We recently migrated to Samba 4.4.16 (from 3.5.15).
Our configuration contains a number of shares which have group access only (@group or +group) which map to unix groups. Here's an excerpt of the config:
[global]
bind interfaces only = yes
interfaces = lo eth0
netbios name = OURSERVER
server string = Office Intranet (OURSERVER) Server Version %v
workgroup = WORKGROUP
domain master = yes
preferred master = yes
os level = 34
dns proxy = no
log level = 3
log file = /var/log/samba/log.%m
max log size = 50
nmbd bind explicit broadcast = No
printcap name = cups
name resolve order = wins hosts
passdb backend = tdbsam:/etc/samba/passdb.tdb
obey pam restrictions = yes
passwd chat debug = yes
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
security = user
encrypt passwords = yes
map to guest = Bad User
wins support = Yes
idmap config * : backend = tdb
cups options = raw
use client driver = Yes
hosts allow = 127.0.0.1 192.168.0.0/24
case sensitive = no
invalid users = root
username map script = /bin/echo
restrict anonymous = 2
[homes]
comment = Home Directories
path = /data/home/%u
hide files = /.*/
veto files = /.*/lost+found/bin/httpd/public/.vacation.*/.forward/
follow symlinks = No
create mask = 0755
read only = No
[Stuff]
comment = All your base are belong to us
path = /data/shares/stuff
hide files = /.*/
veto files = /.*/lost+found/bin/httpd/public/.vacation.*/.forward/
follow symlinks = No
access based share enum = Yes
create mask = 0770
directory mask = 0770
force group = entitled
force user = docman
read only = No
valid users = @entitled
This works on smbclient -L OurServer
:
$ smbclient -L OURSERVER
WARNING: The "syslog" option is deprecated
Enter WORKGROUP\funster's password:
Domain=[OURSERVER] OS=[Windows 6.1] Server=[Samba 4.4.16]
Sharename Type Comment
--------- ---- -------
homes Disk Home Directories
funster Disk Home Directories
Stuff Disk All your base are belong to us
IPC$ IPC IPC Service (Office Intranet (OURSERVER) Server Version 4.4.16)
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP
But not on smbtree
or Nautilus because neither ask for a password by default:
$ smbtree
WORKGROUP
\\OURSERVER Office Intranet (OURSERVER) Server Version 4.4.16
However:
$ smbtree -Ufunster%p4ssw0rd
WORKGROUP
\\OURSERVER Office Intranet (OURSERVER) Server Version 4.4.16
\\OURSERVER\funster Home Directories
\\OURSERVER\IPC$ IPC Service (Office Intranet (OURSERVER) Server Version 4.4.16)
\\OURSERVER\homes Home Directories
\\OURSERVER\Stuff All your base are belong to us
Without restrict anonymous = 2
, anonymous logins are allowed, BUT Nautilus and smbtree
shows only the homes
share even though the others are accessible directly.
How can I force Nautilus and smbtree
to ask for a password so that it sees the group shares?
smbtree
should ask for a password, it says so in the man page, quote "nless a password is specified on the command line or this parameter is specified, the client will request a password." - Maybe its a bug ?smbtree
is asking for a password4.3.11-Ubuntu
installed. What version of Ubuntu are you on and what version ofsmbtree
?-N
switch. I'm using Ubuntu 17.10 on the client, and the server is Alpine 3.4 on Docker on Ubuntu 17.10.