ldap_nua requires guest exist and have rid 501?

[John E. Malmberg]

Andrew Bartlett wrote:

> On Tue, 2002-11-12 at 13:16, John E. Malmberg wrote:
>  
>> On a related note, does SAMBA still use the guest account in place 
>> of the (unkown) internal user for enumerating shares?
>> 
>> An NT client can not browse a SAMBA server with the guest account 
>> disabled, but having a guest account enabled is not required on an 
>> NT account to do the same thing.
> 
> A Samba server must have a guest account, and (now) it must have RID
>  501.  I'm not sure the guest account is 'disabled' on NT, it is just
>  that the groups it is given membership of changes.  IE on NT, the 
> restrictanonymous setting can remove 'guest' from domain users, and 
> 'everyone'.

The GUEST account can definitely be disabled on an NT workstation.  You 
can not access shares through it when it is disabled, yet browsing works.

You can enable it and then access shares through the guest account.

SAMBA should work the same way, but does not.  This puts a minor 
security hole in SAMBA that is not present in Microsoft Windows NT.

Microsoft advises that the guest account be disabled if you are 
concerned about security, and on NT Servers it is disabled by default.

-John
wb8tyw at qsl.network
Personal Opinion Only