Happened to stumble across this thread on the Ubuntu forums, and thought it might help. It explains the steps that happen behind the scenes:

In Windows the client's username and password is automatically sent when it browses for shares - this is done without the user's knowledge. That forces Samba to deal with the sent credentials even though it's a guest share that requires no authentication.

When that username is passed Samba will search through it's password database for that user:

  • If there is no match to the username the client user is tagged a "Bad User" and converted ( mapped ) to the guest account which by default is "nobody".

  • If it finds a match to the username and there is a samba password that matches the one sent by the Windows client then the Windows user automatically gains access although not as an anonymous user which is why you needed to add "force user = nobody" to your share definition.

  • If it finds a match to the username but the samba password does not match exactly the password that's automatically sent by the Windows client then you will be prompted for a password - even for a guest share.

Try adding force user = nobody to your share definition, and see if that does it.

Edit 02/20/2013:

Is testparm returning an exit code of something other than zero? All the same, I would go ahead and give that area of the config a good, hard look. Also, I'm not sure how case-sensitive smb.conf is, but every example I see (for example) of map to guest = Bad User has the B and U capitalized. Check-out the Samba man pages for the options you are using, and double-check everything.

Answer from Aaron on askubuntu.com
Top answer
1 of 5
10

Happened to stumble across this thread on the Ubuntu forums, and thought it might help. It explains the steps that happen behind the scenes:

In Windows the client's username and password is automatically sent when it browses for shares - this is done without the user's knowledge. That forces Samba to deal with the sent credentials even though it's a guest share that requires no authentication.

When that username is passed Samba will search through it's password database for that user:

  • If there is no match to the username the client user is tagged a "Bad User" and converted ( mapped ) to the guest account which by default is "nobody".

  • If it finds a match to the username and there is a samba password that matches the one sent by the Windows client then the Windows user automatically gains access although not as an anonymous user which is why you needed to add "force user = nobody" to your share definition.

  • If it finds a match to the username but the samba password does not match exactly the password that's automatically sent by the Windows client then you will be prompted for a password - even for a guest share.

Try adding force user = nobody to your share definition, and see if that does it.

Edit 02/20/2013:

Is testparm returning an exit code of something other than zero? All the same, I would go ahead and give that area of the config a good, hard look. Also, I'm not sure how case-sensitive smb.conf is, but every example I see (for example) of map to guest = Bad User has the B and U capitalized. Check-out the Samba man pages for the options you are using, and double-check everything.

2 of 5
10

This is how OpenElec is configured. Should do what you are asking for. (even if it is a year later...maybe it will help the next one) Just tweak the share settings as needed.

[global]
  server string = YOURSERVERNAME
  workgroup = WORKGROUP
  netbios name = %h
  security = share
  guest account = root
  socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
  smb ports = 445
  max protocol = SMB2
  min receivefile size = 16384
  deadtime = 30
  os level = 20
  mangled names = no
  syslog only = yes
  syslog = 2
  name resolve order = lmhosts wins bcast host
  preferred master = auto
  domain master = auto
  local master = yes
  printcap name = /dev/null
  load printers = no
  browseable = yes
  writeable = yes
  printable = no
  encrypt passwords = true
  enable core files = no
  passdb backend = smbpasswd
  smb encrypt = disabled
  use sendfile = yes

[share]
comment = Share
path = /share
available = yes
browsable = yes
writable = yes
public = yes
🌐
SambaWiki
wiki.samba.org › index.php › Setting_up_Samba_as_a_Standalone_Server
Setting up Samba as a Standalone Server - SambaWiki
[global] map to guest = Bad User log file = /var/log/samba/%m log level = 1 server role = standalone server [guest] # This share allows anonymous (guest) access # without authentication!
Discussions

Anonymous user on Samba | The FreeBSD Forums
So, I need to set up a specify user, ie guest, for anonymous access and provide a password?.. This example makes it seem that very straightforward, but I'm not finding it that way. Software versions: CentOS 6.6 x64 Samba 4.0.0-66.el6_6.rc4 (from YUM) Problem: I am trying to create a Samba share on ... More on forums.freebsd.org
🌐 forums.freebsd.org
December 20, 2023
How to create a Samba share that is writable from Windows without 777 permissions? - Unix & Linux Stack Exchange
I have a path on a Linux machine (Debian 8) which I want to share with Samba 4 to Windows computers (Win7 and 8 in a domain). In my smb.conf I did the following: [myshare] path = /path/to/share wri... More on unix.stackexchange.com
🌐 unix.stackexchange.com
Trouble setting up an anonymous samba share
Hello, i’m trying to setup a read and writeable samba share on a second internal disk. So far i can see the share on my windows 10 machine, but i cannot access it: “You do not have permission to access…” My smb.conf looks like: [global] workgroup = WORKGROUP wins support = yes security ... More on discussion.fedoraproject.org
🌐 discussion.fedoraproject.org
6
0
May 13, 2021
Anonymous Access to Shares for PMS
You can either use NFS, or do following steps for SMB: 1 Open Control Panel -> User & Group 2 Double Click on guest user, uncheck Deactivate this account, Click on Save button 3 Control Panel -> Shared Folder -> Create or Find the folder we want to share without password/login/username and Click on it 4 Click on Edit button if the folder is already there -> Permissions 5 Find guest user, and give it Read/Write permission Edit: src: https://dannyda.com/2022/09/11/how-to-allow-users-access-shared-folders-without-password-login-for-synology-dsm-shared-folders-how-to-create-a-shared-folder-sharing-without-login-username-password-etc/ "Enabling local master browser" does essentially the same thing, plus some extras: https://kb.synology.com/en-vn/DSM/help/DSM/AdminCenter/file_winmacnfs_win?version=7 Edit 2: allow remote anonymous access to a share inside my LAN This is the worst possible idea. Why is your PMS outside your LAN? If so, use a VPN. SMB over the internet isn't something I would do or recommend. More on reddit.com
🌐 r/synology
7
0
January 31, 2023
🌐
Kenfavors
kenfavors.com › code › configure-samba-file-sharing-in-ubuntu
Configure Samba File Sharing In Ubuntu – Ken Favors . com
Server role: ROLE_STANDALONE Press enter to see a dump of your service definitions <-- Press Enter # Global parameters [global] netbios name = UBUNTU server string = Samba Server %v security = USER map to guest = Bad User dns proxy = No idmap config * : backend = tdb [Anonymous] path = /samba/anonymous force user = nobody read only = No guest ok = Yes [secured] path = /samba/secured valid users = @smbgrp read only = No · Now you can use the network browser of the Windows file explorer to connect to the secured share.
🌐
MangoLassi
mangolassi.it › topic › 10112 › creating-an-anonymous-samba-share-in-centos-7
Creating an anonymous samba share in CentOS 7 | MangoLassi
August 21, 2016 - setsebool -P samba_export_all_ro=1 samba_export_all_rw=1 getsebool –a | grep samba_export yum install policycoreutils-python semanage fcontext –at samba_share_t "/home/public(/.*)?" restorecon /home/public · You should have a writable anonymous share that can be accessed from your Windows Clients.
🌐
TechRepublic
techrepublic.com › home › software
How to create a passwordless guest share in Samba - TechRepublic
March 14, 2022 - To make sure Samba is only listening to that interface locate the below line: ... [public] path = /home/share public = yes guest only = yes writable = yes force create mode = 0666 force directory mode = 0777 browseable = yes · Save and close the file. ... Next, we’re must create a directory to house the shares. Back at the terminal, create the directory with: ... At this point, the newly-created share should be accessible via anonymous access.
🌐
Medium
sourabhdey21.medium.com › samba-configuration-anonymous-user-965b6d81c5ad
Samba Configuration Anonymous User | by Sourabh Dey | Medium
March 5, 2022 - [global] workgroup = WORKGROUP server string = Samba Server %v netbios name = Rhel7 security = user map to guest = bad user dns proxy = no ... [Anonymous] path = /srv/samba/anonymous browsable = yes writable = yes guest ok = yes read only = no
Find elsewhere
Top answer
1 of 4
9

In order to set up guest access in Samba, you need to set up a user that it will pretend to log in as. So, let's say you want to share files on /mnt/somepartition/files publically. Your configuration might look like this:

[public_files]
    comment = Public files
    path = /mnt/somepartition/files
    browsable = yes
    guest ok = yes
    writable = yes
    guest account = someusername
    create mask = 0775
    directory mask = 0755

What this saying is "Create a samba share on \mymachine\public_files that is viewable to anonymous users (not hidden like user files generally are) and enable it for write access. Anonymous users can access this share by using someusername's credentials. When files are created, make them globally executable but restrict write access globally. When directories are created, make them globally executable but only writable by someusername."

Once this is done, you will need to create a smbpassword, per your question. To do this, ensure first that the user exists within your server. If the user doesn't, create it:

sudo adduser someusername

Once the user exists, create a samba login:

sudo smbpasswd -a someusername

A couple of things to keep in mind: the directory that public_files points to will need to be READ accessible to someusername. Make sure you set the permissions correctly. If the directory is owned by you but still want to make them available, add someusername to a common group and then change the group ownership.

2 of 4
0

How I got it to work on my Pi running dietpi. It works with Windows (10), Mac (Catalina) and Linux clients, and has read+write permissions. Note: I automount the USBHDD to /media/USBHDD at startup

Contents of smb.conf:

[global]
        workgroup = WORKGROUP
        server string = %h server
        dns proxy = no
        log file = /var/log/samba/log.%m
        max log size = 1000
        syslog only = no
        syslog = 0
        panic action = /usr/share/samba/panic-action %d
        security = user
        encrypt passwords = true
        passdb backend = tdbsam
        obey pam restrictions = yes
        unix password sync = yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        pam password change = yes
        map to guest = bad user
        load printers = no
        printcap name = /dev/null
        disable spoolss = yes
[dietpi]
        comment = DietPi Share
        path = /mnt/dietpi_userdata
        browseable = yes
        create mask = 0664
        directory mask = 0775
        valid users = dietpi
        writeable = yes
[PiNAS]
        path = /media/USBHDD
        browseable = yes
        read only = no
        guest ok = yes
        writeable = yes
        create mask = 0775
        directory mask = 0755
max connections = 8
🌐
Raspberry Pi Forums
forums.raspberrypi.com › board index › projects › networking and servers
anonymous passwordless samba share - Raspberry Pi Forums
Yes, don't share a directory in a users home directory, only the user will be able to traverse to it, I would create a directory under /srv and share that. Also check that '[global]' in the smb.conf file contains this line: ... [V] path = /srv/V guest ok = yes guest only = yes read only = no With that, any unknown Samba users should be able to connect to the share, provided they are not Windows pro users (they have guest access turned off by default).
🌐
FreeBSD
forums.freebsd.org › server and networking › web and network services
Anonymous user on Samba | The FreeBSD Forums
December 20, 2023 - [global] map to guest = Bad User log file = /var/log/samba/%m log level = 1 server role = standalone server I don't know what to make of 'Bad User'. Do I need to add a user with this name? ... Click to expand... ... Does this avoid a password prompt? How do I mount an SMB share '/var/tmp on /mnt as guest?
Top answer
1 of 5
36

OK, I have found an answer myself.

As this is absolutely not obvious from the docs and HOWTOs and whatever, the reason this thing asks for password is because it cannot map guest user to the owner of the directory being shared.

I have NTFS partitions which I need to mount RW so I used the following setup in my /etc/fstab:

/dev/sdb1  /media/disk1  ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0       2
/dev/sdb2  /media/disk2  ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0       2

The most important pieces of config are uid and gid (maybe only uid, don't know). They are set to the UID and GID of the user jonnie set up on the server (obviously not root). So, when ntfs-3g will mount these disks, everything will be owned by him.

After that, I have added this user to the Samba registry (or maybe created new identical one, don't care):

# smbpasswd -a jonnie

It asked for password, I have entered the same as for the main system.

After that, I have added the force user and force group settings to the smb.conf:

[global]
  workgroup = WORKGROUP
  netbios name = HOMESERV
  security = user
  map to guest = Bad User

[disk1]
  comment = Disk 1 on 400GB HDD
  path = /media/disk1
  browsable = yes
  guest ok = yes
  read only = no
  create mask = 666
  directory mask = 777
  force user = jonnie
  force group = jonnie

[disk2]
  comment = Disk 2 on 400GB HDD
  path = /media/disk2
  browsable = yes
  guest ok = yes
  read only = no
  create mask = 666
  directory mask = 777
  force user = jonnie
  force group = jonnie

So, most important piece of config relevant to me was force user.

Courtesy of the Samba HOWTO

2 of 5
6

The config can be shorter:

Create unix user jonnie

sudo useradd jonnie -s /usr/sbin/nologin

Create smbuser

sudo smbpasswd -a jonnie

Create the Linux directory to share

mkdir /mysmbshare

Change the owner of the directory to jonnie

sudo chown jonnie /mysmbshare

smb.conf

[global]
  workgroup = MyWorkGroup
  server string = Hello, use me
  security = user
  map to guest = Bad User
  guest account = jonnie
  passdb backend = tdbsam
  
[the_public_share]
   path = /mysmbshare
   writable = yes
   printable = no
   public = yes

All files are owned by jonnie and everyone has rw access to the files.

🌐
SambaWiki
wiki.samba.org › index.php › Setting_up_a_Share_Without_Authentication
Setting up a Share Without Authentication - SambaWiki
For details about setting up a share that users can access without authenticating, see Setting up Samba as a Standalone Server.
🌐
Micheljansen
micheljansen.org › blog › entry › 182
Configuring anonymous public shares with Samba 3 | Michel's Exhaust
In my example, I’ve got one public share, on which I want to have full rights for myself and limited (read-only) access to all anonymous users. The name of the share will be “public”: #/etc/samba/smb.conf [public] comment = Public Shares browsable = yes path = /data/pub public = yes writable = no write list = dawuss guest ok = yes
🌐
Raspberry Pi Forums
forums.raspberrypi.com › board index › software › raspberry pi os
Anonymous Samba share on Raspberry Pi3 and Samba 4.2 - Raspberry Pi Forums
If you want to # create files with group=rw permissions, set next parameter to 0775. create mask = 0700 # Directory creation mask is set to 0700 for security reasons. If you want to # create dirs. with group=rw permissions, set next parameter to 0775. directory mask = 0700 # By default, \\server\username shares can be connected to by anyone # with access to the samba server.
Top answer
1 of 5
103

I recommend to create a dedicated user for that share and specify it in force user(see docs).

Create a user (shareuser for example) and set the owner of everything in the share folder to that user:

adduser --system shareuser
chown -R shareuser /path/to/share

Then add force user and permission mask settings in smb.conf:

[myshare]
path = /path/to/share
writeable = yes
browseable = yes
public = yes
create mask = 0644
directory mask = 0755
force user = shareuser

Note that guest ok is a synonym for public.

2 of 5
6

In the share settings in smb.conf, you'll need to specify the names of users and/or groups that are allowed to write to the share, using a write list = ... line.

Example:

[myshare]
...
write list = my_linux_username

Then you'll need to use the smbpasswd command to set up a password to authenticate my_linux_username for Samba:

sudo smbpasswd -a my_linux_username

This step is necessary because the standard system passwords in /etc/shadow are hashed in algorithms that are incompatible with the password hash algorithms used in the SMB protocol. When a client sends a SMB authentication packet, it includes a hashed password. It can only be compared to another password hash that uses the same algorithm.

(Very, very old instructions from the previous millennium may recommend disabling password encryption in Samba, and using certain registry hacks to allow Windows to emit unencrypted passwords to the network. This advice is obsolete: those registry hacks may no longer work in current versions of Windows, and allow anyone who can monitor your network traffic to trivially capture your password.)


There's one more thing you may have to do client-side. When your Windows client system is joined to an Active Directory domain and you're logged in with an AD account, it automatically prefixes all unqualified usernames with the name of the AD domain of the user, i.e. you will be authenticating as AD_DOMAIN\your_username, not just your_username.

If you are logged in with a local account (or your client system is not joined to an AD domain), Windows may automatically prefix the username with the client hostname unless you specify another domain name.

To successfully log in to a stand-alone Samba server from a stand-alone Windows client, you may have to specify your username as SAMBA_SERVER_HOSTNAME\your_username.

Otherwise Samba will see the username as WINDOWS_CLIENT_HOSTNAME\your_username, conclude that it has no way to verify any users belonging to domain named WINDOWS_CLIENT_HOSTNAME, and will reject the login.

(Newer versions of Samba may have a built-in check for this specific situation, and they might allow you access nevertheless. But this is basically how SMB authentication works "under the hood", and if you need to deal with old versions of Samba, it might be useful still.)

🌐
Super User
superuser.com › questions › 1069044 › how-to-set-up-anonymous-read-only-samba-shares
linux - How to set up anonymous read-only samba shares - Super User
[global] workgroup = TOMMY server string = NAS server dns proxy = no interfaces = lo eth0 bind interfaces only = true log level = 2 max log size = 10000 syslog = 0 panic action = /usr/share/samba/panic-action %d security = user encrypt passwords = true passdb backend = tdbsam obey pam restrictions = yes map to guest = Bad User server signing = mandatory ntlm auth = no load printers = no printing = bsd printcap name = /dev/null disable spoolss = yes unix charset = UTF-8 [tmp] comment = Shared data folder path = /home/data read only = no create mask = 0666 force create mode = 0666 directory mask = 0777 force directory mode = 0777 guest ok = yes [photos] comment = Photos path = /home/photos [music] comment = Music files path = /home/music guest ok = yes [documents] comment = Documents repository path = /home/docs guest ok = yes
🌐
Msspace
books.msspace.net › mirrorbooks › linuxcookbook › 0596006403 › linuxckbk-CHP-23-SECT-2.html
Recipe 23.2. Building a Simple Anonymous Samba File Server for Windows
You have a Windows LAN, and you want reliable file sharing without spending a mint on a Windows server license, or having to upgrade hardware. Name resolution, TCP/IP, and Client for Microsoft Networks are installed and working, and all hosts can ping each other by either hostname or IP address.
🌐
Fedora Discussion
discussion.fedoraproject.org › ask fedora
Trouble setting up an anonymous samba share - Fedora Discussion
May 13, 2021 - Hello, i’m trying to setup a read and writeable samba share on a second internal disk. So far i can see the share on my windows 10 machine, but i cannot access it: “You do not have permission to access…” My smb.conf looks like: [global] workgroup = WORKGROUP wins support = yes security = user map to guest = bad user [sambashare] comment = SambaShare path = /mnt/wwn-0x5000039a756056c3/samba-share browseable = yes writeable = yes guest ok = yes guest only = yes read only = no forc...