Samba Help

If you got some knowledge of Samba and a Windows domain I need your help.

I'm trying to allow anon. access to my samba share over a windows domain. I want my users to not have to authenticate everytime they access the share on the linux box. I have google'd and asked many Sys Admins out there and the only thing that we could come up with was OpenLDAP. But the user would still have to Auth to the share.

If you know any way around this or want to share in the greif known as Samba, please feel free to express right here in this thread.
-Chris

So they would have to have domain access, but then they don't get asked for a user/pass? People without domain access are restricted?

hmmm

Do you use AD? If you do, try having Samba authenticate to OpenLDAP, and have OpenLDAP authenticate thru AD. You have to be Kerberized, but it works great for me.

I've also had good luck having machines authenticate directly to AD, and as long as the user/pass in OpenLDAP on the Samba server is the same as the AD user/pass, you're golden. (again, Kerberos is necessary)

Samba may be a little bit of a pain, but it sure beats the living hell out of SMB.

Good luck to you!

Check out the big brain on Scott2!! What he said.

What OS are the clients? How many clients are there? If its just a few users, just create the users/passwords on your samba box, and they can either browse to the shares, or map them to drive letters via login scripts.

ok so i used this ::

/etc/nsswitch.conf -
passwd: compat winbind
group: compat winbind

then in /etc/pam.d/ -

common-account:
#Commented for winbind to work
#account-required pam_unix.so
account-required pam_winbind.so

common-auth:
auth sufficient pam_winbind.so
auth required pam_unix.so nullok_secure use_first_pass

common-session:
session required pam_unix.so
session required pam_mkhomedir.so umask=0022 skel=/etc/skel/

sudo:
auth sufficient pam_winbind.so
auth required pam_unix.so use_first_pass

common-password:
password required pam_unix.so nullok obscure min=4 max=50 md5


then to /etc/login.defs -
PASS_MAX_LEN 50


THEN I Joined the domain:
net rpc join -D MYDOMAIN -U administrator

So in the smb.conf i gave each user a home well..
mkdir /home/MYDOMAIN


---------------- START SMB.CONF -------------------------
[global]
security = ads
realm = MY.REALM.COM
password server = *
workgroup = MYDOMAIN
winbind separator = +
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
winbind cache time = 10
template homedir = /home/%D/%U
template shell = /bin/bash
invalid users = root
socket options = IPTOS_LOWDELAY TCP_NODELAY SO_SNDBUF=4096 SO_RCVBUF=40$
winbind use default domain = yes
guest account = users
server string = Operations File Server
hosts allow = 192.XX.XX. 127.
interfaces = eth0 lo

#============================ Share Definitions ==============================
[ipoints]
comment = Installation Point Files
path = /opt/appz
read only = yes
public = yes
browseable=yes
available=yes
follow symlinks=no

[jobs]
comment = User Personal Folder
path = /opt/printspool/
valid users = MYDOMAIN+user
public = no
writable = yes
printable = no

[mine]
comment = Mine Personal Folder
path = /opt/minetmp/
valid users = MYDOMAIN+user2
public = no
writable = yes
printable = no
hosts allow = 192.xx.xx.xx

--------------------- END SMB.CONF ---------------------

So thanks to Scott I used AD, but i found a way around the kerberos issue, cause it really does complicate things, when PAM is sooo much easier to use. Thanks again Scott for bouncing that idea.. Your right BTW samba is a big pain.

DarthSoCal - I have over 200+ users just in the one domain. i have people in different domains too. as well as accross the country. It would be so hard to and complicated for that many people. But if it were a few than i would agree if it were like 2-5.

Client OS = Windows 2000 & XP
Domain Server OS = Windows 2k3
Samba Server OS = Ubuntu


Thanks again everyone please feel free to keep this and use it as your own... it works.
Client logs into the domain and thats it, the Linux/Samba verify against the AD for access.
A batch script loads from the domain server at user login to map the shares for each group of users. If you need any help with that drop me a line.

-Chris
Asst. Sys. Admin.