1.12. Configuring a share to allow access without authentication
In certain situations, you want to share a directory to which users can connect without authentication. To configure this, enable guest access on a share.
Shares that do not require authentication can be a security risk.
1.12.1. Enabling guest access to a share 复制链接链接已复制到粘贴板!
If guest access is enabled on a share, Samba maps guest connections to the operating system account set in the guest account parameter. Guest users can access files on this share if at least one of the following conditions is satisfied:
- The account is listed in file system ACLs
-
The POSIX permissions for
otherusers allow it
例 1.6. Guest share permissions
If you configured Samba to map the guest account to nobody, which is the default, the ACLs in the following example:
-
Allow guest users to read
file1.txt -
Allow guest users to read and modify
file2.txt -
Prevent guest users to read or modify
file3.txt
-rw-r--r--. 1 root root 1024 1. Sep 10:00 file1.txt
-rw-r-----. 1 nobody root 1024 1. Sep 10:00 file2.txt
-rw-r-----. 1 root root 1024 1. Sep 10:00 file3.txt
Procedure
Edit the
/etc/samba/smb.conffile:If this is the first guest share you set up on this server:
Set
map to guest = Bad Userin the[global]section:[global] ... map to guest = Bad UserWith this setting, Samba rejects login attempts that use an incorrect password unless the user name does not exist. If the specified user name does not exist and guest access is enabled on a share, Samba treats the connection as a guest log in.
By default, Samba maps the guest account to the
nobodyaccount on Red Hat Enterprise Linux. Alternatively, you can set a different account. For example:[global] ... guest account = user_nameThe account set in this parameter must exist locally on the Samba server. For security reasons, Red Hat recommends using an account that does not have a valid shell assigned.
Add the
guest ok = yessetting to the[example]share section:[example] ... guest ok = yes
Verify the
/etc/samba/smb.conffile:# testparmReload the Samba configuration:
# smbcontrol all reload-config