3

I am trying to use an Ubuntu computer to set up Samba shares for a lab of Windows computers (Vista Basic and XP). Two of the shares need logins, but one is supposed to be a public share. My problem is that when a Windows computer attempts to login to a public share (without first logging into another share) it prompts for a username/password.

I know that this problem could be solved by setting "security = share" in the smb.conf file, but I have also read that doing so can cause other security problems and that "security = user" is ideally what should be used. I also know that the smb.conf manual states that "security = user" makes Windows authenticate before accessing a share.

So my main question is, is it possible to use "security = user" for a guest share without Windows prompting for login? Or does Samba not make exceptions for guest shares?

Here is my smb.conf file, for reference:

[global]
        workgroup = hsbclib
        server string = %h server (Samba, Ubuntu)
        dns proxy = no
        log file = /var/log/samba/log.%m
        max log size = 1000
        syslog = 0
        panic action = /usr/share/samba/panic-action %d
        obey pam restrictions = yes
        unix password sync = yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        pam password change = yes
        map to guest = bad user
        usershare allow guests = yes
        security = user
        guest ok = yes
        guest account = publicuser
        username map = /etc/samba/smbusers

[printers]
        comment = All Printers
        browseable = no
        path = /var/spool/samba
        printable = yes
        create mask = 0700

[print$]
        comment = Printer Drivers
        path = /var/lib/samba/printers

[mabusclass]
        path = /srv/smb/mabusclass
        writeable = yes
        valid users = mabus, mabusclass

[yearbook]
        path = /srv/smb/yearbook
        writeable = yes
        valid users = yearbook

[public]
        comment = Free Public Storage
        path = /srv/smb/public
        writeable = yes
        guest ok = yes

1 Answer 1

3

From http://blog.realcomputerguy.com/2010/12/samba-and-guest-shares-with-security.html?spref=tw

In a nutshell you need:

  • A username map file.
  • A valid 'nix "guest" user mapped to the Windows guest account ("nobody" in most distros).
  • Proper smb.conf configuration.

In this example our username map file is /etc/samba/smbusers. It maps a 'nix user to a Windows user.

In /etc/samba/smbusers (many distros include this file, but with the default commented out):

nobody = guest

In /etc/samba/smb.conf:

[global]
   ...
   security = user
   Map to guest = Bad User
   username map = /etc/samba/smbusers
   ...
-- no 'valid users =' line --

[theshare]
   ...
   guest ok = yes
-- no 'valid users =' line --
1
  • If the remote computer still asks for password, try checking the samba logs for more info. On a server i had the user nobody returning NT_STATUS_LOGON_FAILURE and ntlm_password_check: NO NT password stored for user nobody, that point me that samba already had a user nobody configured. pdbedit nobody returned a user, confirming that samba was trying to use it instead of the "guest" role for nobody. the fix was removing it from samba: pdbedit -x nobody and everything worked fine
    – higuita
    Oct 16, 2013 at 18:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .