Member Avatar for NeoKyrgyz

Hi,
I've a *ix machine and I need to share some folders with Windows users. I use samba for this purposes. Samba is set-up and works fine. All windows users use one id to mount (net use) samba drive. But the problems is that when user tries wrong password 3(or more) times this account is locked up. Since there are too many users that are accessing the server, account is being locked up very frequently. On the other hand security policy doesn't allow guest sharing (sharing by not requiring password) and it doesn't allow increasing number of trials before locking account. Do you have any kind of ideas about solving this? We're ready even to put some intermediate machines if needed. If I can't solve this the we'll have to copy whole content to new machine, periodically.

Thanks.

  • 2 Contributors
  • 2 Replies
  • 1K Views
  • 4 Months Discussion Span
  • Latest Post Latest Post by NeoKyrgyz

Dani AI

Generated

A single shared SMB account being used from many Windows clients causes lockouts because the lockout counter applies to the account itself. The authoritative control can be the local Samba passdb/PAM stack or an Active Directory domain controller, so first determine which backend is enforcing the policy by inspecting Samba and the system auth logs for "locked" or "NT_STATUS_ACCOUNT_LOCKED_OUT" messages.

grep -i "locked\|NT_STATUS_ACCOUNT_LOCKED_OUT" /var/log/samba/* /var/log/auth.log /var/log/secure

Per-user accounts are the correct, long-term fix (as implemented). To scale that approach without manual churn, integrate Samba with central auth (LDAP/AD) or automate local provisioning and group assignment. Example batch creation pattern:

for u in $(cat users.txt); do
  useradd -m "$u"
  smbpasswd -a "$u"
done

Use Unix groups and Samba share directives (for example, valid users = @groupname) to manage access centrally and avoid per-share user lists.

As noted, account hygiene is important. Avoid cron jobs that blindly clear lockout counters because that undermines the protection. For troubleshooting, temporarily increase Samba log level, validate smb.conf with testparm, and use smbstatus to find which client IPs are causing repeated failures — many lockouts come from mapped drives or stored credentials on Windows clients that need updating.

Recommended Answers

All 2 Replies

Member Avatar for vimotaru

Two possible ways:
- Make more users (one for each windows user).
- Make the resource public (with public = Yes or guest ok = Yes) in /etc/samba/smb.conf

There's no sense in putting only a user and only one id to connect. This is a security hole anyway.

If you find it dificult or too much work to do it, try with group policies to manage security. But the only way to have the system secure is managing user accounts.

Another option is to put an automatic unlock script in cron, and let's say, every two days, failed tries will be reset (although the limit was not reached).

Hope it helps.

Member Avatar for NeoKyrgyz

We've created seperate account for each possible user. This was the best choice considering security policies in our company.
Thanks a lot.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.