OK, I have found an answer myself.

As this is absolutely not obvious from the docs and HOWTOs and whatever, the reason this thing asks for password is because it cannot map guest user to the owner of the directory being shared.

I have NTFS partitions which I need to mount RW so I used the following setup in my /etc/fstab:

/dev/sdb1  /media/disk1  ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0       2
/dev/sdb2  /media/disk2  ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0       2

The most important pieces of config are uid and gid (maybe only uid, don't know). They are set to the UID and GID of the user jonnie set up on the server (obviously not root). So, when ntfs-3g will mount these disks, everything will be owned by him.

After that, I have added this user to the Samba registry (or maybe created new identical one, don't care):

# smbpasswd -a jonnie

It asked for password, I have entered the same as for the main system.

After that, I have added the force user and force group settings to the smb.conf:

[global]
  workgroup = WORKGROUP
  netbios name = HOMESERV
  security = user
  map to guest = Bad User

[disk1]
  comment = Disk 1 on 400GB HDD
  path = /media/disk1
  browsable = yes
  guest ok = yes
  read only = no
  create mask = 666
  directory mask = 777
  force user = jonnie
  force group = jonnie

[disk2]
  comment = Disk 2 on 400GB HDD
  path = /media/disk2
  browsable = yes
  guest ok = yes
  read only = no
  create mask = 666
  directory mask = 777
  force user = jonnie
  force group = jonnie

So, most important piece of config relevant to me was force user.

Courtesy of the Samba HOWTO

Yes, Samba can be a pain. I use it for my home as well as work.

The first thing you should do is start over from scratch to make troubleshooting easier. You can do this by running the command below in the terminal.

dpkg-reconfigure samba-common

Then go to the folder on the samba server that you want to share, and make sure that the user nobody can read and write to the share. This is because the user nobody is the username windows clients use. I usually just make a folder in the / directory just to keep things simple, but the "correct" way would be to make a subfolder of /srv. If you have not modified the permissions already, use the commands below.

sudo chown -R nobody.nogroup the_folder
sudo chmod -R 777 the_folder

You can also test to see if nobody can write to the directory by running the following command as root.

sudo -u nobody touch test_file

Edit your /etc/samba/smb.conf and add the lines below the [printers] share definition.

[share_name]              ;the share name can be what ever you want
browseable = yes
path = the_complete_path_to_the_shared_folder
guest ok = yes
read only = no
create mask = 777

Then when you are done save it and run the following.

testparm

This will will warn you if you made any typos. Next, you just need to restart the samba services.

sudo systemctl restart smbd
sudo systemctl restart nmbd

I finally found the solution:

[global]
workgroup = WORKGROUP
netbios name = NAS
log file = /var/log/samba/log.%m
max log size = 1000
logging = file
panic action = /usr/share/samba/panic-action %d
server role = standalone server
obey pam restrictions = yes
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
map to guest = bad user
usershare allow guests = yes
[public]
path = /home/share
public = yes
guest only = yes
writable = yes
force create mode = 0666
force directory mode = 0777
browseable = yes

creates a share without any user/password login.

You can access it in Windows with \\NAS\public.

Basically, what I think I want but don't know how to do is to have Samba map any user that connects to a specific user on the server (I think it can be done with a user map file), and then additionally, which I haven't found out how to do, have it accept any password as valid (we have PCs with the same user account names and different passwords).

Both can be done using the same map to guest = bad user option in Samba, but unfortunately, "emulating" Guest access in this way is exactly what "Guest" access is in SMB.

One problem is that SMB servers do not receive passwords at all; they use NTLM when outside an AD domain and Kerberos within a domain. NTLM is a challenge/response protocol that additionally produces a session key to both peers, which SMB then uses to authenticate each packet (as well as the entire handshake in SMBv3 – this provides a form of MITM protection when negotiating the encryption key for SMBv3).

However, for challenge/response protocols like NTLM or CHAP to work properly, the server must already know the user's password (shared secret) – without it, the server cannot derive the NTLM session key from just the client's response alone (being able to do so would defeat the point of the protocol), and therefore cannot correctly 'sign' the SMB messages.

So the way "Guest" access in SMB works is that the server must indicate to the client, "Your credentials didn't work but I accepted you as guest anyway", so that the client would know to not require SMB message signing. If the server accepted arbitrary NTLM responses but didn't send the "Guest access" indication (if I'm reading the protocol docs right), this would result in the client failing to connect anyway.

In short, you cannot really emulate guest access without implementing actual guest access. Selecting map to guest = bad user means Samba has to indicate that this is a guest session.

(Although according to docs, only the Enterprise or Education editions of Windows 10 disables this by default, while Home/Pro does not – and if you do not have an AD domain, I think it's unlikely that you'll be using Enterprise...)

What you could do instead is the opposite: Windows does not require the logged-in user to be used for SMB – on failure it will prompt you for credentials (and will even let you save them), so you could use normal SMB authentication but create a single account with a password that everyone knows (write it next to your office Wi-Fi password). You can have a batch script to pre-save the password using cmdkey.

(This also works when accessing a domain-joined file server via Kerberos.)

You need guest ok = yes and guest only = yes on each service definition.

From the man page:

guest only (S)

If this parameter is yes for a service, then only guest connections to the service are permitted. This parameter will have no effect if guest ok is not set for the service.

See the section below on security for more information about this option.

Default: guest only = no

Note that either or both of these can be in the [global] section instead of the service definition. Also public is a synonym for guest ok and only guest is a synonym for guest only.

Happened to stumble across this thread on the Ubuntu forums, and thought it might help. It explains the steps that happen behind the scenes:

In Windows the client's username and password is automatically sent when it browses for shares - this is done without the user's knowledge. That forces Samba to deal with the sent credentials even though it's a guest share that requires no authentication.

When that username is passed Samba will search through it's password database for that user:

• If there is no match to the username the client user is tagged a "Bad User" and converted ( mapped ) to the guest account which by default is "nobody".

• If it finds a match to the username and there is a samba password that matches the one sent by the Windows client then the Windows user automatically gains access although not as an anonymous user which is why you needed to add "force user = nobody" to your share definition.

• If it finds a match to the username but the samba password does not match exactly the password that's automatically sent by the Windows client then you will be prompted for a password - even for a guest share.

Try adding force user = nobody to your share definition, and see if that does it.

Edit 02/20/2013:

Is testparm returning an exit code of something other than zero? All the same, I would go ahead and give that area of the config a good, hard look. Also, I'm not sure how case-sensitive smb.conf is, but every example I see (for example) of map to guest = Bad User has the B and U capitalized. Check-out the Samba man pages for the options you are using, and double-check everything.