Happened to stumble across this thread on the Ubuntu forums, and thought it might help. It explains the steps that happen behind the scenes:
In Windows the client's username and password is automatically sent when it browses for shares - this is done without the user's knowledge. That forces Samba to deal with the sent credentials even though it's a guest share that requires no authentication.
When that username is passed Samba will search through it's password database for that user:
If there is no match to the username the client user is tagged a "Bad User" and converted ( mapped ) to the guest account which by default is "nobody".
If it finds a match to the username and there is a samba password that matches the one sent by the Windows client then the Windows user automatically gains access although not as an anonymous user which is why you needed to add "force user = nobody" to your share definition.
If it finds a match to the username but the samba password does not match exactly the password that's automatically sent by the Windows client then you will be prompted for a password - even for a guest share.
Try adding force user = nobody to your share definition, and see if that does it.
Edit 02/20/2013:
Is testparm returning an exit code of something other than zero? All the same, I would go ahead and give that area of the config a good, hard look. Also, I'm not sure how case-sensitive smb.conf is, but every example I see (for example) of map to guest = Bad User has the B and U capitalized. Check-out the Samba man pages for the options you are using, and double-check everything.
Happened to stumble across this thread on the Ubuntu forums, and thought it might help. It explains the steps that happen behind the scenes:
In Windows the client's username and password is automatically sent when it browses for shares - this is done without the user's knowledge. That forces Samba to deal with the sent credentials even though it's a guest share that requires no authentication.
When that username is passed Samba will search through it's password database for that user:
If there is no match to the username the client user is tagged a "Bad User" and converted ( mapped ) to the guest account which by default is "nobody".
If it finds a match to the username and there is a samba password that matches the one sent by the Windows client then the Windows user automatically gains access although not as an anonymous user which is why you needed to add "force user = nobody" to your share definition.
If it finds a match to the username but the samba password does not match exactly the password that's automatically sent by the Windows client then you will be prompted for a password - even for a guest share.
Try adding force user = nobody to your share definition, and see if that does it.
Edit 02/20/2013:
Is testparm returning an exit code of something other than zero? All the same, I would go ahead and give that area of the config a good, hard look. Also, I'm not sure how case-sensitive smb.conf is, but every example I see (for example) of map to guest = Bad User has the B and U capitalized. Check-out the Samba man pages for the options you are using, and double-check everything.
This is how OpenElec is configured. Should do what you are asking for. (even if it is a year later...maybe it will help the next one) Just tweak the share settings as needed.
[global]
server string = YOURSERVERNAME
workgroup = WORKGROUP
netbios name = %h
security = share
guest account = root
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
smb ports = 445
max protocol = SMB2
min receivefile size = 16384
deadtime = 30
os level = 20
mangled names = no
syslog only = yes
syslog = 2
name resolve order = lmhosts wins bcast host
preferred master = auto
domain master = auto
local master = yes
printcap name = /dev/null
load printers = no
browseable = yes
writeable = yes
printable = no
encrypt passwords = true
enable core files = no
passdb backend = smbpasswd
smb encrypt = disabled
use sendfile = yes
[share]
comment = Share
path = /share
available = yes
browsable = yes
writable = yes
public = yes
Anonymous user on Samba | The FreeBSD Forums
Trouble setting up an anonymous samba share
[SAMBA on Linux Mint 21.3] I am unable to create an anonymous SAMBA share without authentication but a private share is working fine
How to create a Samba share that is writable from Windows without 777 permissions? - Unix & Linux Stack Exchange
Videos
Hi,
I can't believe how difficult this seems to be (or rather how stupid I must be) ...
Could someone please explain to me how to setup a samba share that can be accessed by anyone without a password?
Say I have created the directory I want to share and have installed samba.
What do I put in smb.conf and what else do I have to do?
OK, I have found an answer myself.
As this is absolutely not obvious from the docs and HOWTOs and whatever, the reason this thing asks for password is because it cannot map guest user to the owner of the directory being shared.
I have NTFS partitions which I need to mount RW so I used the following setup in my /etc/fstab:
/dev/sdb1 /media/disk1 ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0 2
/dev/sdb2 /media/disk2 ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0 2
The most important pieces of config are uid and gid (maybe only uid, don't know).
They are set to the UID and GID of the user jonnie set up on the server (obviously not root). So, when ntfs-3g will mount these disks, everything will be owned by him.
After that, I have added this user to the Samba registry (or maybe created new identical one, don't care):
# smbpasswd -a jonnie
It asked for password, I have entered the same as for the main system.
After that, I have added the force user and force group settings to the smb.conf:
[global]
workgroup = WORKGROUP
netbios name = HOMESERV
security = user
map to guest = Bad User
[disk1]
comment = Disk 1 on 400GB HDD
path = /media/disk1
browsable = yes
guest ok = yes
read only = no
create mask = 666
directory mask = 777
force user = jonnie
force group = jonnie
[disk2]
comment = Disk 2 on 400GB HDD
path = /media/disk2
browsable = yes
guest ok = yes
read only = no
create mask = 666
directory mask = 777
force user = jonnie
force group = jonnie
So, most important piece of config relevant to me was force user.
Courtesy of the Samba HOWTO
The config can be shorter:
Create unix user jonnie
sudo useradd jonnie -s /usr/sbin/nologin
Create smbuser
sudo smbpasswd -a jonnie
Create the Linux directory to share
mkdir /mysmbshare
Change the owner of the directory to jonnie
sudo chown jonnie /mysmbshare
smb.conf
[global]
workgroup = MyWorkGroup
server string = Hello, use me
security = user
map to guest = Bad User
guest account = jonnie
passdb backend = tdbsam
[the_public_share]
path = /mysmbshare
writable = yes
printable = no
public = yes
All files are owned by jonnie and everyone has rw access to the files.
In order to set up guest access in Samba, you need to set up a user that it will pretend to log in as. So, let's say you want to share files on /mnt/somepartition/files publically. Your configuration might look like this:
[public_files]
comment = Public files
path = /mnt/somepartition/files
browsable = yes
guest ok = yes
writable = yes
guest account = someusername
create mask = 0775
directory mask = 0755
What this saying is "Create a samba share on \mymachine\public_files that is viewable to anonymous users (not hidden like user files generally are) and enable it for write access. Anonymous users can access this share by using someusername's credentials. When files are created, make them globally executable but restrict write access globally. When directories are created, make them globally executable but only writable by someusername."
Once this is done, you will need to create a smbpassword, per your question. To do this, ensure first that the user exists within your server. If the user doesn't, create it:
sudo adduser someusername
Once the user exists, create a samba login:
sudo smbpasswd -a someusername
A couple of things to keep in mind: the directory that public_files points to will need to be READ accessible to someusername. Make sure you set the permissions correctly. If the directory is owned by you but still want to make them available, add someusername to a common group and then change the group ownership.
How I got it to work on my Pi running dietpi. It works with Windows (10), Mac (Catalina) and Linux clients, and has read+write permissions. Note: I automount the USBHDD to /media/USBHDD at startup
Contents of smb.conf:
[global]
workgroup = WORKGROUP
server string = %h server
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
syslog only = no
syslog = 0
panic action = /usr/share/samba/panic-action %d
security = user
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = yes
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
map to guest = bad user
load printers = no
printcap name = /dev/null
disable spoolss = yes
[dietpi]
comment = DietPi Share
path = /mnt/dietpi_userdata
browseable = yes
create mask = 0664
directory mask = 0775
valid users = dietpi
writeable = yes
[PiNAS]
path = /media/USBHDD
browseable = yes
read only = no
guest ok = yes
writeable = yes
create mask = 0775
directory mask = 0755
max connections = 8
Solved
There were two problems with my setup,
Invalid config
I put in the line
force user=nobody # Ensure any file created in this share is owned by this user
guess what, you cannot put in comment like that, it has to be in a newline or else it gets treated as a line in the config. Putting the
#part in next line fixed it.Permission issues
I was sharing my
/home/user/Publicdirectory. While I set my/home/user/Publicto have755permission allowing the usernobodyaccess to it, my home directory had750permission. It was like the usernobodywas allowed to come to my house but was banned from entering the neighbourhood my house is located at.For that, I created a new directory called
Publicin/assudo mkdir /Public
I then changed ownership of
/Publicto be owned byuserassudo chown user /Public
I then bind mount
/home/user/Publicinto/Publicsudo mount --bind /home/user/Public /Public
Finally, I added the following line in my
/etc/fstabat the end/home/user/Public /Public none bind 0 0
Also dont forget to register your user with samba
sudo smbpasswd -a user
Choose a good password, you know the usual password rules
I dont have to change anything for private share, only for my public share as my private share works as expected anyways. At the end, this is what it ended up to become
[my_public_share] path=/Public read only=yes browseable=yes create mask = 0644 directory mask = 0755 guest ok=yes guest only=no [my_private_share] path=/home/user/SambaShare browseable=yes read only=no guest ok=no create mask=0644 directory maks=0755 force user=user # ensure files created by clients are owned by this user valid users=user # valid users is comma seperated list of who can access the files
Original question follows
I wanted to setup two SAMBA shares, one being public SAMBA share that I wish anyone in the network can read files without providing any username and password. I also want another private share where I can allow some people to perform both read and write using username and password.
The private share folder is located under /home/user/SambaShare and my public folder is located under /home/user/Public. user is the username I use to login and use my computer and because both are inside my home directory, they should by default be owned by my user.
On top of that, the Public folder is applied 755 permission so I would assume anyone could read and execute the directory whether that user is a part of my group or not. I learned that execute permission for a directory is necessary else people cannot cd into it.
I have added user as a samba passwd with the command
sudo smbpasswd -a user
ls -l shows the following for Public
drwxr-xr-x 2 user user 4096 Oct 29 18:19 Public
However, when I try to login anonymously from the Network section in the File manager, it says Failed to Mount Windows Share: Invalid Argument.
What is insane is that my private share works as expected. Here is my /etc/samba/smb.conf.Most of it is from Ubuntu default and I have mostly only added stuff at the end but I am sharing the whole config just in case there was something there messing it up.
#
# Sample configuration file for the Samba suite for Debian GNU/Linux.
#
#
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options most of which
# are not shown in this example
#
# Some options that are often worth tuning have been included as
# commented-out examples in this file.
# - When such options are commented with ";", the proposed setting
# differs from the default Samba behaviour
# - When commented with "#", the proposed setting is the default
# behaviour of Samba but the option is considered important
# enough to be mentioned here
#
# NOTE: Whenever you modify this file you should run the command
# "testparm" to check that you have not made any basic syntactic
# errors.
#======================= Global Settings =======================
[global]
## Browsing/Identification ###
# Change this to the workgroup/NT-domain name your Samba server will part of
workgroup = WORKGROUP
# server string is the equivalent of the NT Description field
server string = %h server (Samba, Ubuntu)
#### Networking ####
# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
; interfaces = 127.0.0.0/8 eth0
# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself. However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
; bind interfaces only = yes
#### Debugging/Accounting ####
# This tells Samba to use a separate log file for each machine
# that connects
log file = /var/log/samba/log.%m
# Cap the size of the individual log files (in KiB).
max log size = 1000
# We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.
# Append syslog@1 if you want important messages to be sent to syslog too.
logging = file
# Do something sensible when Samba crashes: mail the admin a backtrace
panic action = /usr/share/samba/panic-action %d
####### Authentication #######
# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller".
#
# Most people will want "standalone server" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
server role = standalone server
obey pam restrictions = yes
# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
unix password sync = yes
# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
pam password change = yes
# This option controls how unsuccessful authentication attempts are mapped
# to anonymous connections
map to guest = bad user
########## Domains ###########
#
# The following settings only takes effect if 'server role = classic
# primary domain controller', 'server role = classic backup domain controller'
# or 'domain logons' is set
#
# It specifies the location of the user's
# profile directory from the client point of view) The following
# required a [profiles] share to be setup on the samba server (see
# below)
; logon path = \\%N\profiles\%U
# Another common choice is storing the profile in the user's home directory
# (this is Samba's default)
# logon path = \\%N\%U\profile
# The following setting only takes effect if 'domain logons' is set
# It specifies the location of a user's home directory (from the client
# point of view)
; logon drive = H:
# logon home = \\%N\%U
# The following setting only takes effect if 'domain logons' is set
# It specifies the script to run during logon. The script must be stored
# in the [netlogon] share
# NOTE: Must be store in 'DOS' file format convention
; logon script = logon.cmd
# This allows Unix users to be created on the domain controller via the SAMR
# RPC pipe. The example command creates a user account with a disabled Unix
# password; please adapt to your needs
; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u
# This allows machine accounts to be created on the domain controller via the
# SAMR RPC pipe.
# The following assumes a "machines" group exists on the system
; add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u
# This allows Unix groups to be created on the domain controller via the SAMR
# RPC pipe.
; add group script = /usr/sbin/addgroup --force-badname %g
############ Misc ############
# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
; include = /home/samba/etc/smb.conf.%m
# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
; idmap config * : backend = tdb
; idmap config * : range = 3000-7999
; idmap config YOURDOMAINHERE : backend = tdb
; idmap config YOURDOMAINHERE : range = 100000-999999
; template shell = /bin/bash
# Setup usershare options to enable non-root users to share folders
# with the net usershare command.
# Maximum number of usershare. 0 means that usershare is disabled.
# usershare max shares = 100
# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
usershare allow guests = yes
#======================= Share Definitions =======================
# Un-comment the following (and tweak the other settings below to suit)
# to enable the default home directory shares. This will share each
# user's home directory as \\server\username
;[homes]
; comment = Home Directories
; browseable = no
# By default, the home directories are exported read-only. Change the
# next parameter to 'no' if you want to be able to write to them.
; read only = yes
# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
; create mask = 0700
# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
; directory mask = 0700
# By default, \\server\username shares can be connected to by anyone
# with access to the samba server.
# Un-comment the following parameter to make sure that only "username"
# can connect to \\server\username
# This might need tweaking when using external authentication schemes
; valid users = %S
# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
; comment = Network Logon Service
; path = /home/samba/netlogon
; guest ok = yes
; read only = yes
# Un-comment the following and create the profiles directory to store
# users profiles (see the "logon path" option above)
# (you need to configure Samba to act as a domain controller too.)
# The path below should be writable by all users so that their
# profile directory may be created the first time they log on
;[profiles]
; comment = Users profiles
; path = /home/samba/profiles
; guest ok = no
; browseable = no
; create mask = 0600
; directory mask = 0700
#[printers]
# comment = All Printers
# browseable = no
# path = /var/spool/samba
# printable = yes
# guest ok = no
# read only = yes
# create mask = 0700
# Windows clients look for this share name as a source of downloadable
# printer drivers
# [print$]
# comment = Printer Drivers
# path = /var/lib/samba/printers
# browseable = yes
# read only = yes
# guest ok = no
# Uncomment to allow remote administration of Windows print drivers.
# You may need to replace 'lpadmin' with the name of the group your
# admin users are members of.
# Please note that you also need to set appropriate Unix permissions
# to the drivers directory for these users to have write rights in it
; write list = root, @lpadmin
[my_public_share]
path=/home/user/Public
read only=yes
browseable=yes
create mask = 0644
directory mask = 0755
guest ok=yes
guest only=no
force user=nobody # Ensure any file created in this share is owned by this user
[my_private_share]
path=/home/user/SambaShare
browseable=yes
read only=no
guest ok=no
valid users=user
# valid users is comma seperated listAlso, here is the log file /var/log/samba/log.
[2024/10/29 18:21:31.607361, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:21:31.607809, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:21:31.607938, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:21:31.608286, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:21:31.608463, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:21:52.527151, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:21:52.527604, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:21:52.527814, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:21:52.528231, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:21:52.528377, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:31:17.354190, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:31:17.354707, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:31:17.354843, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:31:17.355382, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:31:17.355567, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:47:21.757292, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:47:21.757822, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:47:21.758110, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:47:21.758663, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:47:21.758891, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:53:13.202809, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:53:13.203198, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:53:13.203325, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:53:13.203784, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 18:53:13.203917, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:00:57.830267, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:00:57.830754, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:00:57.830900, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:00:57.831251, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:00:57.831374, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:01:47.853943, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:01:47.854430, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:01:47.854665, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:01:47.855029, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:01:47.855145, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:11:43.330794, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:11:43.331348, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:11:43.331487, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:11:43.331903, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 19:11:43.332041, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 21:00:55.777001, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 21:00:57.166864, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 21:00:57.188688, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 21:01:01.914315, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 21:02:14.926962, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 21:02:16.523451, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 21:02:16.526750, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534 [2024/10/29 21:02:17.594671, 0] ../../source3/smbd/service.c:168(chdir_current_service) chdir_current_service: vfs_ChDir(/home/user/Public) failed: Permission denied. Current token: uid=65534, gid=65534, 1 groups: 65534
I am kind of new into this stuff. Is there something I missed or did horribly? I did not want to create a new user because it may not be necessary, its okay if I use my regular user user as I am only turining SAMBA when I need it and is disabled in systemd.
One thing I am also confused is that even though Public folder is owned by user, I have set 755 permission meaning that I would expect the owner to have full permission, the members in the same group as user has the permission to read and execute and everyone else has the permission to read and execute. Because everyone is able to read and execute I would expect EVERYONE to be able to read and execute. Is nobody user not included in there?
I recommend to create a dedicated user for that share and specify it in force user(see docs).
Create a user (shareuser for example) and set the owner of everything in the share folder to that user:
adduser --system shareuser
chown -R shareuser /path/to/share
Then add force user and permission mask settings in smb.conf:
[myshare]
path = /path/to/share
writeable = yes
browseable = yes
public = yes
create mask = 0644
directory mask = 0755
force user = shareuser
Note that guest ok is a synonym for public.
In the share settings in smb.conf, you'll need to specify the names of users and/or groups that are allowed to write to the share, using a write list = ... line.
Example:
[myshare]
...
write list = my_linux_username
Then you'll need to use the smbpasswd command to set up a password to authenticate my_linux_username for Samba:
sudo smbpasswd -a my_linux_username
This step is necessary because the standard system passwords in /etc/shadow are hashed in algorithms that are incompatible with the password hash algorithms used in the SMB protocol. When a client sends a SMB authentication packet, it includes a hashed password. It can only be compared to another password hash that uses the same algorithm.
(Very, very old instructions from the previous millennium may recommend disabling password encryption in Samba, and using certain registry hacks to allow Windows to emit unencrypted passwords to the network. This advice is obsolete: those registry hacks may no longer work in current versions of Windows, and allow anyone who can monitor your network traffic to trivially capture your password.)
There's one more thing you may have to do client-side. When your Windows client system is joined to an Active Directory domain and you're logged in with an AD account, it automatically prefixes all unqualified usernames with the name of the AD domain of the user, i.e. you will be authenticating as AD_DOMAIN\your_username, not just your_username.
If you are logged in with a local account (or your client system is not joined to an AD domain), Windows may automatically prefix the username with the client hostname unless you specify another domain name.
To successfully log in to a stand-alone Samba server from a stand-alone Windows client, you may have to specify your username as SAMBA_SERVER_HOSTNAME\your_username.
Otherwise Samba will see the username as WINDOWS_CLIENT_HOSTNAME\your_username, conclude that it has no way to verify any users belonging to domain named WINDOWS_CLIENT_HOSTNAME, and will reject the login.
(Newer versions of Samba may have a built-in check for this specific situation, and they might allow you access nevertheless. But this is basically how SMB authentication works "under the hood", and if you need to deal with old versions of Samba, it might be useful still.)
Use case: File server on local network. All clients are under my control, so I have (for the past 20 years or so!) had no need for accounts or authentication. I just want files to be created with sane ownerships & permissions.
I recently upgraded my file server from CentOS 6 to Fedora 32, so bit of a leap in Samba version, from 2.x (?) to 4.12.
Given the simple requirement, I live in hope I can get this working without too much further pain. With the smb.conf shown below, I keep seeing the following error when attempting to navigate mapped drives -- this happens in both Win 7 & Win 10:
Z:\ is not accessible. The process cannot access the file because it is being used by another process.
Perhaps I need to make some sacrifices to the auth gods, or do some tweaks in Windows? Or maybe there's something I'm overlooking in Samba config? If I need to set up a user, I'll do it. My going in position is to Keep it Simple, or as simple as possible. Relevant components are:
Clients: Windows 7 Windows 10 Server: Fedora 32 (Server Edition) Linux 5.6.8-300.fc32.x86_64 #1 SMP Wed Apr 29 19:01:34 samba-4.12.2-0.fc32.1
Using a basic configuration found on the Samba Wiki, I added the 4 lines at the bottom.
# smb.conf [global] map to guest = Bad User log file = /var/log/samba/%m log level = 1 [share1] path = /local/share1/ read only = no guest ok = yes guest only = yes force user = anonu force group = anong create mode = 0664 directory mode = 0775
Has anyone figured this out for these tech versions, and if so, what New Thing am I missing?