This is how the Samba auth backend works:
- Client username
- Server username via the username map. This is a system (/etc/passwd) account.
- If the server username is empty "" goto "Guest Authentication". Otherwise, goto "passdb/SAM Authentication".
- Check credentials via passdb/SAM database. This is because hashes differ from UNIX accounts, the the SAM database also includes additional information.
- Login the client user as the server user
- Check credentials via guest authentication, which always succeeds.
- Login the client user as the user specified by "guest account", default "nobody"
Unfortunately, while Samba accepts "" to mean guest windows doesn't accept/allow that. Even if the guest account is mapped to "nobody", Samba won't treat a client username of "nobody" as guest. Authentication will proceed through the passdb/SAM backend. The same pitfall applies to the username map.
Now I'm aware of Samba's "map to guest". If configured as "Bad User", non-existent user accounts will be mapped to the guest account. This is unfortunately error prone, with problems similar to that of the discouraged value "Bad Password".
I'm looking for a way to map one user, or several finite users (such as "nobody", "guest") to the guest account. Is this possible?
I have tried this crazy map, which as expected doesn't work:
= guest nobody