samba - Apr 2019 - User mapping/login issue

Hai,  
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Rowland Penny via samba
> Verzonden: donderdag 25 april 2019 11:09
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] User mapping/login issue
> 
> On Thu, 25 Apr 2019 10:24:36 +0200
> L.P.H. van Belle <belle at bazuin.nl> wrote:
> 
> > Ps. Smb1 in Win10 ! I mean ofcourse.. 
> > 
> > Step 1: Go to Start button and type Control Panel. You will get
> > Control Panel; Desktop app. Click on it. Step 2: You will get a
> > window with a list of software on it, go to the left side of the
> > panel and click Turn Windows Features On or Off. Step 3:  
> You need to
> > remove the checkmark beside SMB 1.0/CFs File Sharing Support to
> > disable SMB1 for good. If you want to enable it, put a checkmark
> > beside the same.
> > 
> > And after seeing this, 
> > 
> https://docs.microsoft.com/en-us/openspecs/windows_protocols/m
> s-smb2/fac3655a-7eb5-4337-b0ab-244bbcd014e8 
> > @Rowland, can you do a read in this one. 
> > 
> > Your english is better then mine, but i do think this is related. 
> 
> That isn't written in English, it is written by someone who knows
> exactly what it means, but in GEEK
> 
> Basically, I think it means that whatever protocol is used by the
> client, the server has to reply in.
> 
> > Could bug#13698 (marked fixed today) also have influence here. 
> 
> Not sure a MacOS bug has anything to do with it.
> 
> > 
> > And might be related: 
> > 
> https://support.microsoft.com/en-us/help/4046019/guest-access-
> in-smb2-disabled-by-default-in-windows-10-and-windows-ser
> > Cant think of much more. 
> 
> I will say this again, the Windows 'Guest' user has nothing to do
with
> the Linux guest user. On a Samba machine, any user can be mapped to
> the guest user (usually 'nobody') provided the conditions are
right.
Yes, but then negotitate is going on, which user is send back from samba to
windows? ( withing the smb protocol ?)
And keep in mind user "guest" also disabled in windows side... 
I dont know the depth of this..

As shown in the MS link, ( the one close above here), does say.. 
SMB1 continues to use guest access and guest fallback.

But that implicates that you need SMB2 for this and..

if you want to enable insecure guest access, you can configure the following
Group Policy settings:
Computer configuration\administrative templates\network\Lanman Workstation
"Enable insecure guest logons"

Its one he could try also. 
But with you settings, if it does work, i still have a mixed feeling here.. 

> 
> Rowland
>  
> > 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

On Thu, 25 Apr 2019 11:26:25 +0200
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
> > I will say this again, the Windows 'Guest' user has nothing to
do
> > with the Linux guest user. On a Samba machine, any user can be
> > mapped to the guest user (usually 'nobody') provided the
conditions
> > are right.  
> 
> Yes, but then negotitate is going on, which user is send back from
> samba to windows? ( withing the smb protocol ?) And keep in mind user
> "guest" also disabled in windows side... I dont know the depth of
> this..
> 
> As shown in the MS link, ( the one close above here), does say.. 
> SMB1 continues to use guest access and guest fallback.
> 
> But that implicates that you need SMB2 for this and..
> 
> if you want to enable insecure guest access, you can configure the
> following Group Policy settings: Computer
> configuration\administrative templates\network\Lanman Workstation
> "Enable insecure guest logons"
> 
> Its one he could try also. 
> But with you settings, if it does work, i still have a mixed feeling
> here.. 
When you connect from Windows, you connect as a user. This user can be
a normal user or it could be the Windows 'Guest' user (if it isn't
turned off), Samba doesn't care. If 'map to guest = yes' is set in
smb.conf, then any unknown users will be mapped to the Unix guest user.
The unknown user could be called 'fred', or 'DOMAIN\fred', or
'Guest'(if
not turned off), they will all be mapped to the local Unix guest user
(usually 'nobody'). I hope you can see from this that the username
isn't important for allowing guest access, it is that the username must
not exist on the Samba server.

Rowland

On 25/04/19 19:19, Rowland Penny wrote:
> 
> When you connect from Windows, you connect as a user. This user can be
> a normal user or it could be the Windows 'Guest' user (if it
isn't
> turned off), Samba doesn't care. If 'map to guest = yes' is set
in
> smb.conf, then any unknown users will be mapped to the Unix guest user.
> The unknown user could be called 'fred', or 'DOMAIN\fred',
or 'Guest'(if
> not turned off), they will all be mapped to the local Unix guest user
> (usually 'nobody'). I hope you can see from this that the username
> isn't important for allowing guest access, it is that the username must
> not exist on the Samba server.
> 
Earlier I said that access was working for local clients but that was not 
entirely correct.

It turns out that the person who did the upgrades to windows 10 on the local 
clients changed some of the workgroup entries so those clients were also 
unable to access shares.

While waiting for this to be fixed, I tried connecting using BENPARTS\xxx and 
it worked.

I am waiting to hear from any of the remote clients but it's a fair bet that
this will work for them too. Watch this space.

Thanks for your help.

Stephen