Setting up an anonymous public Samba Share to be accessed via Windows 7 and XBMC

Question

So I should start by saying that I did this successfully less than a week ago and I had no trouble but I have since reformatted and reconfigured my server and now I'm having the hardest time remembering how I did it.

Here's what I had before and what I am trying to accomplish again. I had a public samba share on Ubuntu server. Anyone on my network could access the share and it's contents simply by typing \Hostname. No password necessary. Users who were not on the share's workgroup had read access but users who were on the workgroup had read/write access. (Windows 7)

Now, if I try to connect to \Hostname I'm prompted for a username and password. If I enter the un pw I get full access but I shouldn't have to; my current settings are...

security = user
map to guest = bad user

[Shares]
path = /home/shares
available = yes
read only = no
browsable = yes
public = yes
writable = yes
guest ok = yes

I'm pulling my hair out over this one. Any suggestions?

EDIT:

Ugh, this is giving me such a hard time. I'm so close.

Here's what I've got.

I can get to the share from Windows 7 by going to start and typing \Hostname\Sharename but I'm prompted for a username and password. I cant just leave it blank though because it will use my workgroup as the domain; so I enter \ for the username to clear it out and log in with a blank username and password. Great now I can access the files in the share.

Once I'm in, The workgroup configuration is working properly. If I'm on a computer with the the default WORKGROUP I can read and execute; a computer on my Home workgroup can read write and execute. So that's working.

The problem is, It shouldn't be asking for a password at all. It should be totally public to anyone on the network. I'm trying to share it with XBMC and it's not even showing up under smb in the file manager. I cant access it manually from XBMC either. I get a connection refused error.

Still pulling hair out over this. The worst part is the first time I did this about a week ago, I spent about 30 minutes on it and it worked perfectly. Now I've probably spent at least 4 hours and it's still not working.

Testparm:

Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[printers]"
Processing section "[print$]"
Processing section "[Shares]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

[global]
        workgroup = FELLOWSHIP
        server string = %h server (Samba, Ubuntu)
        map to guest = Bad User
        obey pam restrictions = Yes
        pam password change = Yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        unix password sync = Yes
        syslog = 0
        log file = /var/log/samba/log.%m
        max log size = 1000
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        dns proxy = No
        wins support = Yes
        usershare allow guests = Yes
        panic action = /usr/share/samba/panic-action %d
        idmap config * : backend = tdb

[printers]
        comment = All Printers
        path = /var/spool/samba
        create mask = 0700
        printable = Yes
        print ok = Yes
        browseable = No

[print$]
        comment = Printer Drivers
        path = /var/lib/samba/printers

[Shares]
        path = /home/shares
        read only = No
        guest ok = Yes

UPDATE: So, the share is now available across my network regardless of the work group. Any Windows user who connects to my network can see the NAS under Netowork and access it. The key was setting security to security = share. I know, it's deprecated, but it works and security = user and map to user = bad user wasn't working for me.

Anyway, now it seems that anyone who connects to the share get's unix global permissions for the directory, which is manageable, but I want users that are joined to the workgroup specified in smb.conf to get unix group permissions.

This way, I can set the directory to 775 and I will be able to write because I am joined to the workgroup but other users can only read and execute.

Solution 1

Happened to stumble across this thread on the Ubuntu forums, and thought it might help. It explains the steps that happen behind the scenes:

In Windows the client's username and password is automatically sent when it browses for shares - this is done without the user's knowledge. That forces Samba to deal with the sent credentials even though it's a guest share that requires no authentication.

When that username is passed Samba will search through it's password database for that user:

• If there is no match to the username the client user is tagged a "Bad User" and converted ( mapped ) to the guest account which by default is "nobody".

• If it finds a match to the username and there is a samba password that matches the one sent by the Windows client then the Windows user automatically gains access although not as an anonymous user which is why you needed to add "force user = nobody" to your share definition.

• If it finds a match to the username but the samba password does not match exactly the password that's automatically sent by the Windows client then you will be prompted for a password - even for a guest share.

Try adding force user = nobody to your share definition, and see if that does it.

Edit 02/20/2013:

Is testparm returning an exit code of something other than zero? All the same, I would go ahead and give that area of the config a good, hard look. Also, I'm not sure how case-sensitive smb.conf is, but every example I see (for example) of map to guest = Bad User has the B and U capitalized. Check-out the Samba man pages for the options you are using, and double-check everything.

Solution 2

This is how OpenElec is configured. Should do what you are asking for. (even if it is a year later...maybe it will help the next one) Just tweak the share settings as needed.

[global]
  server string = YOURSERVERNAME
  workgroup = WORKGROUP
  netbios name = %h
  security = share
  guest account = root
  socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
  smb ports = 445
  max protocol = SMB2
  min receivefile size = 16384
  deadtime = 30
  os level = 20
  mangled names = no
  syslog only = yes
  syslog = 2
  name resolve order = lmhosts wins bcast host
  preferred master = auto
  domain master = auto
  local master = yes
  printcap name = /dev/null
  load printers = no
  browseable = yes
  writeable = yes
  printable = no
  encrypt passwords = true
  enable core files = no
  passdb backend = smbpasswd
  smb encrypt = disabled
  use sendfile = yes

[share]
comment = Share
path = /share
available = yes
browsable = yes
writable = yes
public = yes

Solution 3

Since Google search brings us here and there is no clear answer, I summed it up.

Below are the conditions required to make sure SMB clients will not be prompting for the username and password when accessing your Samba server:

1. Add guest account = <owner-of-your-shares> under a [global] section. It is important that the owner account of your shares has an access to them. If you do not do this, Samba will assume the guest account is a nobody user which unlikely has an access to the data in your share.

   Alternatively, you can specify force user = <owner-of-your-share> under your [shareXYZ] block.

2. Make sure your [shareXYZ] has guest ok = yes.

   Set browsable = yes but it is usually inherited from the [global] and is set to yes by default.

Then, probably security = user should be also set (this is default when you do not have Active Directory set in your environment). Though, I am not sure whether this flag is required as I do not have AD in my environment.

Of course, if you want the nobody user to work, then you can just chown -Rh 65534:65534 /yourshare, after that you will be fine just with the single setting guest ok = yes under your [shareXYZ].

Note that having set rwx to others (chmod o+rwx /yourshare) did not let Samba with its nobody user into the share. I have checked this with strace -f -e chdir,geteuid,getegid -p <pid-of-the-parent-smbd-process>. Probably Samba just ignores the permissions set for the others? Not sure.

Solution 4

This probably won't be the solution for everyone with such a problem, but my problem was due to the permissions of the parent directory that the shared directory was in. As soon as I enabled "Read by others" I was able to anonymously access the share. This caught me a bit by surprise as in windows servers the permissions of the parent directory don't matter for the shared directory.

So my path looks like this:

/data1/Downloads 

I had to enable "read by others" on the data1 directory.

I didn't have to anything special in smb.conf, my share entry looks like this...

[Downloads]
path = /data1/Downloads
browseable = yes
read only = yes
guest ok = yes
public = yes

Solution 5

It works for me in 30 seconds

Source:https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Standalone_Server

[global]

    map to guest = Bad User

    log file = /var/log/samba/%m

    log level = 1

[guest]

    # This share allows anonymous (guest) access

    # without authentication!

    path = /srv/samba/guest/

    read only = no

    guest ok = yes

View more solutions

Comments

[Aaron]

You should be able to map workgroup users to get specific permissions with a username map file: samba.org/samba/docs/man/manpages-3/smb.conf.5.html#USERNAME‌​MAP

[George Spake]

Hey Bryce, Thanks for answering. I've managed to make a little progress since my original question but I'm still essentially having the same issue. I've managed to get my share (I'm calling it Shares) configured so that anyone on the workgroup, defined in the global seettings in smb.conf, can get right to it - No password necessary. Continuing in next comment...

[George Spake]

Here are the settings for the share: [Shares] path = /home/shares browsable = yes available = yes read only = no public = yes writable = yes guest ok = yes If I add force user = nobody it breaks and I can't access the share at all. Here's where it get's weird though; when I run testparm it dumps [Shares] path = /home/shares read only = no guest ok = yes So for some reason it's like it isn't seeing the public, writeable, available and browseable definitions. Could this be an indicator of where the problem is.

[Aaron]

@GeorgeSpake edit made...

[davidmdem]

Thank you for this addition! I've been struggling to get a public share working with Windows 8.1 these settings did the trick.

[DanielSmedegaardBuus]

URGH! "guest account = root". This means guest accounts are mapped to root, i.e. have unrestricted permissions to do anything. BE VERY CAREFUL! DRAGONS AHEAD!

[Antony]

Recent samba update 4.3.11+dfsg-0ubuntu0.14.04.3 on Ubuntu 14.04 broke my public share, force user = nobody is just the fix I needed to bring public share back

[Dany]

Thank you for explanation about nobody! I've also struggled with chmod o+rwx being unaware of nobody by default

[Admin]

guest account = <username> solved my problem! Thanks a lot!