[Samba] How to stop authentication for guest?

[Jeremy C. Reed]

How can I stop samba from authenticating the guest?

Currently, my user authenticates with PAM (ldap from Active Directory) and
that is successful. But the user doesn't have any Unix account information
-- so Samba falls back to the "guest" account. This is okay.

Bu then Samba tries to authenticate again (via PAM) for this guest. And
that fails:

 passdb/pampass.c:smb_pam_auth(510)  smb_pam_auth: PAM: Athentication
 Error for user nobody

 passdb/pampass.c:smb_pam_error_handler(71)  smb_pam_error_handler: PAM:
 Authentication Failure : Authentication failure

I have tried this with guest account as nobody and as another valid Unix
account.

How can I get Samba to not try to authenticate again?

I used "guest ok = yes" because the documentation says: "no password is
required to connect to the service." But I do want the first PAM
authentication to be required. (I just don't want the second to be done.)

This is what I want:
- must authenticate original, non-guest user via PAM;
- then use one guest account but don't authenticate again.

I tried "security = share" but that tries to do the authentication for the
guest account first and fails. But if I don't use that "security = share"
then I need to use "map to guest", but that doesn't apply -- because I
don't want to use guest on bad passowrd or bad user. I want to use guest
every time but only if the username provided authenticates first.

Note: if I log in using a user that has a local account, it works fine.
But I don't want to have every user setup locally too. I just want to use
one guest account for all remote users that authenticate correctly via
PAM.

Any ideas?

(This is Samba 2.2.3a-6 for Debian.)

Thanks,

   Jeremy C. Reed
   http://bsd.reedmedia.net/