Unable to write to Samba share as guest user after upgrading to Samba 4

Question

I recently upgraded to Samba 4.4.8 from 3.x on a FreeBSD 11 system. During the upgrade, I found out that security = share was removed and halfway replaced with map to guest = Bad Password. After changing that, I was able to connect to the share as a guest, but not able to write to the share; clients say permission denied.

Looking through the logs, I found this error:

[2017/01/08 20:17:59.632441,  3] ../source3/smbd/error.c:82(error_packet_set)
  NT error packet at ../source3/smbd/error.c(165) cmd=162 (SMBntcreateX) NT_STATUS_ACCESS_DENIED

Here's /usr/local/etc/smb4.conf:

[global]
   workgroup = MYGROUP
   server string = share

   # security and map to guest were the only settings changed after upgrading
   security = user
   map to guest = Bad Password
   guest account = share

   log file = /var/log/samba4/log.%m
   max log size = 50
   log level = 3

   dns proxy = no

[share]
   path = /tank/share
   public = yes
   guest ok = yes
   only guest = yes
   writable = yes
   force user = share
   force group = share
   printable = no

And the ownership of the directories:

$ ls -l -d /tank /tank/share
drwxr-xr-x  10 root   wheel   12 Dec  5 04:50 /tank
drwxr-xr-x  43 share  share  101 Jan  3 05:04 /tank/share

In all my googling for this issue, problems seemed to be either not setting writable = yes, not doing force user, not setting a guest account, or the user not having write access to the target directory, but those all look fine.

This happens for both Windows and Linux clients.

Answer 1

I'm not sure what fixed it, but one three changes did:

• changing map to guest to Bad User (as documented in the basic config file example on the Samba wiki)
• removing guest account from the global config
• removing public = yes from the share config

[global]
   workgroup = MYGROUP
   server string = share

   security = user
   map to guest = Bad User
   # guest account = share

   log file = /var/log/samba4/log.%m
   max log size = 50
   log level = 3

   dns proxy = no

[share]
   path = /tank/share
   # public = yes
   guest ok = yes
   only guest = yes
   writable = yes
   force user = share
   force group = share
   printable = no