What I do, is set SECURITY = SERVER
Samba will do all its username/password validation via a remote server.
Then set:
password server = NTBDC1, NTBDC2, NTBDC3
If you are using a Windows NT server as your password server then you will have to ensure that your users are able to login from the Samba server, as when in security = server mode the network logon will appear to come from there rather than from the users workstation.
That way all user authentication comes from Windows..
Here's what you have:
SECURITY = USER
This is the default security setting in Samba 2.2. With user-level security a client must first "log-on" with a valid username and password (which can be mapped using the username map parameter). Encrypted passwords (see the encrypted passwords parameter) can also be used in this security mode. Parameters such as user and guest only if set are then applied and may change the UNIX user to use on this connection, but only after the user has been successfully authenticated.
Note that the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing the server to automatically map unknown users into the guest account. See the map to guest parameter for details on doing this.
NOTE ABOUT USERNAME/PASSWORD VALIDATION
There are a number of ways in which a user can connect to a service. The server uses the following steps in determining if it will allow a connection to a specified service. If all the steps fail, then the connection request is rejected. However, if one of the steps succeeds, then the following steps are not checked.
If the service is marked "guest only = yes" and the server is running with share-level security ("security = share") then steps 1 to 5 are skipped.
If the client has passed a username/password pair and that username/password pair is validated by the UNIX system's password programs then the connection is made as that username. Note that this includes the \\server\service%username method of passing a username.
If the client has previously registered a username with the system and now supplies a correct password for that username then the connection is allowed.
The client's NetBIOS name and any previously used user names are checked against the supplied password, if they match then the connection is allowed as the corresponding user.
If the client has previously validated a username/password pair with the server and the client has passed the validation token then that username is used.
If a "user = " field is given in the smb.conf file for the service and the client has supplied a password, and that password matches (according to the UNIX system's password checking) with one of the usernames from the "user =" field then the connection is made as the username in the "user =" line. If one of the username in the "user =" list begins with a '@' then that name expands to a list of names in the group of the same name.
If the service is a guest service then a connection is made as the username given in the "guest account =" for the service, irrespective of the supplied password.
You will have to configure users with smbpasswd
Rgds...Geoff
Proverbs 3:5,6 Trust in the Lord with all your heart and lean not on your own understanding; in all your ways acknowledge him, and he will make all your paths straight.
