Follow Techotopia on Twitter

On-line Guides
All Guides
eBook Store
iOS / Android
Linux for Beginners
Office Productivity
Linux Installation
Linux Security
Linux Utilities
Linux Virtualization
Linux Kernel
System/Network Admin
Scripting Languages
Development Tools
Web Development
GUI Toolkits/Desktop
Mail Systems
Eclipse Documentation

How To Guides
General System Admin
Linux Security
Linux Filesystems
Web Servers
Graphics & Desktop
PC Hardware
Problem Solutions
Privacy Policy




Samba HowTo Guide
Prev Home Next

Share-Level Security

In share-level security, the client authenticates itself separately for each share. It sends a password along with each tree connection request (share mount), but it does not explicitly send a username with this operation. The client expects a password to be associated with each share, independent of the user. This means that Samba has to work out what username the client probably wants to use, the SMB server is not explicitly sent the username. Some commercial SMB servers such as NT actually associate passwords directly with shares in share-level security, but Samba always uses the UNIX authentication scheme where it is a username/password pair that is authenticated, not a share/password pair.

To understand the MS Windows networking parallels, think in terms of MS Windows 9x/Me where you can create a shared folder that provides read-only or full access, with or without a password.

Many clients send a session setup request even if the server is in share-level security. They normally send a valid username but no password. Samba records this username in a list of possible usernames. When the client then issues a tree connection request, it also adds to this list the name of the share they try to connect to (useful for home directories) and any users listed in the user parameter in the smb.conf file. The password is then checked in turn against these possible usernames. If a match is found, then the client is authenticated as that user.

Where the list of possible user names is not provided, Samba makes a UNIX system call to find the user account that has a password that matches the one provided from the standard account database. On a system that has no name service switch (NSS) facility, such lookups will be from the /etc/passwd database. On NSS enabled systems, the lookup will go to the libraries that have been specified in the nsswitch.conf file. The entries in that file in which the libraries are specified are:

passwd: files nis ldap
shadow: files nis ldap
group: files nis ldap

In the example shown here (not likely to be used in practice) the lookup will check /etc/passwd and /etc/group, if not found it will check NIS, then LDAP.

Example Configuration

The smb.conf parameter that sets share-level security is:

security = share
Samba HowTo Guide
Prev Home Next

  Published under the terms fo the GNU General Public License Design by Interspire