UNIX for Dummies Questions & Answers

Hi,


I am trying to comprehend Samba's behaviour on one of my Arch systems and thus I'd like to ask a couple of quick questions:


The setup I'd like to build is just a small home network for file-sharing using guest connections.

Here it goes,


1) When using the following settings for guest connections,
map to guest = bad user guest account = nobody
does user 'nobody' have to exist both on Samba AND on the system's accounts?
If yes, is there any other way I can use Samba to serve guest connections without the need to create their respective system accounts? Why is that so?


2) If I change the second option to
guest account = myUnixAccountName
I notice that the system works perfectly well and serves guest connections just fine.
But how is that possible since myUnixAccountName doesn't exist on Samba?


Thanks in advance!

I am not a samba expert, or even an arch user, so regard the following with suspicion. That being said:

Not sure what you mean by "on Samba", but I believe account=nobody exists on any linux device by default, and it will probably be in your account database unless you remove it.

In your example, 'guest account' maps account=guest (in the windows world) to account=myUnixAccountName in the linux world. Since you setup the device, I'm guessing you did so using account=myUnixAccountName, so now every guest access runs with your privileges. This may not be what you want, but at least it's useful for testing.

samba always expects its own usernames to match system ones. That's how they login -- a samba password associated with a local system username. When samba has an entry and /etc/passwd doesn't, samba considers that file corruption!

So yes -- there does have to be a 'nobody' user. Linux systems almost always have one anyway, a do-nothing user with no home directory, no password, and access to nothing significant. If you check ps aux you'll probably find daemons running as nobody.

Since Windows can have very long and strange usernames which UNIX would refuse to keep in /etc/passwd, there has to be some way to translate them into local usernames. That's what smbusers is for.

It's just a text replacement which happens before login. So as long as you translate those user names into a local username, it's okay.

Note that samba doesn't care about your system passwords, just the samba ones, which is why samba can login to 'nobody', which shouldn't have a password for local logins.

Thanks for all this useful information.
However, when I tried to map the guest account to 'nobody', the system didn't work. Only when I created the UNIX account 'nobody' did the system work (or when I just used myUnixAccountName). Therefore I assume 'nobody' didn't exist on my system...could that be the case?

Thanks to both of you for your time and effort.

I can't tell you whether it existed or not, and probably neither can you by this point... if it had an entry in /etc/passwd it existed, if it didn't it didn't.

If you did have to create your own nobody account, you might want to secure it now. Set its login shell to some nonsense like /bin/false, make sure the UNIX account for it has no password, remove it from all groups, give it a home directory of /, and so forth. Nobody will be able to login to it except samba, and it will have access to only world-readable things.