Happened to stumble across this thread on the Ubuntu forums, and thought it might help. It explains the steps that happen behind the scenes:
In Windows the client's username and password is automatically sent when it browses for shares - this is done without the user's knowledge. That forces Samba to deal with the sent credentials even though it's a guest share that requires no authentication.
When that username is passed Samba will search through it's password database for that user:
If there is no match to the username the client user is tagged a "Bad User" and converted ( mapped ) to the guest account which by default is "nobody".
If it finds a match to the username and there is a samba password that matches the one sent by the Windows client then the Windows user automatically gains access although not as an anonymous user which is why you needed to add "force user = nobody" to your share definition.
If it finds a match to the username but the samba password does not match exactly the password that's automatically sent by the Windows client then you will be prompted for a password - even for a guest share.
Try adding force user = nobody to your share definition, and see if that does it.
Edit 02/20/2013:
Is testparm returning an exit code of something other than zero? All the same, I would go ahead and give that area of the config a good, hard look. Also, I'm not sure how case-sensitive smb.conf is, but every example I see (for example) of map to guest = Bad User has the B and U capitalized. Check-out the Samba man pages for the options you are using, and double-check everything.
Happened to stumble across this thread on the Ubuntu forums, and thought it might help. It explains the steps that happen behind the scenes:
In Windows the client's username and password is automatically sent when it browses for shares - this is done without the user's knowledge. That forces Samba to deal with the sent credentials even though it's a guest share that requires no authentication.
When that username is passed Samba will search through it's password database for that user:
If there is no match to the username the client user is tagged a "Bad User" and converted ( mapped ) to the guest account which by default is "nobody".
If it finds a match to the username and there is a samba password that matches the one sent by the Windows client then the Windows user automatically gains access although not as an anonymous user which is why you needed to add "force user = nobody" to your share definition.
If it finds a match to the username but the samba password does not match exactly the password that's automatically sent by the Windows client then you will be prompted for a password - even for a guest share.
Try adding force user = nobody to your share definition, and see if that does it.
Edit 02/20/2013:
Is testparm returning an exit code of something other than zero? All the same, I would go ahead and give that area of the config a good, hard look. Also, I'm not sure how case-sensitive smb.conf is, but every example I see (for example) of map to guest = Bad User has the B and U capitalized. Check-out the Samba man pages for the options you are using, and double-check everything.
This is how OpenElec is configured. Should do what you are asking for. (even if it is a year later...maybe it will help the next one) Just tweak the share settings as needed.
[global]
server string = YOURSERVERNAME
workgroup = WORKGROUP
netbios name = %h
security = share
guest account = root
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
smb ports = 445
max protocol = SMB2
min receivefile size = 16384
deadtime = 30
os level = 20
mangled names = no
syslog only = yes
syslog = 2
name resolve order = lmhosts wins bcast host
preferred master = auto
domain master = auto
local master = yes
printcap name = /dev/null
load printers = no
browseable = yes
writeable = yes
printable = no
encrypt passwords = true
enable core files = no
passdb backend = smbpasswd
smb encrypt = disabled
use sendfile = yes
[share]
comment = Share
path = /share
available = yes
browsable = yes
writable = yes
public = yes
Anonymous user on Samba | The FreeBSD Forums
How to create a Samba share that is writable from Windows without 777 permissions? - Unix & Linux Stack Exchange
Trouble setting up an anonymous samba share
Anonymous Access to Shares for PMS
Videos
Hi,
I can't believe how difficult this seems to be (or rather how stupid I must be) ...
Could someone please explain to me how to setup a samba share that can be accessed by anyone without a password?
Say I have created the directory I want to share and have installed samba.
What do I put in smb.conf and what else do I have to do?
In order to set up guest access in Samba, you need to set up a user that it will pretend to log in as. So, let's say you want to share files on /mnt/somepartition/files publically. Your configuration might look like this:
[public_files]
comment = Public files
path = /mnt/somepartition/files
browsable = yes
guest ok = yes
writable = yes
guest account = someusername
create mask = 0775
directory mask = 0755
What this saying is "Create a samba share on \mymachine\public_files that is viewable to anonymous users (not hidden like user files generally are) and enable it for write access. Anonymous users can access this share by using someusername's credentials. When files are created, make them globally executable but restrict write access globally. When directories are created, make them globally executable but only writable by someusername."
Once this is done, you will need to create a smbpassword, per your question. To do this, ensure first that the user exists within your server. If the user doesn't, create it:
sudo adduser someusername
Once the user exists, create a samba login:
sudo smbpasswd -a someusername
A couple of things to keep in mind: the directory that public_files points to will need to be READ accessible to someusername. Make sure you set the permissions correctly. If the directory is owned by you but still want to make them available, add someusername to a common group and then change the group ownership.
How I got it to work on my Pi running dietpi. It works with Windows (10), Mac (Catalina) and Linux clients, and has read+write permissions. Note: I automount the USBHDD to /media/USBHDD at startup
Contents of smb.conf:
[global]
workgroup = WORKGROUP
server string = %h server
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
syslog only = no
syslog = 0
panic action = /usr/share/samba/panic-action %d
security = user
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = yes
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
map to guest = bad user
load printers = no
printcap name = /dev/null
disable spoolss = yes
[dietpi]
comment = DietPi Share
path = /mnt/dietpi_userdata
browseable = yes
create mask = 0664
directory mask = 0775
valid users = dietpi
writeable = yes
[PiNAS]
path = /media/USBHDD
browseable = yes
read only = no
guest ok = yes
writeable = yes
create mask = 0775
directory mask = 0755
max connections = 8
OK, I have found an answer myself.
As this is absolutely not obvious from the docs and HOWTOs and whatever, the reason this thing asks for password is because it cannot map guest user to the owner of the directory being shared.
I have NTFS partitions which I need to mount RW so I used the following setup in my /etc/fstab:
/dev/sdb1 /media/disk1 ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0 2
/dev/sdb2 /media/disk2 ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0 2
The most important pieces of config are uid and gid (maybe only uid, don't know).
They are set to the UID and GID of the user jonnie set up on the server (obviously not root). So, when ntfs-3g will mount these disks, everything will be owned by him.
After that, I have added this user to the Samba registry (or maybe created new identical one, don't care):
# smbpasswd -a jonnie
It asked for password, I have entered the same as for the main system.
After that, I have added the force user and force group settings to the smb.conf:
[global]
workgroup = WORKGROUP
netbios name = HOMESERV
security = user
map to guest = Bad User
[disk1]
comment = Disk 1 on 400GB HDD
path = /media/disk1
browsable = yes
guest ok = yes
read only = no
create mask = 666
directory mask = 777
force user = jonnie
force group = jonnie
[disk2]
comment = Disk 2 on 400GB HDD
path = /media/disk2
browsable = yes
guest ok = yes
read only = no
create mask = 666
directory mask = 777
force user = jonnie
force group = jonnie
So, most important piece of config relevant to me was force user.
Courtesy of the Samba HOWTO
The config can be shorter:
Create unix user jonnie
sudo useradd jonnie -s /usr/sbin/nologin
Create smbuser
sudo smbpasswd -a jonnie
Create the Linux directory to share
mkdir /mysmbshare
Change the owner of the directory to jonnie
sudo chown jonnie /mysmbshare
smb.conf
[global]
workgroup = MyWorkGroup
server string = Hello, use me
security = user
map to guest = Bad User
guest account = jonnie
passdb backend = tdbsam
[the_public_share]
path = /mysmbshare
writable = yes
printable = no
public = yes
All files are owned by jonnie and everyone has rw access to the files.
I recommend to create a dedicated user for that share and specify it in force user(see docs).
Create a user (shareuser for example) and set the owner of everything in the share folder to that user:
adduser --system shareuser
chown -R shareuser /path/to/share
Then add force user and permission mask settings in smb.conf:
[myshare]
path = /path/to/share
writeable = yes
browseable = yes
public = yes
create mask = 0644
directory mask = 0755
force user = shareuser
Note that guest ok is a synonym for public.
In the share settings in smb.conf, you'll need to specify the names of users and/or groups that are allowed to write to the share, using a write list = ... line.
Example:
[myshare]
...
write list = my_linux_username
Then you'll need to use the smbpasswd command to set up a password to authenticate my_linux_username for Samba:
sudo smbpasswd -a my_linux_username
This step is necessary because the standard system passwords in /etc/shadow are hashed in algorithms that are incompatible with the password hash algorithms used in the SMB protocol. When a client sends a SMB authentication packet, it includes a hashed password. It can only be compared to another password hash that uses the same algorithm.
(Very, very old instructions from the previous millennium may recommend disabling password encryption in Samba, and using certain registry hacks to allow Windows to emit unencrypted passwords to the network. This advice is obsolete: those registry hacks may no longer work in current versions of Windows, and allow anyone who can monitor your network traffic to trivially capture your password.)
There's one more thing you may have to do client-side. When your Windows client system is joined to an Active Directory domain and you're logged in with an AD account, it automatically prefixes all unqualified usernames with the name of the AD domain of the user, i.e. you will be authenticating as AD_DOMAIN\your_username, not just your_username.
If you are logged in with a local account (or your client system is not joined to an AD domain), Windows may automatically prefix the username with the client hostname unless you specify another domain name.
To successfully log in to a stand-alone Samba server from a stand-alone Windows client, you may have to specify your username as SAMBA_SERVER_HOSTNAME\your_username.
Otherwise Samba will see the username as WINDOWS_CLIENT_HOSTNAME\your_username, conclude that it has no way to verify any users belonging to domain named WINDOWS_CLIENT_HOSTNAME, and will reject the login.
(Newer versions of Samba may have a built-in check for this specific situation, and they might allow you access nevertheless. But this is basically how SMB authentication works "under the hood", and if you need to deal with old versions of Samba, it might be useful still.)