Can I kill 'restrict anonymous'?

Andrew Bartlett abartlet at
Sun Nov 11 21:54:24 GMT 2001

"Gerald (Jerry) Carter" wrote:
> On Sun, 11 Nov 2001, Andrew Bartlett wrote:
> > Correct, and this is the way the code now works.  The 'guest' flag on
> > the vuser (and the server_info) is only set if and only if the user
> > either: a) did not provide credentials or b) was 'mapped to guest' by
> > that ugly hack in the session setup code.  Both of these are purely
> > anonymous as far as this is concerned.
> >
> > In HEAD, we no longer compare unix uids to determine 'guest' status, and
> > an authenticated user with that uid is not treated as a guest.
> If the auth rewrite in HEAD broke "restrict anonymous", then we need to
> fix the original intended behavior or remove the parameter.  However,
> in no way would I agree with replacing the intended behavior and
> implementing it with a new parameter. :-)  Make sense?

Sorry, it doesn't.
> Change under the hood is good, but change the interfaces a little
> as possible (smb.conf in this case) and only if absolutely necessary.

In this case I think the *original* 'intended' behaviour was some really
broken ugly hack to do with preserving %U and %G on TCP/IP connections
that had already got an authenticated connection.  The comments in the
original patch indicate this assited in some bizarre % macros induced
custom browse list.

The behaviour jra and I have beed discussing has the same name, but
quite different intentions. It is designed to stop giving out user list
and such, and is known as 'restrict anonymous' on NT.  Currently (in
both branches) we don't 'restrict anonymous' anything, if the anonymous
connecitons was the first connection.

Andrew Bartlett

Andrew Bartlett                                 abartlet at
Manager, Authentication Subsystems, Samba Team  abartlet at
Student Network Administrator, Hawker College   abartlet at

More information about the samba-technical mailing list