the other options are appropriate. I do think that your question is on-topic, but unfortunately, as Robert suggested below, I usually choose to not enable what I see as non-optimal infrastructure choices, whether in production or not. –  EEAA Nov 13 '10 at 16:46

1 Answer 1

The purpose of the Guest account is to control anonymous access to some OS facilities. If I wanted to allow anonymous access to, say, an SMB share, I'd enable the Guest account,

Enabling the account in changes the behavior of the OS. Guest is a user account, but its enabled/disabled status acts as a flag that says "Hey-- when this account is enabled allow anybody with any credentials to authenticate as this context."

The "FUD" comes from Microsoft's historically bad handling of security and allowing anonymous users unnecessarily broad access, by default, in older versions of the OS. Even though Windows Server 2003 and newer versions of Windows do a much better job with this the community is still a little gun-shy.

To my mind there's nothing wrong with using the OS built-in Guest account for its intended purpose.

Personally I'd tend to be against using anonymous SMB file sharing. I'd export the files you want to share with HTTP or, if they needed to be read/write, WebDAV. I tend to think that writeable folders with anonymous access enabled are irresponsible to host.

Edit:

If you want "Guest" to access a shared folder via SMB in a Windows Server OS's (W2K3 and W2K8 flavors) then you'd want to:

  • "Enable" the "Guest" account from "Local User and Groups"
  • Add either the "Guest" user or the "Guests" group with the desired permissions (hopefully read-only) to the ACL on the shared folder

The "Users" and "Authenticated Users" built-in groups don't contain "Guest" (though "Everyone" does) so most default folder ACLs won't allow Guest access. I'd add "Guests" explicitly, rather than "Everyone", so that it's visually very clear that I've allowed "Guests" access to this folder. (You don't have to use the group "Guests" but, generally it's better to use groups in permissions rather than individual users. When you're joined to be a domain be aware that "DOMAIN\Domain Guests" is nested into your computer's local "Guests" group, though.)

share|improve this answer
2  
For the benefit of those who are unaware, that poor security record mainly stems from Windows having evolved out of a single user, single tasking operating system. In that situation OS security just doesn't matter and was therefore always an afterthought. In most earlier versions of Windows security was handled with more after than thought. –  John Gardeniers Nov 12 '10 at 3:05
1  
So then, in your opinion, asking how to enable network access on the built in guest account would not be a security risk? I tried that and got told strongly by various people it was a security risk -- of course they couldn't say how and simply closed the question, bizarrely, as off-topic. –  user47587 Nov 12 '10 at 3:07
1  
Zoredache, I deleted the question after it was closed. I was very very frustrated. It was voted down almost immediately and then closed as off topic. All I asked was how to enabled the built in guest account the ability to join a network. Nothing else. People then started asking why I wanted that (which is irrelevant, and self-righteous to insist) and insisted there was a better way. I said I wanted to know how to do that, and then it got closed as off topic. I could open the question again and show you the same responses, but that probably isn't wise. –  user47587 Nov 12 '10 at 3:49
2  
@John Gardeniers: I'll take a little umbrage to the "single user, single tasking" statement. I think that Microsoft (and, in general the PC culture of the time) wasn't geared toward secure design and implementation practices. "NT", as designed by David Cutler and his team, certainly did come from a background of secure, solid design (DEC VMS). Bolting "Windows" onto "NT", though, brought a lot of baggage from the rest of Microsoft's culture. Give "Showstopper" (goo.gl/AW7sk) a read sometime. It's got some great insight into the beginnings of "NT". –  Evan Anderson Nov 12 '10 at 4:12
4  
@Jacob People then started asking why I wanted that (which is irrelevant, and self-righteous to insist) - yes and no. I can see why it might feel inappropriate to you, but people here don't have to answer questions, and many people here have a code of ethics that won't allow them to provide what they think of as fundamentally bad advice. Think of it as a doctor, who when asked "how do I wrap even more bandages around my bleeding arm", replies "perhaps instead of doing that, I should be helping you stop the wound from bleeding in the first place" –  RobM Nov 12 '10 at 15:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.