samba - Sep 2023 - anonymous samba server with unauthenticated guest access policy

27.09.2023 12:38, Rowland Penny via samba:
> On Wed, 27 Sep 2023 11:39:00 +0300
> Michael Tokarev via samba <samba at lists.samba.org> wrote:
> 
>> Hi!
>>
>> What's the best way to have an anonymous samba server (with
read-only
>> shares only, users can't modify anything) with todays windows which
>> block unauthenticated guest access by default and require signing?
>>
>> Is the only solution (besides unblocking which is not nice) is to add
>> this server to the domain in question?
> Hi Michael, it is my understanding that if it is the Windows machine
> that has guest access turned off, then there is nothing that Samba can
> do to re-enable it, so you must use authenticated users.
Heh.  It's as good answer as useless.  But ok :)

Is there an alternative to joining samba server to domain in question?

Also, for this mode of operation (read-only anonymous access), how can
one run samba as non-root unpriv user?

Thanks,

/mjt

On Wed, 27 Sep 2023 12:56:19 +0300
Michael Tokarev via samba <samba at lists.samba.org> wrote:
> 27.09.2023 12:38, Rowland Penny via samba:
> > On Wed, 27 Sep 2023 11:39:00 +0300
> > Michael Tokarev via samba <samba at lists.samba.org> wrote:
> > 
> >> Hi!
> >>
> >> What's the best way to have an anonymous samba server (with
> >> read-only shares only, users can't modify anything) with
todays
> >> windows which block unauthenticated guest access by default and
> >> require signing?
> >>
> >> Is the only solution (besides unblocking which is not nice) is to
> >> add this server to the domain in question?
> 
> > Hi Michael, it is my understanding that if it is the Windows machine
> > that has guest access turned off, then there is nothing that Samba
> > can do to re-enable it, so you must use authenticated users.
> 
> Heh.  It's as good answer as useless.  But ok :)
No, it isn't useless, it is a fact. If guest access is turned off on a
Windows machine (currently win10 pro and up, I believe), then nothing
you can do on or with a Samba server will turn it back on again, you
have to turn it on again in Windows.

You can run Samba as a standalone server, AD DC, Domain member etc and
have all the required guest parameters set correctly and you still will
not get anonymous access from a Windows machine if it is turned off on
the Windows machine.

Rowland