SMB client: guest access to Win7 share

Untitled_Doc · September 15, 2018 at 6:41 PM

I am running LibrElec 8.2.5 / Kodi 17.6 (LibreELEC-RPi.arm-8.2.5.img) on a Raspberry Pi 1b. This is more of an out-of-curiosity question than a request for help, so I'll be brief. When attempting to access a Windows 7 SMB share in the Kodi UI, there is no guest / anonymous access option in the username / password prompt. I have read the announcement which suggests that guest / anonymous may no longer work. I understand this will not work for SMB shares hosted on Win10 boxes because guest / anonymous access has been disabled in a recent release of Win10 itself. However, no such limitation has been put upon Windows 7 (not sure about 8 & 8.1). As a side note: I can successfully access the Win7 share anonymously using the command line smbclient in Ubuntu 16 (SMB 2.1 protocol).

Precisely what is it within the current LibreElec / Kodi distribution that has changed that means guest / anonymous in the smb client is no longer an option?

**chewitt** · September 17, 2018 at 6:32 PM Official Post

Nothing changed. Kodi (still) defaults to anonymous/guest auth unless a credential is used. If the Windows end supports anonymous auth things will work. If it doesn't (which is increasingly the case) the user needs to use a credential. As it's impossible for us to guess Windows configuration from the typically illiterate descriptions we receive we advise everyone to use a credential; which is also the best advice for security.

Untitled_Doc · September 19, 2018 at 9:12 PM

Thanks for the reply. I would need to re-check but I could have sworn when I tried to connect as guest there was no way to get past the credentials prompt without entering a user/pass. Then when I started searching for answers, I came across this post which states:

Quote

What isn't supported by LibreELEC is anonymous access to shares (and this also isn't supported by Microsoft in Windows 10 - it was dropped a few updates ago)

Probably a misinterpretation on my part. In the context of a Windows 10 share, the above is accurate.

I agree it's best to provide advice that will work for everyone and uphold good security practices.

Untitled_Doc · September 24, 2018 at 9:49 PM

I checked and guest / anonymous access definitely would not work, attempting to connect to a Windows 7 SMB share. The Lock Preferences dialogue window is not passable. It looks like the Username / Password fields in this dialogue are mandatory, and entering Guest / Some-madeup-password doesn't allow the connection.

I made sure the following settings were enabled on the Win7 "server":

Control Panel\Network and Internet\Network and Sharing Center\Advanced sharing settings

Enable file sharing for devices that use 40- or 56-bit encryption ✔
Turn off password protected sharing ✔

I also made sure that the Share and NTFS permissions allowed Read access for Guest, and confirmed successful anonymous access with the command-line smbclient in Ubuntu.

The SMB client in LE Settings > Services > SMB client is configured with min protocol 2 and max protocol 3.

Though I could investigate further, perhaps seeing if tcpdump reveals anything, this will probably be a fruitless exercise. From a search on other posts on this forum, it seems it might well be the case that Guest access is prohibited irrespective of the version of Windows hosting the share:

Can't browse SMB shares on Krypton version

Problem with MySQL database, picture not showing and movies not available

Am I misunderstanding the above posts?

**chewitt** · September 26, 2018 at 2:18 AM Official Post

Microsoft wants everyone to use authenticated access to shares. There are at least 2000+ different combinations of Windows, Windows config options, and Samba versions in the wild so it's impossible for anyone to give a direct/straight answer to the "why did my stuff stop working?" question. The sooner everyone gets onboard with the new plan and starts using username/password access, the sooner everyone can get back to watching movies instead of trying to diagnose why their insecure guest or anon access (mostly) no longer works.