[Samba] SAMBA in hybrid mode

[Dan Willis]

I think you may have been bitten by this change in behavior- I was. I 
assume using LDAP would provide similar behavior to a Windows Domain 
Controller.

http://info.ccone.at/INFO/Samba/upgrading-to-3.0.html
Changes in Behavior
The following issues are known changes in behavior between Samba-2.2 and 
Samba-3 that may affect certain installations of Samba.
When operating as a member of a Windows domain, Samba-2.2 would map any 
users authenticated by the remote DC to the "guest account" if a uid could 
not be obtained via the getpwnam() call. Samba-3 rejects the connection as 
NT_STATUS_LOGON_FAILURE. There is no current work around to re-establish 
the Samba-2.2 behavior.

I was providing guest printing on a NT-4 Domain member SAMBA server.  After 
the upgrade from 2.28 to 3.010, I had to make the print server a 
stand-alone machine again because guest printing was not working as desired 
(see my ealier post below).

Subject: [Samba] Guest Printing Broke after upgrade from 2.28 to 3.010
X-BeenThere: samba at lists.samba.org
X-Mailman-Version: 2.1.4
List-Id: General questions regarding Samba <samba.lists.samba.org>
List-Unsubscribe: <https://lists.samba.org/mailman/listinfo/samba>,
         <mailto:samba-request at lists.samba.org?subject=unsubscribe>
List-Archive: <http://lists.samba.org/archive/samba>
List-Post: <mailto:samba at lists.samba.org>
List-Help: <mailto:samba-request at lists.samba.org?subject=help>
List-Subscribe: <https://lists.samba.org/mailman/listinfo/samba>,
         <mailto:samba-request at lists.samba.org?subject=subscribe>
Sender: samba-bounces+dannowwillis=comcast.net at lists.samba.org

I'm running a CUPS print server with SuSe 9.0 Pro with printers shared 
through Samba. I've recently upgraded from 2.28 to 3.010.  My server is a 
member of an NT 4 domain.  I run winbind to authenticate users to the 
domain; however, I also allow guest printing because many laptop users' 
machines are not domain members.

There has been a change in guest printing behavior after the 
upgrade.  Domain authentication is working fine. Guest printing (desired) 
is working OK if the guest's username is not a valid domain username. 
However, guest printing for laptop users who have domain accounts but are 
not logged in to the domain does not work and actually locks the user's 
domain account.  In Samba 2.28, these users would map to "nobody" and could 
print as desired.

I have tried changing the winbind use default domain parameter, the allow 
trusted domains parameter, etc. with no change.  I'd like to be able to 
authenticate users if possible, but still provide guest printing to laptop 
users.

<snip>

At 05:28 AM 1/1/2005, you wrote:
>Hi,
>
>I am trying to setup my SAMBA server to use both user and share
>security so I can have share printers for all clients without
>authentication while protecting the file shares.  Does anyone have a
>working example that I can use as a reference?
>
>I am running Debian sarge with SAMBA 3.0.10-1.  I currently have a
>working SAMBA server running in user security mode.  I am using LDAP
>as the backend authentication.
>
>I appreciate any help you can provide.
>
>Roger
>--
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/listinfo/samba