Network Neighborhood, Visionfs, Samba Authentication and all that

Understanding Mixed‑Environment Authentication

When a network mixes Windows clients with Unix‑based servers, the first hurdle is realizing that the different operating systems each manage authentication in distinct ways. Windows 98 and XP, for instance, rely on local SAM databases for user accounts unless a domain controller is present. Unix servers running Visionfs or Samba maintain their own separate user tables, and they compare incoming credentials against those tables, not against the Windows SAM. That means a single user can have a Windows account, a Visionfs account, and a Samba account, all with the same username but potentially different passwords. In most real‑world deployments the password for each service is kept separate, and the network administrator must decide whether to sync them or keep them independent.

In the scenario described, the accounting application on the Unix box had its own authentication system that was unrelated to both Windows and Visionfs. The mail server used a third, independent set of credentials. This layering can be confusing for end users who expect a single sign‑on experience. However, from an administrative perspective, each service is independent, and the only common thread is the username that the user presents. That username must be known to every system that the user intends to use.

Visionfs, like Samba, authenticates by matching the username and password sent by the Windows client to entries in its own database. It does not consult the Windows SAM or any external directory service unless specifically configured to do so. Consequently, if a user changes his Windows password but does not update the corresponding Visionfs entry, file and printer access will fail, even though the Windows log‑in itself works fine. This explains why the XP user was able to use the internet, the accounting app, and email, yet could not reach shared resources on the Unix server.

Because of this independence, administrators often create a mapping mechanism. In Visionfs this can be done with an alias file or a dedicated mapping command, while Samba offers the username map directive. These mappings translate the Windows login name into a different internal name that Visionfs or Samba knows. While useful, mapping alone is not enough if the password stored in Visionfs differs from the Windows password. Passwords must be synchronized or reset in each service’s database to ensure consistent authentication across the network.

In summary, the core lesson is that each platform’s authentication logic is isolated. When users move between Windows machines, the underlying account on the Unix server must match the Windows username and password pair that the client presents. Ignoring this fact leads to the kind of access problems seen in the example, and the only real solution is a clear, documented policy for managing usernames and passwords across all systems.

Managing User Names and Passwords Across Windows, Visionfs, and Samba

Because the Windows client supplies only a username and password during a file‑share connection, the Unix server must have a record that matches that pair. The easiest way to achieve this is to enforce a naming convention that keeps the Windows name the same as the Unix account name. For example, using a single lowercase abbreviation such as bobf for Bob Franklin avoids ambiguity and eliminates the need for name translation. When a new Windows machine is installed, the administrator should prompt the user to adopt the existing network‑wide username, or to create a new account that follows the same naming pattern.

In practice, many organizations use a script or configuration management tool to create matching accounts across all services. The script can query the Windows SAM for the list of local users and then create identical entries in Visionfs’s user.conf file and in Samba’s users.conf file. Once the accounts exist, the administrator can copy the password hash from the Windows SAM into the Unix files, or have the users set a new password that is then stored in all three databases. Keeping the passwords in sync can be automated with scheduled jobs that read the Windows password hash via the secedit tool and write it to Visionfs’s password database.

When mapping is unavoidable - such as when the Windows name contains spaces or special characters - Visionfs and Samba provide mechanisms to translate the incoming name to a canonical form. In Visionfs, the --map option can map Bob Franklin to bobf, while Samba’s username map file can contain entries like Bob Franklin = bobf. These mapping files must be loaded during startup and should be kept in a version‑controlled location. Administrators should test the mapping on a single machine before deploying it network‑wide to avoid cascading access problems.

Passwords are the most sensitive part of this puzzle. Visionfs stores passwords in plain text or in a simple hash, whereas Samba stores them in a more secure format. When a user changes their Windows password, the corresponding Unix password must also be updated. Some environments use PAM modules that allow Samba to verify Windows passwords directly against the Windows SAM. This approach removes the need for password duplication but requires a trusted Windows domain controller. In the absence of a domain, the safest route is to enforce a policy that forces users to set the same password on all services, and to automate the synchronization of those passwords.

By establishing a consistent naming convention, using reliable mapping mechanisms, and automating password synchronization, administrators can reduce the cognitive load on users and prevent the common pitfalls that arise when Windows clients attempt to access shared resources on Visionfs or Samba. These practices also simplify troubleshooting, because when an authentication failure occurs it is clear whether the problem lies with the username mapping, the password hash, or the service configuration.

Practical Troubleshooting Steps for Shared File and Printer Access

When a user on an XP machine reports that they cannot access shared files or printers on a Visionfs server, the first step is to verify the network connection and the Windows credentials. Open the Run dialog, type \\unixserver\sharename, and press Enter. If a login prompt appears, enter the Windows username and password that the user normally uses. If the prompt disappears but a “Access denied” message follows, the problem is almost certainly with the Visionfs password or the mapping of the Windows name.

Next, confirm that the Windows username the user is sending matches an entry in Visionfs’s database. On the Unix server run visionfs list users or consult the user.conf file. Look for a line that reads bobf and check that the stored password matches the one the user entered on XP. If it does not, reset the password with visionfs password --amend bobf newpass and test again. Remember that Visionfs is case‑sensitive and does not accept spaces in usernames unless they are mapped.

If the user’s Windows account has a different name - perhaps because they typed their full name - check the mapping configuration. Open the Visionfs map file (often /etc/visionfs/visionfs.map) and ensure that an entry like Bob Franklin = bobf exists. After editing the map file, restart Visionfs with visionfs restart to apply changes. Test the connection again from the XP machine. The same procedure applies to Samba: edit /etc/samba/smb.conf, add the username map directive if missing, restart the Samba service, and verify access.

When files and printers still refuse access, check the user’s group memberships on the Unix server. Visionfs and Samba typically enforce permissions based on Unix file modes or group membership. If the user is not a member of the group that owns the share, the server will deny access. Use visionfs group list bobf or getent group to see the groups the user belongs to, and add them to the necessary groups with visionfs user addgroup bobf groupname or the equivalent Samba command. After adjusting group memberships, the user should see the shared resources.

Finally, inspect the server logs for authentication failures. Visionfs writes detailed logs to /var/log/visionfs.log, while Samba logs to /var/log/samba/log.smbd. Look for entries that show the username, password status, and the error code returned. These logs often reveal subtle mismatches - such as a trailing newline in the password or an invisible carriage return - that can cause authentication to fail. By correlating log entries with the user’s reported symptoms, administrators can pinpoint the exact cause of the issue and apply the appropriate fix, whether it be resetting a password, updating a mapping, or correcting file permissions.