Samba Guest Account with Password of 'guest'

andy_ · #1 16th March 2009, 09:22 PM

Hi,

I have a local file server running Samba on Fedora 9. It's already configured and serves a few people without any problems. I am now trying to set up a new read-only share with the username 'guest' and the password 'guest'. However, with no success so far!

If I log on as 'guest' with the password 'guest' like so:

Code:

su - guest

No problem. Once logged in, if I try:

Code:

smbclient //samba/share

I'm prompted for a password. If I enter 'guest' I get:

Code:

session setup failed: NT_STATUS_LOGON_FAILURE

If I enter nothing (null) I get:

Code:

Anonymous login successful
  Domain=[RIVER] OS=[Unix] Server=[Samba 3.2.8-0.26.fc9]
  tree connect failed: NT_STATUS_LOGON_FAILURE

Any help or advice pointing me in the right direction would be greatly appreciated.

Cheers!

beaker_ · #2 16th March 2009, 10:29 PM

My first guess would be "guest" is mapped to nobody in smbusers.

edit: I forgot to mention you've probebly specified "guest ok = no" in smb.conf

andy_ · #3 17th March 2009, 01:28 AM

Thanks for your reply. I guess I should of included:

/etc/samba/smbusers

Code:

nobody = guest pcguest smbguest
guest = guest

/etc/samba/smb.conf

Code:

[global]
workgroup = river
server string = Samba Server Version %v
netbios name = hiccup
interfaces = lo eth0 eth1 192.168.111.230/24 192.168.0.230/24
hosts allow = 127. 192.168.111. 192.168.0.
security = user
passdb backend = tdbsam
os level = 255
preferred master = yes
wins support = yes
dns proxy = yes
cups options = raw
username map = /etc/samba/smbusers
;guest ok = yes
guest account = guest
store dos attributes = yes
unix extensions = no

[install]
comment = Unattended
writeable = no
locking = no
path = /install
guest ok = yes

I can log on using smbclient and no password.

Code:

-bash-3.2$ smbclient //hiccup/install
Enter guest's password: 
Anonymous login successful
Domain=[RIVER] OS=[Unix] Server=[Samba 3.2.8-0.26.fc9]
smb: \>

I have also just set the password for guest using 'smbpasswd guest' to 'guest' and restarted the service but still I can only access with no password.

Code:

[andy@harris ~]$ su - guest
Password:                                                        // typed 'guest' here
-bash-3.2$ smbclient //hiccup/install
Enter guest's password:                                          // typed 'guest' here
session setup failed: NT_STATUS_LOGON_FAILURE
-bash-3.2$ smbclient //hiccup/install
Enter guest's password:                                          // typed nothing here
Anonymous login successful
Domain=[RIVER] OS=[Unix] Server=[Samba 3.2.8-0.26.fc9]
smb: \>

Thanks again for your help!

beaker_ · #4 17th March 2009, 02:19 PM

Ok here's where I'm gonna say, I need to set this up and try it because I'm not 100% on guest with password. Looking at smbusrs I suspect you just want an anonymous, read-only, file server for anyone and everyone who has guest's password.

Let's step back for a minute and make your share avaiable to your username. Run system-config-samba (yum install system-config-samba, if you don't have it) and add yourself as a samba user, then too your share.

I'm also thinking selinux maybe stopping you so place it into 'permissive mode' first and try to login.

Edit: it's also possible that your guest usr doesn't have read privlidges on the filesystem. But let's start with the easy stuff first.

andy_ · #5 17th March 2009, 08:52 PM

Thanks for your reply beaker! Firstly let me just mention that I need a read-only access to a share for the user account 'guest' with the password 'guest'. The reason is because I am trying to setup an "Unattended" server (see http://unattended.sourceforge.net/ for more info).

I tried what you suggested and I think you might be on to something. Yesterday I tried to login via ssh (putty) with the username 'guest', password 'guest but got a message to say I didn't have permissions to write to my home directory.

After trying:

Code:

setenforce 0

and then logging in as 'guest' - no problem!!

Straigh away though I received a SELinux warning:

Code:

SELinux denied access requested by sshd. It is not expected that 
this access is required by sshd and this access may signal an intrusion 
attempt. It is also possible that the specific version or configuration of 
the application is causing it to require additional access. 

Allowing Access

Sometimes labeling problems can cause SELinux denials. You could 
try to restore the default system file context for ./install, 

restorecon -v './install' 

If this does not work, there is currently no automatic way to allow this 
access. Instead, you can generate a local policy module to allow this 
access - see FAQ Or you can disable SELinux protection altogether. 
Disabling SELinux protection is not recommended. Please file a 
bug report against this package.

Still not quite sure what the problem is or how to resolve it but I think we are a step closer! Thanks again for your help!

beaker_ · #6 17th March 2009, 10:18 PM

Yeah that's what I thought. So here's what I think; you've created a regular linux user named guest, guest then has a windows name guest and password guest. Two easy problems to address first:

Guest is still mapped to nobody in smbusers. Use vi or gedit and edit smbusers from this

Code:

nobody = guest pcguest smbguest
guest = guest

to this.

Code:

root = administrator admin
nobody = pcguest smbguest
guest = guest

Leave selinux in permissive mode and restart samba (just for luck) then at the terminal try 'smbclient -U guest -L 127.0.0.1.' It should prompt your for a password and then kickout your shared directory.

beaker_ · #7 17th March 2009, 10:36 PM

Hopefully you backed up the original smb.conf, it contains useful notes about selinux. I believe /install isn't labelled properly. wrt selinux i.e., You can allow selinux to export everything or label the directory like so:

Code:

[      @localhost ~]$ su
Password: 
[root@localhost       ]# cd /install
[root@localhost install]# ls -ldZ
drwxr-xr-x  root root unconfined_u:object_r:default_t:s0
[root@localhost install]# chcon -t samba_share_t /install
[root@localhost install]# ls -ldZ
drwxr-xr-x  root root unconfined_u:object_r:samba_share_t:s0

beaker_ · #8 17th March 2009, 10:46 PM

Last you shouldn't need "guest ok = yes" because there are no anonymous logins.

Code:

[install]
comment = Unattended
writeable = no
locking = no
path = /install
guest ok = yes

try

Code:

[install]
comment = Unattended
path = /install
; writeable = no
locking = no
browseable = yes
valid users = guest

Let me know how you make out.

andy_ · #9 18th March 2009, 12:17 AM

Wow, what can I say, you are a legend!!

I took guest out of the "nobody = guest pcguest smbguest" option in smbuser like you suggested and then restarted samba. Then it worked straight away!!

Thanks for the "chcon -t samba_share_t /install" advice. As it happened I had already changed that as it has caused me a lot of wasted time google'ing in the past!

Thanks for explaining so clearly. I must confess, I didn't know exactly what the "guest ok = yes" option did. I have taken that out now and applied all your other suggestions.

I also switched back to enforcing mode:

Code:

setenforce 1

And then restarted the samba service again. Now everything works as it needs to; I can access my samba share as guest with guest via "\\ntinstall\install".

Thanks again!!