1

Using samba 2:4.7.6, Lubuntu distro based on Ubuntu 18.04.3 LTS

Is there a way to force samba to request valid credentials when enumerating shares?

The problem: Windows 10 version 1903 caches session credentials. When browsing an SMB server's shares, it enumerates the shares (EnumShares2) with anonymous credentials, which get cached. Subsequent attempts to connect to a share that requires authentication fail with the message:

Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again.

In Windows 10 1903, there doesn't appear to be any way to force Windows to release the anonymous session short of rebooting the machine.

This problem doesn't occur when enumerating shares on remote Windows computers because anonymous browsing of shares has been disabled since Windows 1703 (Server 2016?, not sure).

Effectively, unless samba can be convinced not to enumerate shares with anonymous credentials, samba shares are inaccessible on window 10 pretty much 100% of the time, since it's improbable that users will connect to the share without having first browsed server shares.

There are no obvious errors in /var/log/samba logfiles.

@smbgroup contains exactly one user, "smb" which was created specifically for accessing shares.

My smb.conf follows:

[global]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of
   workgroup = WORKGROUP

# server string is the equivalent of the NT Description field
    server string = %h server (Samba, Ubuntu)

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable its WINS Server
   wins support = no

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
;   wins server = w.x.y.z

# This will prevent nmbd to search for NetBIOS names through DNS.
   dns proxy = yes

   interfaces = 127.0.0.0/8 eth0

   log file = /var/log/samba/log.%m

   max log size = 1000

   syslog = 0
   panic action = /usr/share/samba/panic-action %d


####### Authentication #######
   server role = standalone server

   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

   pam password change = yes

   map to guest = bad user


# Maximum number of usershare. 0 (default) means that usershare is disabled.
   usershare max shares = 100

# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
   usershare allow guests = yes

#======================= Share Definitions =======================


# Added shares

[Anonymous]
 path = /samba/anonymous
 browsable = yes
 writable = no
 read only = yes
 force user = nobody

[SECURED]
 path = /samba/shares
 valid users = @smbgrp
 browsable = yes
 writable = yes
 read only = no
3
  • Updated with smb.conf (with commented sections removed). Jan 20 '20 at 8:14
  • One "quick" workaround would be to show a dummy share with no content in your SMB server so the users would have to authenticate. After authentication, you can show them their available shares Jan 20 '20 at 8:19
  • 1
    That doesn't work. The problem is that credentials are first passed and cached when ENUMERATING shares. And the credentials that are passed are anonymous credentials. Reboot Windows 10, Access the share directly first, Works. Reboot, Enumerate the server's shares by viewing the server Explorer, Access the share. Doesn't work. Jan 20 '20 at 8:46
1

In your global section add:

restrict anonymous = 2

and change allow guests as it cancels out the anonymous restriction:

usershare allow guests = no

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.