request to remove security=share

[Gerald (Jerry) Carter]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Christopher R. Hertel wrote:

> There's a discussion of the mechanism used to do 
> security=share given in the smb.conf man page.  Basically,
> we have to map the user to a valid user ID somehow.  The
> security=server mode simply hides some of the details.
> I believe that we can do the same using security=user and 
> a handful of other parameters.  As such, security=share
> is a short-hand.

Chris,

I'm sorry, but this is misleading.  I'm going to assume you
meant s/=server/=share/g above.  With that in mind....

For share mode security we try to match the password transmitted
in the tcon request to some username.  The could have been
sent earlier or could be specified in the share definition.
As you know this is fundamentally different than always
validating the password with the transmitted username from the
session setup.  smbd is effectively trying to hack an account.

So security = share is really not short hand.  It is a
non-intuitive, broken model the way we implement it.  Users
don't understand it.  We don't even understand how its
implemented because none of us use it.  I'm still waiting
for some one to give a real world example justifying why
we should keep it (and not just for protocol completeness).

It would be better to just define a ro/rw password and specify
the euid for accessing files/directories.  At least would be
easy to explain.  The current model works sometimes and doesn't
in other environments.





cheers, jerry
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEEercIR7qMdg1EfYRAnacAJ0YwrCS7Q6IshOqfQguqJkPZ3mi1gCgj5Gr
yozFtPHQ4mu0qaxNbpDEpMg=
=/iri
-----END PGP SIGNATURE-----