SAMBA: log in as your guest user

ellocco · 01-03-2023, 01:53 AM

I am struggling to properly configure the guest account for Samba.
I would like to grant access to anonymous / guest user to my DVD-drive.
I have found the advice to read the man page in the old thread:

Cannot move files from Linux to a samba NAS

Quote:

Originally Posted by Firerat

[...]

man smb.conf # That is a long read, but it will help
man smbpasswd #

a small taste of man smb.conf

that should help you understand what was going wrong

I agree that the man page is a good starting point, unfortunately the following suggestion is not helpful for me.
I need a hint what is meant here:

Quote:

This user must exist in the password file, but does not require a valid login.

What is meant by: "must exist in the password file"? Which file is meant here? The system wide "password file"?

And than it is proposed to log in as this user:

Quote:

You should test this by trying to log in as your guest user (perhaps by using the su - command) and trying to print

I do not have a clue what to do here :-(

ferrari · 01-03-2023, 02:44 AM

Welcome to LinuxQuestions.org. The samba wiki has some good documentation around this...

https://wiki.samba.org/index.php/Set...ndalone_Server

ellocco · 01-04-2023, 02:08 AM

Quote:

Originally Posted by ferrari

Welcome to LinuxQuestions.org. The samba wiki has some good documentation around this...

https://wiki.samba.org/index.php/Set...ndalone_Server

Thanks this link is really helpful!
Unfortunately, my two questions about the "password file" and the validation of the guest account is still not clear.
The first two things I did, are
1.) add a folder for the guest account & setting the proper rights and
2.) open a section for the guest account inside "smb.conf".

ferrari · 01-04-2023, 03:18 AM

The guest account must exist in the Linux server. By default the guest account is mapped to user "nobody" (which will exist, but the shell is configured to /sbin/nologin). The 'guest account =' can be used to set it to any other such user that may exist similarly, but best left as default IMHO.

See here regarding creating a nologin system user:
https://www.baeldung.com/linux/creat...in-system-user

Hopefully, that clarifies things for you.

Share your current working smb.conf if you need more help.

CmdLineInterface · 01-04-2023, 03:32 AM

Quote:

Originally Posted by ellocco

Thanks this link is really helpful!
Unfortunately, my two questions about the "password file" and the validation of the guest account is still not clear.

1. check out Creating a Local User Account, then compare that with what you see in Creating a Basic authenticated access smb.conf File and Creating a Basic guest only smb.conf File. Then all that against the first paragraph of Guest Account from ferarri's link. That should set you up for success.

2. This is just saying, make sure the username that Guest accounts are associated with has access to all the services you want Guest accounts to have access to. They warn that Unix uses 'nobody' as that account, and that on some systems 'nobody' doesn't have Printer permissions. That's why they recommend redefining that user to 'ftp'.

Further, I defer to experts, and am off to n00b around the forums.

ellocco · 01-05-2023, 02:29 AM

Quote:

Originally Posted by ferrari

The guest account must exist in the Linux server. By default the guest account is mapped to user "nobody" (which will exist, but the shell is configured to /sbin/nologin). The 'guest account =' can be used to set it to any other such user that may exist similarly, but best left as default IMHO.

Thanks!!!
The password file that is meant in the man page "smb.conf" is the global one for the machine.
The proposed user "ftp" needs to exist in this file. To check, if the user "ftp" exist you can type:

Quote:

cat /etc/passwd | grep ftp

The user rights of "ftp" is equal to the ones of user "nobody", "nobody" is expected to exist,
therefore,

Quote:

cat /etc/passwd | grep nobody

should show something like:

Quote:

nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

I understand now what is meant by the remark:

Quote:

You should test this by trying to log in as your guest user (perhaps by using the su - command)

But I am still confused, is the user "nobody" really the right one?
How to check, if the rights of "nobody" are suitable to access a DVD via remote VLC session?

If the access rights of "nobody" are sufficient I can map the guest user to the user "nobody" in my "smb.conf":

Quote:

[DVD]
comment = Samba_DVD
browseable = yes
read only = yes
map to guest = Bad User
guest ok = yes
guest account = nobody
# man pages vfs_fruit: https://www.samba.org/samba/docs/cur...s_fruit.8.html
vfs objects = catia fruit streams_xattr
fruit:resource = file
fruit:metadata = netatalk

ferrari · 01-05-2023, 01:36 PM

Quote:

Originally Posted by ellocco

But I am still confused, is the user "nobody" really the right one?

That is for you to decide as the administrator of your Linux server. It is the guest user for samba by default, and commonly used in many distros. You are free to create a dedicated user for samba guest access.

Quote:

How to check, if the rights of "nobody" are suitable to access a DVD via remote VLC session?

The user "nobody" is usually used for NFS (and samba guest access) only.

You can check the groups a user belongs to using

Code:

groups <username>

Quote:

If the access rights of "nobody" are sufficient I can map the guest user to the user "nologin" in my "smb.conf":

The user is not called "nologin", it is "nobody" and has no ability to login to the Linux system.

sundialsvcs · 01-05-2023, 02:49 PM

If you seriously want to create "a guest account" – which I do not(!) recommend – then that account must correspond to a "real" user. Guests will then act under the auspices of that system user.

"nobody" is a dummy-account that cannot actually be used. The configuration file examples reference this user-id simply as a placeholder.

Nevertheless: I emphasize that "guest accounts" – in any context at all – are not a good idea. Simply create an account for your guests to use, and tell them how to use it. "If you want to share my files, you must have 'real' credentials."

ellocco · 01-05-2023, 05:13 PM

Quote:

Originally Posted by ferrari

That is for you to decide as the administrator of your Linux server. It is the guest user for samba by default, and commonly used in many distros. You are free to create a dedicated user for samba guest access.
[...]

You are right and I am missing the skills of an admin :-(

Physically it acts as a server, but in reality it is a workstation with an integrated DVD-drive.

Unfortunately, I have severe problems to play a DVD in a remote VLC-session, I can start the DVD and can jump
in the menu between the different options, but each time I click on play the whole film VLC crashes, please see my 2nd post:
debug samba / SMB DVD / cdrom share

ferrari · 01-05-2023, 05:23 PM

Quote:

Originally Posted by ellocco

You are right and I am missing the skills of an admin :-(

Physically it acts as a server, but in reality it is a workstation with an integrated DVD-drive.

Unfortunately, I have severe problems to play a DVD in a remote VLC-session, I can start the DVD and can jump
in the menu between the different options, but each time I click on play the whole film VLC crashes, please see my 2nd post:
debug samba / SMB DVD / cdrom share

I've responded to you in that thread.