Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to use an Ubuntu computer to set up Samba shares for a lab of Windows computers (Vista Basic and XP). Two of the shares need logins, but one is supposed to be a public share. My problem is that when a Windows computer attempts to login to a public share (without first logging into another share) it prompts for a username/password.

I know that this problem could be solved by setting "security = share" in the smb.conf file, but I have also read that doing so can cause other security problems and that "security = user" is ideally what should be used. I also know that the smb.conf manual states that "security = user" makes Windows authenticate before accessing a share.

So my main question is, is it possible to use "security = user" for a guest share without Windows prompting for login? Or does Samba not make exceptions for guest shares?

Here is my smb.conf file, for reference:

[global]

    workgroup = hsbclib
    server string = %h server (Samba, Ubuntu)
    dns proxy = no
    log file = /var/log/samba/log.%m
    max log size = 1000
    syslog = 0
    panic action = /usr/share/samba/panic-action %d
    obey pam restrictions = yes
    unix password sync = yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    pam password change = yes
    map to guest = bad user
    usershare allow guests = yes
    security = user
    guest ok = yes
    guest account = publicuser
    username map = /etc/samba/smbusers

[printers]

    comment = All Printers
    browseable = no
    path = /var/spool/samba
    printable = yes
    create mask = 0700

[print$]

    comment = Printer Drivers
    path = /var/lib/samba/printers

[mabusclass]

    path = /srv/smb/mabusclass
    writeable = yes
    valid users = mabus, mabusclass

[yearbook]

    path = /srv/smb/yearbook
    writeable = yes
    valid users = yearbook

[public]

    comment = Free Public Storage
    path = /srv/smb/public
    writeable = yes
    guest ok = yes
share|improve this question
add comment

1 Answer 1

From http://blog.realcomputerguy.com/2010/12/samba-and-guest-shares-with-security.html?spref=tw

In a nutshell you need:

  • A username map file.
  • A valid 'nix "guest" user mapped to the Windows guest account ("nobody" in most distros).
  • Proper smb.conf configuration.

In this example our username map file is /etc/samba/smbusers. It maps a 'nix user to a Windows user.

In /etc/samba/smbusers (many distros include this file, but with the default commented out):

nobody = guest

In /etc/samba/smb.conf:

[global]
   ...
   security = user
   Map to guest = Bad User
   username map = /etc/samba/smbusers
   ...
-- no 'valid users =' line --

[theshare]
   ...
   guest ok = yes
-- no 'valid users =' line --
share|improve this answer
    
If the remote computer still asks for password, try checking the samba logs for more info. On a server i had the user nobody returning NT_STATUS_LOGON_FAILURE and ntlm_password_check: NO NT password stored for user nobody, that point me that samba already had a user nobody configured. pdbedit nobody returned a user, confirming that samba was trying to use it instead of the "guest" role for nobody. the fix was removing it from samba: pdbedit -x nobody and everything worked fine –  higuita Oct 16 '13 at 18:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.