User-agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113
email@hidden wrote:
auth methods = opendirectory guest
Mine is "auth methods = guest opendirectory" which is interesting
because as "man smb.conf" points out that these are searched *in order*
The "guest" method is for anonymous connections (user=unknown on Xserve)
and I suspect having it second means more work for OD's directory server
which I think is one of your symptoms. Do you remember changing this?
Yes, we changed this. We reasoned that by searching first for the
username in the OD directory, we would cut-down the authentication time.
We were under the impression that since we do not allow "guest" account
login, it would be faster to simply search the OD directory first for
the name of the user logging-in. This has been changed again, today, to
reflect the default settings you refer to.
Your reasoning makes sense however I believe there are edge conditions
associated with the initial connect during the logon sequence which
have to start off as a guest (since you haven't logged in yet). Anyway
the Samba docs are explicit that guest should come first.
auth methods = guest ntdomain opendirectory
Note that "opendirectory" is also there. Normally Samba would have a local
auth method after "ntdomain" to allow local accounts just as in Windows.
Assuming that your Xserves are using the OD master on the PDC, this might
be a bit strange in that they might search the database again but only
in a local context.
I have removed 'opendirectory' from this directive in each home
directory server. I will see if it makes any difference.
I think the only harm it can cause is if you were getting attacked
by a worm trying to guess userids. I was just using it to explain
the logic of the Samba developers
