How can I enable anonymous access to a Samba share under ADS security mode?

Question

I'm trying to enable anonymous access to a single service in my Samba config. Authorized user access is working perfectly, but when I attempt a no-password connection, I get this message:

Anonymous login successful
Domain=[...] OS=[Unix] Server=[Samba
3.3.8-0.51.el5] tree connect failed: NT_STATUS_LOGON_FAILURE

The message log shows this error:

... smbd[21262]: [2010/05/24 21:26:39,  0] smbd/service.c:make_connection_snum(1004)
... smbd[21262]:   Can't become connected user!

The smb.conf is configured thusly:

[global]
   security = ads
   obey pam restrictions = Yes
   winbind enum users = Yes
   winbind enum groups = Yes
   winbind use default domain = true
   valid users = "@domain admins", "@domain users"
   guest account = nobody
   map to guest = Bad User

[evilshare]
   path = /evil/share
   guest ok = yes
   read only = No
   browseable = No

Given that I have 'map to guest = Bad User' and 'guest ok' specified, I don't understand why it is trying to "become connected user". Should it not be trying to "become guest user"?

Answer 1

For me the solution was to set:

auth methods = guest sam winbind
restrict anonymous = 0
guest account = nobody

Of course, make sure the nobody user has been created without a password:

auth methods = guest sam winbind

Answer 2

Check out this tutorial

You remembered to restart samba to pull the config also what are the local permissions for that folder?

Answer 3

remove

valid users = "@domain admins", "@domain users"

from [global], only use it in shares that are not "guest" enabled