Full access without credentials?

[ITHAQVA]

Hi All,

Very new to FreeNAS, so go easy on me :D

Is it possible to create SMB shares on FreeNAS which are fully accessible to any Windows clients without the need for username or password?

Thanks

 

[Samuel Tai]

You can create SMB shares with the "Allow guest access" and "Only guest access" boxes checked. However, Microsoft changed the behavior of Windows 8 and 10 clients so they no longer accept offers for guest access from the server, and must authenticate, so those check boxes no longer have any effect.

 

[ITHAQVA]

You can create SMB shares with the "Allow guest access" and "Only guest access" boxes checked. However, Microsoft changed the behavior of Windows 8 and 10 clients so they no longer accept offers for guest access from the server, and must authenticate, so those check boxes no longer have any effect.

Thanks Samuel, yep, we are having issues with Win10 for that very reason. I was hoping there was a work round as CentOS works fine in having public shares.

 

[Patrick M. Hausen]

You can wack Windows 10 into behaving reasonably, but for more than a handful of clients you want an AD and group policies because you have to touch every single system, otherwise. And probably again after each succeeding update.

 

[ITHAQVA]

Thanks Patrick, as for Widows 10, please don't get me onto to that monster.

Setting local group policy to allow unauthorized access hasn't worked, and i'm about to alter the registry to include"AllowInsecureGuestAuth" to see how it effects access. I'm going to be bashed for saying this but i miss windows 7!

Its a small group of Windows 10 users. So I'm going to have to work out a viable strategy moving forward . My ultimate goal is to implement Linux workstations one day, but my users struggle with the basics and understand the extra work it will entail for me.

A big thank you for the very prompt replies. I think i need to have a re think :)

 

[Tigersharke]

Perhaps if a thing looks like windows, acts like windows, but is something much better, it may satisfy these folk ou'll struggle with. Copious forms or prompts etc, may also help them do the right things. *shrugs* The best I can do here is trick the windows people to use a more secure internet access (OPNsense firewall etc) by spoofing the one they foolishly prefer to use (Comcast-I-don't-trust-its-security). I wish you success in your efforts!

 

[ITHAQVA]

Tigersharke, you know my pain, if i told you for the last 10 years they have struggled with the concept of their passwords changing every 90 days, yes and totally forgetting their own passwords more times than i can remember :D But that's what i'm paid for! To think for them

 

[Samuel Tai]

From my local experiments, "AllowInsecureGuestAuth" also doesn't work. I finally gave up, and installed the ClientforNFS, and got access to that share using MapAll="nobody:nogroup" NFS exports.

 

[ITHAQVA]

From my local experiments, "AllowInsecureGuestAuth" also doesn't work. I finally gave up, and installed the ClientforNFS, and got access to that share using MapAll="nobody:nogroup" NFS exports.

Nice one, another option to consider ;):). This idea of mine to move away from Microsoft is becoming a bit of a minefield, but loving the challenge.

I see me living here: https://www.ixsystems.com/documentation/freenas/11.3-U1/intro.html

And thanks to everyone for being so helpful. This resource will give me the confidence to keep going with my plan to move away from Microshaft products, which was making me stupid and lazy :p

 

[HoneyBadger]

On my 11.1-U7 box, I just created an SMB share with "Allow Guest Access" and set permissions on the dataset to nobody:nogroup. A Windows 10 (Pro 1909) connected straight to it without AllowInsecureGuestAuth being set. Does this work to reproduce?

 

[Samuel Tai]

I see me living here: https://www.ixsystems.com/documentation/freenas/11.3-U1/intro.html

READ THIS before you upgrade to 11.3, if you have GELI-encrypted pools!

This is in the Known Impacts section of the Release Notes at https://www.ixsystems.com/blog/library/freenas-11-3-release/. The system no longer allows moving the system dataset to an encrypted pool containing a passphrase. Since Directory Services and some SMB state information is stored in the...

www.ixsystems.com

 

[ITHAQVA]

On my 11.1-U7 box, I just created an SMB share with "Allow Guest Access" and set permissions on the dataset to nobody:nogroup. A Windows 10 (Pro 1909) connected straight to it without AllowInsecureGuestAuth being set. Does this work to reproduce?

Im currently building a fresh FreeNAS VM and will try these settings once im up and running :)

 

[ITHAQVA]

READ THIS before you upgrade to 11.3, if you have GELI-encrypted pools!

This is in the Known Impacts section of the Release Notes at https://www.ixsystems.com/blog/library/freenas-11-3-release/. The system no longer allows moving the system dataset to an encrypted pool containing a passphrase. Since Directory Services and some SMB state information is stored in the...

www.ixsystems.com

I've kept encryption off to keep things simple for the initial phase of testing, but if all goes well, I will most certainly look into this as the server will be part of the business/enterprise. Part of my reasoning to the business to move away from Microshaft is security amongst the other million benefits

 

[ITHAQVA]

On my 11.1-U7 box, I just created an SMB share with "Allow Guest Access" and set permissions on the dataset to nobody:nogroup. A Windows 10 (Pro 1909) connected straight to it without AllowInsecureGuestAuth being set. Does this work to reproduce?

Followed above:

If i browse to the server on the network I still get the prompt, I also cannot map to this share.

testparm -e result

Working now!!!

I had a look at this thread https://www.ixsystems.com/community/threads/public-smb-share.83454

Followed the last answer, added a new shortcut to my Win 10 PC and im in!

This forum is great, i've spent days on this and within a few hours of being here i have a result.

I'm truly grateful for all the help here, thanks peeps! :) :) :) :) :)