2

I am trying to make a public share (anon and users) for my entire network, no restrictions what so ever. I keep getting access denied when I try to access the Public share from any computer (win10 and debian 10) Ive checked all the users are added to the server (checking via pdbedit -w -L). The port is open on the server and a simple ncat shows I am able to connect.

Windows login attempt:

The password is invalid for \\IP.IP.IP.IP\Public.
Enter the user name for 'IP.IP.IP.IP: user1
Enter the password for IP.IP.IP.IP:
System error 5 has occurred.

Access is denied.

Linux login attempt:

smbclient //IP.IP.IP.IP/Public /mnt/Public
Unable to initialize messaging context
Anonymous login successful
tree connect failed: NT_STATUS_ACCESS_DENIED

smb.conf :

#======================= Global Settings =======================

[global]
workgroup = WORKGROUP
min protocol = SMB2
max protocol = SMB2
security = user
null passwords = yes
map to guest = Bad User
guest ok = Yes

#======================= Share Definitions =======================

[Public]
        comment = Public Share
        path = /share0
        writable = yes
        available = yes
        browsable = yes
        guest ok = yes

When I run ls -ld /share0 I get this

drwxrwxrwx   2 root root  4096 Sep 12 15:22 share0
9
  • 1
    Is SELinux enabled? Have you looked at the logs? Sep 12 '20 at 20:28
  • 1
    Debian doesn't enable SELinux by default
    – roaima
    Sep 12 '20 at 20:55
  • SELinux is currently off. Theres not much in /var/log/samba It only has logs for the daemon starting up.
    – ehammer
    Sep 12 '20 at 20:57
  • 1
    @roaima I know. I just wanted to see if it had perhaps been turned on whether by the OP or someone else. Sep 12 '20 at 20:59
  • 1
    can you login with smbclient from localhost ?
    – binarysta
    Sep 12 '20 at 21:32
1

Well, this isn't going to work. As you noticed. After all your share is owned by root and you aren't designating a guest user.

The proper method is to provide a guest user guest account = ... (johndoe below).

This is a working configuration:

$ testparm -s
# Global parameters
[global]
        dns proxy = No
        guest account = johndoe
        log file = /var/log/samba/log.%m
        map to guest = Bad Password
        max log size = 1000
        panic action = /usr/share/samba/panic-action %d
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        passwd program = /usr/bin/passwd %u
        security = USER
        server role = standalone server
        server string = %h server (Samba, Ubuntu)
        workgroup = NULL
        idmap config * : backend = tdb


[share]
        force create mode = 0660
        force directory mode = 0770
        guest ok = Yes
        guest only = Yes
        path = /share
        read only = No

The second setting you may want to consider is guest only = ... (depends on what you really want to achieve). I have found that leaving out the force directory mode and force create mode caused issues for me. Oh and don't forget to chown -R johndoe: ... your share (replace the user name 😉).

Long story short:

Adjust ownership of the share on the server. Then:

[global]
# ...
map to guest = bad password
security = user
guest account = johndoe

[share]
  path = /share
  writable = yes
  guest only = yes
  guest ok = yes
  force directory mode = 0770
  force create mode = 0660

... does the job for me. That is, it allows anonymous wrtie-access to shares for anyone. The main difference to your configuration is the setting of the protocol level.


General Samba troubleshooting advice

On the server side:

  • Use testparm -s to determine the effective settings used by Samba. This is also useful to give when asking questions and prevents redacting crucial information. Also, it strips empty lines and comments.
  • Comment out what you don't use. So if you don't use CUPS printing, comment out the options for shares [print$] and [printers].
  • Make sure to restart the Samba daemon (smbd) and for good measure (especially name-related settings) also restart nmbd.
  • Check user and group ownership of the shared folder.
  • To rule out firewall-related issues use smbclient with localhost (this could fail if you don't have Samba listening on the loopback adapter!).

On the client side:

  • Use smbclient from Linux. I find its error messages more explicit.
  • On Windows try net use, if you have to.
  • Ensure that ping and such stuff works, in case a firewall might interfere. Also an nmap run may be enlightening.

Please note that the above setting is tried and tested with Windows 10 Pro (2004). No SMB1-compatibility is required. This has been tested (server-side) on several generations of Debian and Ubuntu machines and on the client side with Windows 7 and various Windows 10 as well as various Linux clients.

Feature selection dialog in Windows 10

9
  • "Well, this isn't going to work. As you noticed. After all your share is owned by root and you aren't designating a guest user." That doesn't really matter since the permissions are 0777. (I would use force user myself, but it doesn't matter here.)
    – roaima
    Sep 12 '20 at 21:13
  • @roaima it will matter once you start creating files/folders. But you're right for the purpose of my answer root is "just like any other system account". Sep 12 '20 at 21:16
  • If I add a guest account, does that mean the other users I've added to the samba server can't access the /share0 share?
    – ehammer
    Sep 12 '20 at 21:17
  • @ehammer well, that depends on whether you apply ACLs. But if you use standard Unix permissions it's the ownership and the file mode that will govern who can access what. So you can fix some of it via the group membership, but real flexibility only comes with using ACLs in my experience (but it adds complexity). So if you want a share that isn't just anonymously accessible to guests, this can be hairy business, i.e. if non-guest users also should be able to access it. Sep 12 '20 at 21:19
  • My concern is that windows really only will connect to smb servers with credentials (the anonymous user on windows 10 just doesnt work) so if multiple people wanted to connect to the server, could they do this with the one guest account?
    – ehammer
    Sep 12 '20 at 21:22
0

I got the share to work for all users thanks to 0xC0000022L

With the configuration:

[global]
        guest account = guest
        log file = /var/log/samba/log.%m
        logging = file
        map to guest = Bad Password
        max log size = 1000
        obey pam restrictions = Yes
        pam password change = Yes
        panic action = /usr/share/samba/panic-action %d
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        passwd program = /usr/bin/passwd %u
        security = USER
        server max protocol = SMB2
        server min protocol = SMB2
        server role = standalone server
        unix password sync = Yes
        idmap config * : backend = tdb
        guest ok = Yes


[Public]
        comment = Public Share
        create mask = 0700
        directory mask = 0700
        path = /share0

And valid users = %S commented out in /etc/samba/smb.conf

1
  • ... which didn't match what you gave in the question. The contents of your question weren't actually too far off from what was needed to get this to work. Sep 12 '20 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.