Can't connect to Debian Samba server from anywhere?

Question

I am trying to make a public share (anon and users) for my entire network, no restrictions what so ever. I keep getting access denied when I try to access the Public share from any computer (win10 and debian 10) Ive checked all the users are added to the server (checking via pdbedit -w -L). The port is open on the server and a simple ncat shows I am able to connect.

Windows login attempt:

The password is invalid for \\IP.IP.IP.IP\Public.
Enter the user name for 'IP.IP.IP.IP: user1
Enter the password for IP.IP.IP.IP:
System error 5 has occurred.

Access is denied.

Linux login attempt:

smbclient //IP.IP.IP.IP/Public /mnt/Public
Unable to initialize messaging context
Anonymous login successful
tree connect failed: NT_STATUS_ACCESS_DENIED

smb.conf :

#======================= Global Settings =======================

[global]
workgroup = WORKGROUP
min protocol = SMB2
max protocol = SMB2
security = user
null passwords = yes
map to guest = Bad User
guest ok = Yes

#======================= Share Definitions =======================

[Public]
        comment = Public Share
        path = /share0
        writable = yes
        available = yes
        browsable = yes
        guest ok = yes

When I run ls -ld /share0 I get this

drwxrwxrwx   2 root root  4096 Sep 12 15:22 share0

Answer 1

Well, this isn't going to work. As you noticed. After all your share is owned by root and you aren't designating a guest user.

The proper method is to provide a guest user guest account = ... (johndoe below).

This is a working configuration:

$ testparm -s
# Global parameters
[global]
        dns proxy = No
        guest account = johndoe
        log file = /var/log/samba/log.%m
        map to guest = Bad Password
        max log size = 1000
        panic action = /usr/share/samba/panic-action %d
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        passwd program = /usr/bin/passwd %u
        security = USER
        server role = standalone server
        server string = %h server (Samba, Ubuntu)
        workgroup = NULL
        idmap config * : backend = tdb


[share]
        force create mode = 0660
        force directory mode = 0770
        guest ok = Yes
        guest only = Yes
        path = /share
        read only = No

The second setting you may want to consider is guest only = ... (depends on what you really want to achieve). I have found that leaving out the force directory mode and force create mode caused issues for me. Oh and don't forget to chown -R johndoe: ... your share (replace the user name 😉).

Long story short:

Adjust ownership of the share on the server. Then:

[global]
# ...
map to guest = bad password
security = user
guest account = johndoe

[share]
  path = /share
  writable = yes
  guest only = yes
  guest ok = yes
  force directory mode = 0770
  force create mode = 0660

... does the job for me. That is, it allows anonymous wrtie-access to shares for anyone. The main difference to your configuration is the setting of the protocol level.

---

General Samba troubleshooting advice

On the server side:

• Use testparm -s to determine the effective settings used by Samba. This is also useful to give when asking questions and prevents redacting crucial information. Also, it strips empty lines and comments.
• Comment out what you don't use. So if you don't use CUPS printing, comment out the options for shares [print$] and [printers].
• Make sure to restart the Samba daemon (smbd) and for good measure (especially name-related settings) also restart nmbd.
• Check user and group ownership of the shared folder.
• To rule out firewall-related issues use smbclient with localhost (this could fail if you don't have Samba listening on the loopback adapter!).

On the client side:

• Use smbclient from Linux. I find its error messages more explicit.
• On Windows try net use, if you have to.
• Ensure that ping and such stuff works, in case a firewall might interfere. Also an nmap run may be enlightening.

---

Please note that the above setting is tried and tested with Windows 10 Pro (2004). No SMB1-compatibility is required. This has been tested (server-side) on several generations of Debian and Ubuntu machines and on the client side with Windows 7 and various Windows 10 as well as various Linux clients.

Answer 2

I got the share to work for all users thanks to 0xC0000022L

With the configuration:

[global]
        guest account = guest
        log file = /var/log/samba/log.%m
        logging = file
        map to guest = Bad Password
        max log size = 1000
        obey pam restrictions = Yes
        pam password change = Yes
        panic action = /usr/share/samba/panic-action %d
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        passwd program = /usr/bin/passwd %u
        security = USER
        server max protocol = SMB2
        server min protocol = SMB2
        server role = standalone server
        unix password sync = Yes
        idmap config * : backend = tdb
        guest ok = Yes


[Public]
        comment = Public Share
        create mask = 0700
        directory mask = 0700
        path = /share0

And valid users = %S commented out in /etc/samba/smb.conf