Here is how I understand it.

If Windows user credentials do not exist in OSX then the user is logged in as Guest and given access to OSX shared folders that you (and the other OSX users) specify in Preferences>Sharing>File Sharing but only to those shares that allow Everyone (or Guest) access. These shares are more or less equivalent to Windows shares. If Guest account in OSX is entirely disabled (it is enabled by default) then this guest access will not work.

If Windows user credentials are valid in OSX but per-user access for this user is not configured (Preferences>Sharing>File Sharing>Options) then this user will not be given access at all. When per-user access is configured then this user will be given access. However, the user will be given access to the entire system in the same way as if he/she logged in physically onto OSX machine. The shared folders specified in Preferences>Sharing>File Sharing seem not to have any significance in this case. This is roughly equivalent to what happens when you connect to C$ in Windows and to “/“ in UNIX.

What I don’t understand then is the following. For every shared folder specified in OSX Preferences>Sharing>File Sharing you specify a list of users and their permissions. Because a valid OSX user gets access to entire drive if per-user option is enabled, no access at all otherwise, then the list of users and their permissions seem to be meaningless, except for the Everyone/Guest entry.

Here is how I would like it to be.

1. Access permissions specified in OSX Preferences>Sharing>File Sharing list are always obeyed. No other access is given to any users or any shares whatsoever.
2. If I want to give a user access to the entire drive then I have to enter this drive name in the above list for appropriate user with appropriate permissions.
3. If I want to give Guest an access to a share then I enter this in the above list too. This one works today.
4. Credentials of a network user trying to connect are always verified. If the user credentials are valid then he/she is given access as specified above for this user. If not then he/she is logged in as Guest (if Guest account is enabled) and again given access as specified above for Guest.
5. Then we wouldn’t need this strange per-user option at all.
6. The problem of passwords that the system has to store separately for SMB users should be solved by an interface between Samba used internally by OSX and OSX native key store. Samba has already an option for using an external password store.

Thanks/Mikael

dom_beta

Der SMB/CIFS-Gastzugriff funktioniert zwar dann für den "Erstaccount" noch immer. Allerdings soll es dann halt irgendein Benutzername sein...