Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to use an Ubuntu computer to set up Samba shares for a lab of Windows computers (Vista Basic and XP). Two of the shares need logins, but one is supposed to be a public share. My problem is that when a Windows computer attempts to login to a public share (without first logging into another share) it prompts for a username/password.

I know that this problem could be solved by setting "security = share" in the smb.conf file, but I have also read that doing so can cause other security problems and that "security = user" is ideally what should be used. I also know that the smb.conf manual states that "security = user" makes Windows authenticate before accessing a share.

So my main question is, is it possible to use "security = user" for a guest share without Windows prompting for login? Or does Samba not make exceptions for guest shares?

Here is my smb.conf file, for reference:

[global]
        workgroup = hsbclib
        server string = %h server (Samba, Ubuntu)
        dns proxy = no
        log file = /var/log/samba/log.%m
        max log size = 1000
        syslog = 0
        panic action = /usr/share/samba/panic-action %d
        obey pam restrictions = yes
        unix password sync = yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        pam password change = yes
        map to guest = bad user
        usershare allow guests = yes
        security = user
        guest ok = yes
        guest account = publicuser
        username map = /etc/samba/smbusers

[printers]
        comment = All Printers
        browseable = no
        path = /var/spool/samba
        printable = yes
        create mask = 0700

[print$]
        comment = Printer Drivers
        path = /var/lib/samba/printers

[mabusclass]
        path = /srv/smb/mabusclass
        writeable = yes
        valid users = mabus, mabusclass

[yearbook]
        path = /srv/smb/yearbook
        writeable = yes
        valid users = yearbook

[public]
        comment = Free Public Storage
        path = /srv/smb/public
        writeable = yes
        guest ok = yes
share|improve this question

1 Answer 1

From http://blog.realcomputerguy.com/2010/12/samba-and-guest-shares-with-security.html?spref=tw

In a nutshell you need:

  • A username map file.
  • A valid 'nix "guest" user mapped to the Windows guest account ("nobody" in most distros).
  • Proper smb.conf configuration.

In this example our username map file is /etc/samba/smbusers. It maps a 'nix user to a Windows user.

In /etc/samba/smbusers (many distros include this file, but with the default commented out):

nobody = guest

In /etc/samba/smb.conf:

[global]
   ...
   security = user
   Map to guest = Bad User
   username map = /etc/samba/smbusers
   ...
-- no 'valid users =' line --

[theshare]
   ...
   guest ok = yes
-- no 'valid users =' line --
share|improve this answer
    
If the remote computer still asks for password, try checking the samba logs for more info. On a server i had the user nobody returning NT_STATUS_LOGON_FAILURE and ntlm_password_check: NO NT password stored for user nobody, that point me that samba already had a user nobody configured. pdbedit nobody returned a user, confirming that samba was trying to use it instead of the "guest" role for nobody. the fix was removing it from samba: pdbedit -x nobody and everything worked fine –  higuita Oct 16 '13 at 18:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.