0

This is how the Samba auth backend works:

  1. Client username
  2. Server username via the username map. This is a system (/etc/passwd) account.
  3. If the server username is empty "" goto "Guest Authentication". Otherwise, goto "passdb/SAM Authentication".

passdb/SAM Authentication:

  1. Check credentials via passdb/SAM database. This is because hashes differ from UNIX accounts, the the SAM database also includes additional information.
  2. Login the client user as the server user

Guest Authentication:

  1. Check credentials via guest authentication, which always succeeds.
  2. Login the client user as the user specified by "guest account", default "nobody"

Unfortunately, while Samba accepts "" to mean guest windows doesn't accept/allow that. Even if the guest account is mapped to "nobody", Samba won't treat a client username of "nobody" as guest. Authentication will proceed through the passdb/SAM backend. The same pitfall applies to the username map.

Now I'm aware of Samba's "map to guest". If configured as "Bad User", non-existent user accounts will be mapped to the guest account. This is unfortunately error prone, with problems similar to that of the discouraged value "Bad Password".

I'm looking for a way to map one user, or several finite users (such as "nobody", "guest") to the guest account. Is this possible?

Edit:

I have tried this crazy map, which as expected doesn't work:

= guest nobody

Improve this question

1 Answer 1

Reset to default
0

Use username map =. But you seem to use an unorthodox approarch, so I seriously doubt you really need it.

P.S. And no, your description of how authrization works is beyound any acceptable error threshold.

Improve this answer
2
  • I don't see how that could work. Also I need the username map, I'm currently using it. And I've just described what I see in my logs with log level = 3 passdb:5 auth:10, so it can't be wrong.
    – user19087
    Nov 7, 2016 at 22:12
  • Okay, you seem to think that you know the subject better than all the others, and you're doing it right. Why asking then ? PS Get rid of this dangerous delusion. You actually can do this, the way I told you, just reread it until you get it. And no, you aren't using the username map, at least you didn't mention it.
    – drookie
    Nov 8, 2016 at 3:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .