s3-auth: Remove security=share (depricated since 3.6).

This patch removes security=share, which Samba implemented by matching
the per-share password provided by the client in the Tree Connect with
a selection of usernames supplied by the client, the smb.conf or
guessed from the environment.

The rationale for the removal is that for the bulk of security=share
users, we just we need a very simple way to run a 'trust the network'
Samba server, where users mark shares as guest ok.  This is still
supported, and the smb.conf options are documented at
https://wiki.samba.org/index.php/Public_Samba_Server

At the same time, this closes the door on one of the most arcane areas
of Samba authentication.

Naturally, full user-name/password authentication remain available in
security=user and above.

This includes documentation updates for username and only user, which
now only do a small amount of what they used to do.

Andrew Bartlett

                       --------------
                      /              \
                     /      REST      \
                    /        IN        \
                   /       PEACE        \
                  /                      \
                  |      SEC_SHARE       |
                  |    security=share    |
                  |                      |
                  |                      |
                  |       5 March        |
                  |                      |
                  |        2012          |
                 *|     *  *  *          | *
        _________)/\\_//(\/(/\)/\//\/\///|_)_______

10 files changed, 63 insertions, 613 deletions

diff --git a/source3/smbd/globals.h b/source3/smbd/globals.h
index 0c4b3b71a4..075dc564d9 100644
--- a/source3/smbd/globals.h
+++ b/source3/smbd/globals.h
@@ -531,10 +531,6 @@ struct smbd_server_connection {
 			int max_send;
 			uint16_t last_session_tag;
 
-			/* users from session setup */
-			char *session_userlist;
-			/* workgroup from session setup. */
-			char *session_workgroup;
 			/*
 			 * this holds info on user ids that are already
 			 * validated for this VC
diff --git a/source3/smbd/negprot.c b/source3/smbd/negprot.c
index 2f3fd450ca..8a6b509fea 100644
--- a/source3/smbd/negprot.c
+++ b/source3/smbd/negprot.c
@@ -299,7 +299,6 @@ static void reply_nt1(struct smb_request *req, uint16 choice)
 	   supports it and we can do encrypted passwords */
 
 	if (sconn->smb1.negprot.encrypted_passwords &&
-	    (lp_security() != SEC_SHARE) &&
 	    lp_use_spnego() &&
 	    (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
 		negotiate_spnego = True;
diff --git a/source3/smbd/password.c b/source3/smbd/password.c
index 9df99ef6b1..27ba3bd01b 100644
--- a/source3/smbd/password.c
+++ b/source3/smbd/password.c
@@ -172,12 +172,6 @@ int register_initial_vuid(struct smbd_server_connection *sconn)
 {
 	user_struct *vuser;
 
-	/* Paranoia check. */
-	if(lp_security() == SEC_SHARE) {
-		smb_panic("register_initial_vuid: "
-			"Tried to register uid in security=share");
-	}
-
 	/* Limit allowed vuids to 16bits - VUID_OFFSET. */
 	if (sconn->smb1.sessions.num_validated_vuids >= 0xFFFF-VUID_OFFSET) {
 		return UID_FIELD_INVALID;
@@ -352,394 +346,3 @@ int register_existing_vuid(struct smbd_server_connection *sconn,
 	}
 	return UID_FIELD_INVALID;
 }
-
-/****************************************************************************
- Add a name to the session users list.
-****************************************************************************/
-
-void add_session_user(struct smbd_server_connection *sconn,
-		      const char *user)
-{
-	struct passwd *pw;
-	char *tmp;
-
-	pw = Get_Pwnam_alloc(talloc_tos(), user);
-
-	if (pw == NULL) {
-		return;
-	}
-
-	if (sconn->smb1.sessions.session_userlist == NULL) {
-		sconn->smb1.sessions.session_userlist = SMB_STRDUP(pw->pw_name);
-		goto done;
-	}
-
-	if (in_list(pw->pw_name,sconn->smb1.sessions.session_userlist,false)) {
-		goto done;
-	}
-
-	if (strlen(sconn->smb1.sessions.session_userlist) > 128 * 1024) {
-		DEBUG(3,("add_session_user: session userlist already "
-			 "too large.\n"));
-		goto done;
-	}
-
-	if (asprintf(&tmp, "%s %s",
-		     sconn->smb1.sessions.session_userlist, pw->pw_name) == -1) {
-		DEBUG(3, ("asprintf failed\n"));
-		goto done;
-	}
-
-	SAFE_FREE(sconn->smb1.sessions.session_userlist);
-	sconn->smb1.sessions.session_userlist = tmp;
- done:
-	TALLOC_FREE(pw);
-}
-
-/****************************************************************************
- In security=share mode we need to store the client workgroup, as that's
-  what Vista uses for the NTLMv2 calculation.
-****************************************************************************/
-
-void add_session_workgroup(struct smbd_server_connection *sconn,
-			   const char *workgroup)
-{
-	if (sconn->smb1.sessions.session_workgroup) {
-		SAFE_FREE(sconn->smb1.sessions.session_workgroup);
-	}
-	sconn->smb1.sessions.session_workgroup = smb_xstrdup(workgroup);
-}
-
-/****************************************************************************
- In security=share mode we need to return the client workgroup, as that's
-  what Vista uses for the NTLMv2 calculation.
-****************************************************************************/
-
-const char *get_session_workgroup(struct smbd_server_connection *sconn)
-{
-	return sconn->smb1.sessions.session_workgroup;
-}
-
-/****************************************************************************
- Check if a username is valid.
-****************************************************************************/
-
-static bool user_ok(const char *user, int snum)
-{
-	bool ret;
-
-	ret = True;
-
-	if (lp_invalid_users(snum)) {
-		char **invalid = str_list_copy(talloc_tos(),
-			lp_invalid_users(snum));
-		if (invalid &&
-		    str_list_substitute(invalid, "%S", lp_servicename(snum))) {
-
-			/* This is used in sec=share only, so no current user
-			 * around to pass to str_list_sub_basic() */
-
-			if ( invalid && str_list_sub_basic(invalid, "", "") ) {
-				ret = !user_in_list(talloc_tos(), user,
-						    (const char **)invalid);
-			}
-		}
-		TALLOC_FREE(invalid);
-	}
-
-	if (ret && lp_valid_users(snum)) {
-		char **valid = str_list_copy(talloc_tos(),
-			lp_valid_users(snum));
-		if ( valid &&
-		     str_list_substitute(valid, "%S", lp_servicename(snum)) ) {
-
-			/* This is used in sec=share only, so no current user
-			 * around to pass to str_list_sub_basic() */
-
-			if ( valid && str_list_sub_basic(valid, "", "") ) {
-				ret = user_in_list(talloc_tos(), user,
-						   (const char **)valid);
-			}
-		}
-		TALLOC_FREE(valid);
-	}
-
-	if (ret && lp_onlyuser(snum)) {
-		char **user_list = str_list_make_v3(
-			talloc_tos(), lp_username(snum), NULL);
-		if (user_list &&
-		    str_list_substitute(user_list, "%S",
-					lp_servicename(snum))) {
-			ret = user_in_list(talloc_tos(), user,
-					   (const char **)user_list);
-		}
-		TALLOC_FREE(user_list);
-	}
-
-	return(ret);
-}
-
-/****************************************************************************
- Validate a group username entry. Return the username or NULL.
-****************************************************************************/
-
-static char *validate_group(struct smbd_server_connection *sconn,
-			    char *group, DATA_BLOB password,int snum)
-{
-#ifdef HAVE_NETGROUP
-	{
-		char *host, *user, *domain;
-		struct auth_context *actx = sconn->smb1.negprot.auth_context;
-		bool enc = sconn->smb1.negprot.encrypted_passwords;
-		setnetgrent(group);
-		while (getnetgrent(&host, &user, &domain)) {
-			if (user) {
-				if (user_ok(user, snum) &&
-				    password_ok(actx, enc,
-						get_session_workgroup(sconn),
-						user,
-						sconn->remote_address,
-						password)) {
-					endnetgrent();
-					return(user);
-				}
-			}
-		}
-		endnetgrent();
-	}
-#endif
-
-#ifdef HAVE_GETGRENT
-	{
-		struct group *gptr;
-		struct auth_context *actx = sconn->smb1.negprot.auth_context;
-		bool enc = sconn->smb1.negprot.encrypted_passwords;
-
-		setgrent();
-		while ((gptr = (struct group *)getgrent())) {
-			if (strequal(gptr->gr_name,group))
-				break;
-		}
-
-		/*
-		 * As user_ok can recurse doing a getgrent(), we must
-		 * copy the member list onto the heap before
-		 * use. Bug pointed out by leon@eatworms.swmed.edu.
-		 */
-
-		if (gptr) {
-			char *member_list = NULL;
-			size_t list_len = 0;
-			char *member;
-			int i;
-
-			for(i = 0; gptr->gr_mem && gptr->gr_mem[i]; i++) {
-				list_len += strlen(gptr->gr_mem[i])+1;
-			}
-			list_len++;
-
-			member_list = (char *)SMB_MALLOC(list_len);
-			if (!member_list) {
-				endgrent();
-				return NULL;
-			}
-
-			*member_list = '\0';
-			member = member_list;
-
-			for(i = 0; gptr->gr_mem && gptr->gr_mem[i]; i++) {
-				size_t member_len = strlen(gptr->gr_mem[i])+1;
-
-				DEBUG(10,("validate_group: = gr_mem = "
-					  "%s\n", gptr->gr_mem[i]));
-
-				strlcpy(member, gptr->gr_mem[i],
-					list_len - (member-member_list));
-				member += member_len;
-			}
-
-			endgrent();
-
-			member = member_list;
-			while (*member) {
-				if (user_ok(member,snum) &&
-				    password_ok(actx, enc,
-						get_session_workgroup(sconn),
-						member,
-						sconn->remote_address,
-						password)) {
-					char *name = talloc_strdup(talloc_tos(),
-								member);
-					SAFE_FREE(member_list);
-					return name;
-				}
-
-				DEBUG(10,("validate_group = member = %s\n",
-					  member));
-
-				member += strlen(member) + 1;
-			}
-
-			SAFE_FREE(member_list);
-		} else {
-			endgrent();
-			return NULL;
-		}
-	}
-#endif
-	return(NULL);
-}
-
-/****************************************************************************
- Check for authority to login to a service with a given username/password.
- Note this is *NOT* used when logging on using sessionsetup_and_X.
-****************************************************************************/
-
-bool authorise_login(struct smbd_server_connection *sconn,
-		     int snum, fstring user, DATA_BLOB password,
-		     bool *guest)
-{
-	bool ok = False;
-	struct auth_context *actx = sconn->smb1.negprot.auth_context;
-	bool enc = sconn->smb1.negprot.encrypted_passwords;
-
-#ifdef DEBUG_PASSWORD
-	DEBUG(100,("authorise_login: checking authorisation on "
-		   "user=%s pass=%s\n", user,password.data));
-#endif
-
-	*guest = False;
-
-	/* there are several possibilities:
-		1) login as the given user with given password
-		2) login as a previously registered username with the given
-		   password
-		3) login as a session list username with the given password
-		4) login as a previously validated user/password pair
-		5) login as the "user =" user with given password
-		6) login as the "user =" user with no password
-		   (guest connection)
-		7) login as guest user with no password
-
-		if the service is guest_only then steps 1 to 5 are skipped
-	*/
-
-	/* now check the list of session users */
-	if (!ok) {
-		char *auser;
-		char *user_list = NULL;
-		char *saveptr;
-
-		if (sconn->smb1.sessions.session_userlist)
-			user_list = SMB_STRDUP(sconn->smb1.sessions.session_userlist);
-		else
-			user_list = SMB_STRDUP("");
-
-		if (!user_list)
-			return(False);
-
-		for (auser = strtok_r(user_list, LIST_SEP, &saveptr);
-		     !ok && auser;
-		     auser = strtok_r(NULL, LIST_SEP, &saveptr)) {
-			fstring user2;
-			fstrcpy(user2,auser);
-			if (!user_ok(user2,snum))
-				continue;
-
-			if (password_ok(actx, enc,
-					get_session_workgroup(sconn),
-					user2,
-					sconn->remote_address,
-					password)) {
-				ok = True;
-				strlcpy(user,user2,sizeof(fstring));
-				DEBUG(3,("authorise_login: ACCEPTED: session "
-					 "list username (%s) and given "
-					 "password ok\n", user));
-			}
-		}
-
-		SAFE_FREE(user_list);
-	}
-
-	/* check the user= fields and the given password */
-	if (!ok && lp_username(snum)) {
-		TALLOC_CTX *ctx = talloc_tos();
-		char *auser;
-		char *user_list = talloc_strdup(ctx, lp_username(snum));
-		char *saveptr;
-
-		if (!user_list) {
-			goto check_guest;
-		}
-
-		user_list = talloc_string_sub(ctx,
-				user_list,
-				"%S",
-				lp_servicename(snum));
-
-		if (!user_list) {
-			goto check_guest;
-		}
-
-		for (auser = strtok_r(user_list, LIST_SEP, &saveptr);
-		     auser && !ok;
-		     auser = strtok_r(NULL, LIST_SEP, &saveptr)) {
-			if (*auser == '@') {
-				auser = validate_group(sconn,auser+1,
-						       password,snum);
-				if (auser) {
-					ok = True;
-					fstrcpy(user,auser);
-					DEBUG(3,("authorise_login: ACCEPTED: "
-						 "group username and given "
-						 "password ok (%s)\n", user));
-				}
-			} else {
-				fstring user2;
-				fstrcpy(user2,auser);
-				if (user_ok(user2,snum) &&
-				    password_ok(actx, enc,
-						get_session_workgroup(sconn),
-						user2,
-						sconn->remote_address,
-						password)) {
-					ok = True;
-					strlcpy(user,user2,sizeof(fstring));
-					DEBUG(3,("authorise_login: ACCEPTED: "
-						 "user list username and "
-						 "given password ok (%s)\n",
-						 user));
-				}
-			}
-		}
-	}
-
-  check_guest:
-
-	/* check for a normal guest connection */
-	if (!ok && GUEST_OK(snum)) {
-		struct passwd *guest_pw;
-		fstring guestname;
-		fstrcpy(guestname,lp_guestaccount());
-		guest_pw = Get_Pwnam_alloc(talloc_tos(), guestname);
-		if (guest_pw != NULL) {
-			strlcpy(user,guestname,sizeof(fstring));
-			ok = True;
-			DEBUG(3,("authorise_login: ACCEPTED: guest account "
-				 "and guest ok (%s)\n",	user));
-		} else {
-			DEBUG(0,("authorise_login: Invalid guest account "
-				 "%s??\n",guestname));
-		}
-		TALLOC_FREE(guest_pw);
-		*guest = True;
-	}
-
-	if (ok && !user_ok(user, snum)) {
-		DEBUG(0,("authorise_login: rejected invalid user %s\n",user));
-		ok = False;
-	}
-
-	return(ok);
-}
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 6ffc06700f..6c927554f1 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -1364,8 +1364,7 @@ static connection_struct *switch_message(uint8 type, struct smb_request *req, in
 	flags = smb_messages[type].flags;
 
 	/* In share mode security we must ignore the vuid. */
-	session_tag = (lp_security() == SEC_SHARE)
-		? UID_FIELD_INVALID : req->vuid;
+	session_tag = req->vuid;
 	conn = req->conn;
 
 	DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
@@ -3257,10 +3256,6 @@ void smbd_process(struct tevent_context *ev_ctx,
 	sconn->smb1.sessions.done_sesssetup = false;
 	sconn->smb1.sessions.max_send = BUFFER_SIZE;
 	sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
-	/* users from session setup */
-	sconn->smb1.sessions.session_userlist = NULL;
-	/* workgroup from session setup. */
-	sconn->smb1.sessions.session_workgroup = NULL;
 	/* this holds info on user ids that are already validated for this VC */
 	sconn->smb1.sessions.validated_users = NULL;
 	sconn->smb1.sessions.next_vuid = VUID_OFFSET;
diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h
index 599180084e..7321ca698f 100644
--- a/source3/smbd/proto.h
+++ b/source3/smbd/proto.h
@@ -707,13 +707,6 @@ int register_existing_vuid(struct smbd_server_connection *sconn,
 			uint16 vuid,
 			struct auth_session_info *session_info,
 			DATA_BLOB response_blob);
-void add_session_user(struct smbd_server_connection *sconn, const char *user);
-void add_session_workgroup(struct smbd_server_connection *sconn,
-			   const char *workgroup);
-const char *get_session_workgroup(struct smbd_server_connection *sconn);
-bool authorise_login(struct smbd_server_connection *sconn,
-		     int snum, fstring user, DATA_BLOB password,
-		     bool *guest);
 
 /* The following definitions come from smbd/pipes.c  */
 
@@ -986,11 +979,10 @@ struct smbd_smb2_tcon;
 connection_struct *make_connection_smb2(struct smbd_server_connection *sconn,
 					struct smbd_smb2_tcon *tcon,
 					user_struct *vuser,
-					DATA_BLOB password,
 					const char *pdev,
 					NTSTATUS *pstatus);
 connection_struct *make_connection(struct smbd_server_connection *sconn,
-				   const char *service_in, DATA_BLOB password,
+				   const char *service_in,
 				   const char *pdev, uint16 vuid,
 				   NTSTATUS *status);
 void close_cnum(connection_struct *conn, uint16 vuid);
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 0ab764c2d4..26a928f1b4 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -599,13 +599,6 @@ void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inb
 			break;
 		}
 
-		/* only add the client's machine name to the list
-		   of possibly valid usernames if we are operating
-		   in share mode security */
-		if (lp_security() == SEC_SHARE) {
-			add_session_user(sconn, get_remote_machine_name());
-		}
-
 		reload_services(sconn, conn_snum_used, true);
 		reopen_logs();
 
@@ -656,7 +649,6 @@ void reply_tcon(struct smb_request *req)
 	int pwlen=0;
 	NTSTATUS nt_status;
 	const char *p;
-	DATA_BLOB password_blob;
 	TALLOC_CTX *ctx = talloc_tos();
 	struct smbd_server_connection *sconn = req->sconn;
 
@@ -688,14 +680,10 @@ void reply_tcon(struct smb_request *req)
 		service = service_buf;
 	}
 
-	password_blob = data_blob(password, pwlen+1);
-
-	conn = make_connection(sconn,service,password_blob,dev,
+	conn = make_connection(sconn,service,dev,
 			       req->vuid,&nt_status);
 	req->conn = conn;
 
-	data_blob_clear_free(&password_blob);
-
 	if (!conn) {
 		reply_nterror(req, nt_status);
 		END_PROFILE(SMBtcon);
@@ -723,7 +711,6 @@ void reply_tcon_and_X(struct smb_request *req)
 {
 	connection_struct *conn = req->conn;
 	const char *service = NULL;
-	DATA_BLOB password;
 	TALLOC_CTX *ctx = talloc_tos();
 	/* what the cleint thinks the device is */
 	char *client_devicetype = NULL;
@@ -761,27 +748,14 @@ void reply_tcon_and_X(struct smb_request *req)
 	}
 
 	if (sconn->smb1.negprot.encrypted_passwords) {
-		password = data_blob_talloc(talloc_tos(), req->buf, passlen);
-		if (lp_security() == SEC_SHARE) {
-			/*
-			 * Security = share always has a pad byte
-			 * after the password.
-			 */
-			p = (const char *)req->buf + passlen + 1;
-		} else {
-			p = (const char *)req->buf + passlen;
-		}
+		p = (const char *)req->buf + passlen;
 	} else {
-		password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
-		/* Ensure correct termination */
-		password.data[passlen]=0;
 		p = (const char *)req->buf + passlen + 1;
 	}
 
 	p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 
 	if (path == NULL) {
-		data_blob_clear_free(&password);
 		reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 		END_PROFILE(SMBtconX);
 		return;
@@ -794,7 +768,6 @@ void reply_tcon_and_X(struct smb_request *req)
 	if (*path=='\\') {
 		q = strchr_m(path+2,'\\');
 		if (!q) {
-			data_blob_clear_free(&password);
 			reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 			END_PROFILE(SMBtconX);
 			return;
@@ -809,7 +782,6 @@ void reply_tcon_and_X(struct smb_request *req)
 				MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 
 	if (client_devicetype == NULL) {
-		data_blob_clear_free(&password);
 		reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 		END_PROFILE(SMBtconX);
 		return;
@@ -817,12 +789,10 @@ void reply_tcon_and_X(struct smb_request *req)
 
 	DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 
-	conn = make_connection(sconn, service, password, client_devicetype,
+	conn = make_connection(sconn, service, client_devicetype,
 			       req->vuid, &nt_status);
 	req->conn =conn;
 
-	data_blob_clear_free(&password);
-
 	if (!conn) {
 		reply_nterror(req, nt_status);
 		END_PROFILE(SMBtconX);
@@ -2117,7 +2087,7 @@ void reply_ulogoffX(struct smb_request *req)
 
 	/* in user level security we are supposed to close any files
 		open by this user */
-	if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
+	if (vuser != NULL) {
 		file_close_user(sconn, req->vuid);
 	}
 
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 8436fbee91..c53323381e 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -381,7 +381,6 @@ static NTSTATUS find_forced_group(bool force_user,
 static NTSTATUS create_connection_session_info(struct smbd_server_connection *sconn,
 					      TALLOC_CTX *mem_ctx, int snum,
                                               struct auth_session_info *session_info,
-					      DATA_BLOB password,
                                               struct auth_session_info **presult)
 {
         if (lp_guest_only(snum)) {
@@ -425,29 +424,7 @@ static NTSTATUS create_connection_session_info(struct smbd_server_connection *sc
 		return NT_STATUS_OK;
         }
 
-        if (lp_security() == SEC_SHARE) {
-
-                fstring user;
-		bool guest;
-
-                /* add the sharename as a possible user name if we
-                   are in share mode security */
-
-                add_session_user(sconn, lp_servicename(snum));
-
-                /* shall we let them in? */
-
-                if (!authorise_login(sconn, snum,user,password,&guest)) {
-                        DEBUG( 2, ( "Invalid username/password for [%s]\n",
-                                    lp_servicename(snum)) );
-			return NT_STATUS_WRONG_PASSWORD;
-                }
-
-		return make_session_info_from_username(mem_ctx, user, guest,
-						       presult);
-        }
-
-	DEBUG(0, ("invalid VUID (vuser) but not in security=share\n"));
+	DEBUG(0, ("invalid VUID (vuser)\n"));
 	return NT_STATUS_ACCESS_DENIED;
 }
 
@@ -557,7 +534,6 @@ static void create_share_access_mask(connection_struct *conn, int snum)
 static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 					connection_struct *conn,
 					int snum, user_struct *vuser,
-					DATA_BLOB password,
 					const char *pdev)
 {
 	struct smb_filename *smb_fname_cpath = NULL;
@@ -582,7 +558,7 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 	conn->params->service = snum;
 
 	status = create_connection_session_info(sconn,
-		conn, snum, vuser ? vuser->session_info : NULL, password,
+		conn, snum, vuser ? vuser->session_info : NULL,
 		&conn->session_info);
 
 	if (!NT_STATUS_IS_OK(status)) {
@@ -591,12 +567,10 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 		goto err_root_exit;
 	}
 
-	if ((lp_guest_only(snum)) || (lp_security() == SEC_SHARE)) {
+	if (lp_guest_only(snum)) {
 		conn->force_user = true;
 	}
 
-	add_session_user(sconn, conn->session_info->unix_info->unix_name);
-
 	conn->num_files_open = 0;
 	conn->lastused = conn->lastused_count = time(NULL);
 	conn->used = True;
@@ -630,7 +604,7 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 		goto err_root_exit;
 	}
 
-	conn->vuid = (vuser != NULL) ? vuser->vuid : UID_FIELD_INVALID;
+	conn->vuid = vuser->vuid;
 
 	{
 		char *s = talloc_sub_advanced(talloc_tos(),
@@ -930,7 +904,6 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 
 static connection_struct *make_connection_smb1(struct smbd_server_connection *sconn,
 					int snum, user_struct *vuser,
-					DATA_BLOB password,
 					const char *pdev,
 					NTSTATUS *pstatus)
 {
@@ -944,7 +917,6 @@ static connection_struct *make_connection_smb1(struct smbd_server_connection *sc
 					conn,
 					snum,
 					vuser,
-                                        password,
 					pdev);
 	if (!NT_STATUS_IS_OK(*pstatus)) {
 		conn_free(conn);
@@ -961,7 +933,6 @@ static connection_struct *make_connection_smb1(struct smbd_server_connection *sc
 connection_struct *make_connection_smb2(struct smbd_server_connection *sconn,
 					struct smbd_smb2_tcon *tcon,
 					user_struct *vuser,
-					DATA_BLOB password,
 					const char *pdev,
 					NTSTATUS *pstatus)
 {
@@ -976,7 +947,6 @@ connection_struct *make_connection_smb2(struct smbd_server_connection *sconn,
 					conn,
 					tcon->snum,
 					vuser,
-                                        password,
 					pdev);
 	if (!NT_STATUS_IS_OK(*pstatus)) {
 		conn_free(conn);
@@ -992,7 +962,7 @@ connection_struct *make_connection_smb2(struct smbd_server_connection *sconn,
 ****************************************************************************/
 
 connection_struct *make_connection(struct smbd_server_connection *sconn,
-				   const char *service_in, DATA_BLOB password,
+				   const char *service_in,
 				   const char *pdev, uint16 vuid,
 				   NTSTATUS *status)
 {
@@ -1017,14 +987,12 @@ connection_struct *make_connection(struct smbd_server_connection *sconn,
 		return NULL;
 	}
 
-	if(lp_security() != SEC_SHARE) {
-		vuser = get_valid_user_struct(sconn, vuid);
-		if (!vuser) {
-			DEBUG(1,("make_connection: refusing to connect with "
-				 "no session setup\n"));
-			*status = NT_STATUS_ACCESS_DENIED;
-			return NULL;
-		}
+	vuser = get_valid_user_struct(sconn, vuid);
+	if (!vuser) {
+		DEBUG(1,("make_connection: refusing to connect with "
+			 "no session setup\n"));
+		*status = NT_STATUS_ACCESS_DENIED;
+		return NULL;
 	}
 
 	/* Logic to try and connect to the correct [homes] share, preferably
@@ -1037,57 +1005,28 @@ connection_struct *make_connection(struct smbd_server_connection *sconn,
 	*/
 
 	if (strequal(service_in,HOMES_NAME)) {
-		if(lp_security() != SEC_SHARE) {
-			DATA_BLOB no_pw = data_blob_null;
-			if (vuser->homes_snum == -1) {
-				DEBUG(2, ("[homes] share not available for "
-					  "this user because it was not found "
-					  "or created at session setup "
-					  "time\n"));
-				*status = NT_STATUS_BAD_NETWORK_NAME;
-				return NULL;
-			}
-			DEBUG(5, ("making a connection to [homes] service "
-				  "created at session setup time\n"));
-			return make_connection_smb1(sconn,
-						    vuser->homes_snum,
-						    vuser, no_pw, 
-						    dev, status);
-		} else {
-			/* Security = share. Try with
-			 * current_user_info.smb_name as the username.  */
-			if (*current_user_info.smb_name) {
-				char *unix_username = NULL;
-				(void)map_username(talloc_tos(),
-						current_user_info.smb_name,
-						&unix_username);
-				snum = find_service(talloc_tos(),
-						unix_username,
-						&unix_username);
-				if (!unix_username) {
-					*status = NT_STATUS_NO_MEMORY;
-				}
-				return NULL;
-			}
-			if (snum != -1) {
-				DEBUG(5, ("making a connection to 'homes' "
-					  "service %s based on "
-					  "security=share\n", service_in));
-				return make_connection_smb1(sconn,
-							    snum, NULL,
-							    password,
-							    dev, status);
-			}
+		if (vuser->homes_snum == -1) {
+			DEBUG(2, ("[homes] share not available for "
+				  "this user because it was not found "
+				  "or created at session setup "
+				  "time\n"));
+			*status = NT_STATUS_BAD_NETWORK_NAME;
+			return NULL;
 		}
-	} else if ((lp_security() != SEC_SHARE) && (vuser->homes_snum != -1)
+		DEBUG(5, ("making a connection to [homes] service "
+			  "created at session setup time\n"));
+		return make_connection_smb1(sconn,
+					    vuser->homes_snum,
+					    vuser,
+					    dev, status);
+	} else if ((vuser->homes_snum != -1)
 		   && strequal(service_in,
 			       lp_servicename(vuser->homes_snum))) {
-		DATA_BLOB no_pw = data_blob_null;
 		DEBUG(5, ("making a connection to 'homes' service [%s] "
 			  "created at session setup time\n", service_in));
 		return make_connection_smb1(sconn,
 					    vuser->homes_snum,
-					    vuser, no_pw, 
+					    vuser,
 					    dev, status);
 	}
 
@@ -1134,7 +1073,6 @@ connection_struct *make_connection(struct smbd_server_connection *sconn,
 	DEBUG(5, ("making a connection to 'normal' service %s\n", service));
 
 	return make_connection_smb1(sconn, snum, vuser,
-				    password,
 				    dev, status);
 }
 
diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index 987b626d6b..da306b97bc 100644
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -561,11 +561,7 @@ void reply_sesssetup_and_X(struct smb_request *req)
 		if (doencrypt) {
 			lm_resp = data_blob(p, passlen1);
 			nt_resp = data_blob(p+passlen1, passlen2);
-		} else if (lp_security() != SEC_SHARE) {
-			/*
-			 * In share level we should ignore any passwords, so
- 			 * only read them if we're not.
- 			 */
+		} else {
 			char *pass = NULL;
 			bool unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
 
@@ -673,27 +669,6 @@ void reply_sesssetup_and_X(struct smb_request *req)
 
 	reload_services(sconn, conn_snum_used, true);
 
-	if (lp_security() == SEC_SHARE) {
-		char *sub_user_mapped = NULL;
-		/* In share level we should ignore any passwords */
-
-		data_blob_free(&lm_resp);
-		data_blob_free(&nt_resp);
-		data_blob_clear_free(&plaintext_password);
-
-		(void)map_username(talloc_tos(), sub_user, &sub_user_mapped);
-		if (!sub_user_mapped) {
-			reply_nterror(req, NT_STATUS_NO_MEMORY);
-			END_PROFILE(SMBsesssetupX);
-			return;
-		}
-		fstrcpy(sub_user, sub_user_mapped);
-		add_session_user(sconn, sub_user);
-		add_session_workgroup(sconn, domain);
-		/* Then force it to null for the benfit of the code below */
-		user = "";
-	}
-
 	if (!*user) {
 
 		nt_status = check_guest_password(sconn->remote_address, &server_info);
@@ -796,36 +771,31 @@ void reply_sesssetup_and_X(struct smb_request *req)
 	/* register the name and uid as being validated, so further connections
 	   to a uid can get through without a password, on the same VC */
 
-	if (lp_security() == SEC_SHARE) {
-		sess_vuid = UID_FIELD_INVALID;
-		TALLOC_FREE(session_info);
-	} else {
-		/* Ignore the initial vuid. */
-		sess_vuid = register_initial_vuid(sconn);
-		if (sess_vuid == UID_FIELD_INVALID) {
-			data_blob_free(&nt_resp);
-			data_blob_free(&lm_resp);
-			reply_nterror(req, nt_status_squash(
-					      NT_STATUS_LOGON_FAILURE));
-			END_PROFILE(SMBsesssetupX);
-			return;
-		}
-		/* register_existing_vuid keeps the session_info */
-		sess_vuid = register_existing_vuid(sconn, sess_vuid,
-					session_info,
-					nt_resp.data ? nt_resp : lm_resp);
-		if (sess_vuid == UID_FIELD_INVALID) {
-			data_blob_free(&nt_resp);
-			data_blob_free(&lm_resp);
-			reply_nterror(req, nt_status_squash(
-					      NT_STATUS_LOGON_FAILURE));
-			END_PROFILE(SMBsesssetupX);
-			return;
-		}
-
-		/* current_user_info is changed on new vuid */
-		reload_services(sconn, conn_snum_used, true);
+	/* Ignore the initial vuid. */
+	sess_vuid = register_initial_vuid(sconn);
+	if (sess_vuid == UID_FIELD_INVALID) {
+		data_blob_free(&nt_resp);
+		data_blob_free(&lm_resp);
+		reply_nterror(req, nt_status_squash(
+				      NT_STATUS_LOGON_FAILURE));
+		END_PROFILE(SMBsesssetupX);
+		return;
 	}
+	/* register_existing_vuid keeps the session_info */
+	sess_vuid = register_existing_vuid(sconn, sess_vuid,
+					   session_info,
+					   nt_resp.data ? nt_resp : lm_resp);
+	if (sess_vuid == UID_FIELD_INVALID) {
+		data_blob_free(&nt_resp);
+		data_blob_free(&lm_resp);
+		reply_nterror(req, nt_status_squash(
+				      NT_STATUS_LOGON_FAILURE));
+		END_PROFILE(SMBsesssetupX);
+		return;
+	}
+
+	/* current_user_info is changed on new vuid */
+	reload_services(sconn, conn_snum_used, true);
 
 	data_blob_free(&nt_resp);
 	data_blob_free(&lm_resp);
diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c
index b7e5ce0877..56c42889b6 100644
--- a/source3/smbd/smb2_tcon.c
+++ b/source3/smbd/smb2_tcon.c
@@ -232,7 +232,7 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
 	compat_conn = make_connection_smb2(req->sconn,
 					tcon,
 					req->session->compat_vuser,
-					data_blob_null, "???",
+					"???",
 					&status);
 	if (compat_conn == NULL) {
 		TALLOC_FREE(tcon);
diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c
index 3847d393d7..84cb61cd14 100644
--- a/source3/smbd/uid.c
+++ b/source3/smbd/uid.c
@@ -288,19 +288,7 @@ bool change_to_user(connection_struct *conn, uint16_t vuid)
 
 	vuser = get_valid_user_struct(conn->sconn, vuid);
 
-	/*
-	 * We need a separate check in security=share mode due to vuid
-	 * always being UID_FIELD_INVALID. If we don't do this then
-	 * in share mode security we are *always* changing uid's between
-	 * SMB's - this hurts performance - Badly.
-	 */
-
-	if((lp_security() == SEC_SHARE) && (current_user.conn == conn) &&
-	   (current_user.ut.uid == conn->session_info->unix_token->uid)) {
-		DEBUG(4,("Skipping user change - already "
-			 "user\n"));
-		return(True);
-	} else if ((current_user.conn == conn) &&
+	if ((current_user.conn == conn) &&
 		   (vuser != NULL) && (current_user.vuid == vuid) &&
 		   (current_user.ut.uid == vuser->session_info->unix_token->uid)) {
 		DEBUG(4,("Skipping user change - already "
@@ -308,16 +296,15 @@ bool change_to_user(connection_struct *conn, uint16_t vuid)
 		return(True);
 	}
 
-	session_info = vuser ? vuser->session_info : conn->session_info;
-
-	if (session_info == NULL) {
-		/* Invalid vuid sent - even with security = share. */
+	if (vuser == NULL) {
+		/* Invalid vuid sent */
 		DEBUG(2,("Invalid vuid %d used on "
 			 "share %s.\n", vuid, lp_servicename(snum) ));
 		return false;
 	}
 
-	/* security = share sets force_user. */
+	session_info = vuser->session_info;
+
 	if (!conn->force_user && vuser == NULL) {
 		DEBUG(2,("Invalid vuid used %d in accessing "
 			"share %s.\n", vuid, lp_servicename(snum) ));