Paranoid Penguin - Samba Security, Part III

Start creating shares on your secure Samba file server.

That's all we've got space for this month. Next time, we'll create that third, mick-only share (I'll bet you can figure that out yourself beforehand), create persistent Samba mounts on our client systems using smbmount and at least briefly address some miscellaneous Samba security topics, such as how to make Samba automatically and safely serve people's home directories. Until then, be safe!

Mick Bauer ( is Network Security Architect for one of the US's largest banks. He is the author of the O'Reilly book Linux Server Security, 2nd edition (formerly called Building Secure Servers With Linux), an occasional presenter at information security conferences and composer of the “Network Engineering Polka”.



Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

troubleshooting with smbclient failed

honkytonkwillie's picture

Everything in this series of articles has worked so far until I get to the section in part III with smbtreee and smbclient.

when I enter the command

"smbclient //myserver/share -U nobody" with no password,

I get

Anonymous login successful
Domain=[MYWORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]
tree connect failed: NT_STATUS_ACCESS_DENIED

Same thing happens when I use "totallyfakeusername".

Is there some obvious config thing I missed? Aside from adding users and passwords at manually at the command line, everything else I did using SWAT.

The only other item I can think to mention is that I'm not working on my server directly, but through my network from my main workstation.

Thank you.


troubleshooting with smbclient failed

EdSol's picture

Took me some time to figure out NT_STATUS_ACCESS_DENIED (Not a very informative thing). I remembered trying this one recently. Might help you too:

Good Luck!


honkytonkwillie's picture

upon closer inspection, when trying to force a Bad User with "totallyfakeusername", I do not get an "Anonymous login successful" message, and alss the domain is different,
Domain=[MYSERVER] instead of Domain=[MYWORKGROUP]. I still get a "tree connect failed: NT_STATUS_ACCESS_DENIED" error.

Same problem here I

Anonymous's picture

Same problem here

I get
Domain=[FED-CENTRAL] OS=[Unix] Server=[Samba 3.4.0]
tree connect failed: NT_STATUS_BAD_NETWORK_NAME

Please help

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState