I am trying to use an Ubuntu computer to set up Samba shares for a lab of Windows computers (Vista Basic and XP). Two of the shares need logins, but one is supposed to be a public share. My problem is that when a Windows computer attempts to login to a public share (without first logging into another share) it prompts for a username/password.

I know that this problem could be solved by setting "security = share" in the smb.conf file, but I have also read that doing so can cause other security problems and that "security = user" is ideally what should be used. I also know that the smb.conf manual states that "security = user" makes Windows authenticate before accessing a share.

So my main question is, is it possible to use "security = user" for a guest share without Windows prompting for login? Or does Samba not make exceptions for guest shares?

Here is my smb.conf file, for reference:

        workgroup = hsbclib
        server string = %h server (Samba, Ubuntu)
        dns proxy = no
        log file = /var/log/samba/log.%m
        max log size = 1000
        syslog = 0
        panic action = /usr/share/samba/panic-action %d
        obey pam restrictions = yes
        unix password sync = yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        pam password change = yes
        map to guest = bad user
        usershare allow guests = yes
        security = user
        guest ok = yes
        guest account = publicuser
        username map = /etc/samba/smbusers

        comment = All Printers
        browseable = no
        path = /var/spool/samba
        printable = yes
        create mask = 0700

        comment = Printer Drivers
        path = /var/lib/samba/printers

        path = /srv/smb/mabusclass
        writeable = yes
        valid users = mabus, mabusclass

        path = /srv/smb/yearbook
        writeable = yes
        valid users = yearbook

        comment = Free Public Storage
        path = /srv/smb/public
        writeable = yes
        guest ok = yes

1 Answer 1


From http://blog.realcomputerguy.com/2010/12/samba-and-guest-shares-with-security.html?spref=tw

In a nutshell you need:

  • A username map file.
  • A valid 'nix "guest" user mapped to the Windows guest account ("nobody" in most distros).
  • Proper smb.conf configuration.

In this example our username map file is /etc/samba/smbusers. It maps a 'nix user to a Windows user.

In /etc/samba/smbusers (many distros include this file, but with the default commented out):

nobody = guest

In /etc/samba/smb.conf:

   security = user
   Map to guest = Bad User
   username map = /etc/samba/smbusers
-- no 'valid users =' line --

   guest ok = yes
-- no 'valid users =' line --
  • If the remote computer still asks for password, try checking the samba logs for more info. On a server i had the user nobody returning NT_STATUS_LOGON_FAILURE and ntlm_password_check: NO NT password stored for user nobody, that point me that samba already had a user nobody configured. pdbedit nobody returned a user, confirming that samba was trying to use it instead of the "guest" role for nobody. the fix was removing it from samba: pdbedit -x nobody and everything worked fine
    – higuita
    Oct 16, 2013 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.