Can I kill 'restrict anonymous'?

[Andrew Bartlett]

"Gerald (Jerry) Carter" wrote:
> 
> On Sun, 11 Nov 2001, Andrew Bartlett wrote:
> 
> > Correct, and this is the way the code now works.  The 'guest' flag on
> > the vuser (and the server_info) is only set if and only if the user
> > either: a) did not provide credentials or b) was 'mapped to guest' by
> > that ugly hack in the session setup code.  Both of these are purely
> > anonymous as far as this is concerned.
> >
> > In HEAD, we no longer compare unix uids to determine 'guest' status, and
> > an authenticated user with that uid is not treated as a guest.
> 
> If the auth rewrite in HEAD broke "restrict anonymous", then we need to
> fix the original intended behavior or remove the parameter.  However,
> in no way would I agree with replacing the intended behavior and
> implementing it with a new parameter. :-)  Make sense?

Sorry, it doesn't.
 
> Change under the hood is good, but change the interfaces a little
> as possible (smb.conf in this case) and only if absolutely necessary.

In this case I think the *original* 'intended' behaviour was some really
broken ugly hack to do with preserving %U and %G on TCP/IP connections
that had already got an authenticated connection.  The comments in the
original patch indicate this assited in some bizarre % macros induced
custom browse list.

The behaviour jra and I have beed discussing has the same name, but
quite different intentions. It is designed to stop giving out user list
and such, and is known as 'restrict anonymous' on NT.  Currently (in
both branches) we don't 'restrict anonymous' anything, if the anonymous
connecitons was the first connection.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet at pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet at samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net