Guest share for domain-integrated Samba-Server

Question

Have set up a Windows-domain-integrated samba server. Sharing files is working pretty well but failing to set up a guest share as long the security is set to ads. This is a shortened version of the configuration containing a share free to a certain domain group and a non working share for non authenticated users. I've attached the smb.conf for reference.

[global]
    workgroup = MYDOMAIN
    dns proxy = no
    netbios name = myshare
    clustering = yes

    security = ads
    realm = mydomain.com
    password server = 1.2.3.4
    winbind enum users = yes
    winbind enum groups = yes
    winbind cache time = 10
    winbind use default domain = yes
    client use spnego = yes
    client ntlmv2 auth = yes
    encrypt passwords = yes
    restrict anonymous = 2
    domain master = no
    local master = no
    preferred master = no
    os level = 0
    idmap uid = 100000-109999
    idmap gid = 100000-109999

    log file = /var/log/samba/log
    log level = 3
    max log size = 1000
    syslog = 0
    panic action = /usr/share/samba/panic-action %d

    server role = standalone server
    passdb backend = tdbsam

    unix password sync = yes
    pam password change = yes
    map to guest = bad user
    guest account = nobody


[public]
    browsable = yes
    create mask = 0666
    directory mask = 0777
    writeable = yes
    path = /share/public
    guest ok = yes

[temp]
    browsable = yes
    valid users = root, @"share users"
    create mask = 0666
    directory mask = 0777
    writeable = yes
    path = /share/temp
    guest ok = no

However guest ok = yes does not seem to have any effect (temp is working as expected writable by root and users of the group). The user nobody which should be mapped to has the rwx right's for share folder.

So what is also needed to grant guest access to a specific share when security generally is ads?

i add always to the share that guest ok – djdomi Sep 16 '19 at 20:50 — djdomi, Sep 16 '19 at 20:50

score 0 · Accepted Answer · answered Sep 23 '19 at 08:58

Security ads was not the problem - it just indicates that the samba-daemon accepts Kerberos-Tickets as authentication.

The real problem was restrict anonymous = 2. This disallows every anonymous connection to the server. Lowering the value to 1 allows to access a share anonymously by entering the path, 0 allows to even browse the share. Setting 0 oder 1 still checks access and may require additional authentication.

Source: https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html#RESTRICTANONYMOUS

Guest share for domain-integrated Samba-Server

1 Answers1