Troubleshooting
Problem
This document explains how to configure and use a Guest profile with NetServer.
Resolving The Problem
IBM i NetServer supports the use of a GUEST (or anonymous) profile. This feature enables users of Windows workstations who do not have a valid IBM i user profile to access the NetServer shares. If GUEST is enabled and the Windows login does not match a valid IBM i profile, then NetServer logs the user in as GUEST.
Note: Windows has the capability of prompting the user for a user ID and a password. Therefore, users of currently supported Windows versions are able to log on the NetServer without a GUEST profile even if the Windows login does not match a valid IBM i user profile.
To configure NetServer GUEST support, the GUEST profile must exist in IBM i, it cannot have any special authorities, and must be enabled. The GUEST profile can have any name and does not have to be called GUEST. Users are not prompted for security information when the GUEST profile is being used for the connection.
To create a GUEST profile named GUEST, do the following:
On the IBM i command line, enter the command CRTUSRPRF GUEST.
Note: To use GUEST support with NetServer Printer shares, the GUEST profile must have a password. (The network print server requires the profile have a password.) In addition, you might want to specify the initial menu as *SIGNOFF to prevent unauthorized access to an IBM i command line. If you plan to use NetServer Printer shares, create the GUEST profile by using the following command:
To configure NetServer to use the GUEST profile, do the following:
Note: Windows has the capability of prompting the user for a user ID and a password. Therefore, users of currently supported Windows versions are able to log on the NetServer without a GUEST profile even if the Windows login does not match a valid IBM i user profile.
To configure NetServer GUEST support, the GUEST profile must exist in IBM i, it cannot have any special authorities, and must be enabled. The GUEST profile can have any name and does not have to be called GUEST. Users are not prompted for security information when the GUEST profile is being used for the connection.
To create a GUEST profile named GUEST, do the following:
On the IBM i command line, enter the command CRTUSRPRF GUEST.
Note: To use GUEST support with NetServer Printer shares, the GUEST profile must have a password. (The network print server requires the profile have a password.) In addition, you might want to specify the initial menu as *SIGNOFF to prevent unauthorized access to an IBM i command line. If you plan to use NetServer Printer shares, create the GUEST profile by using the following command:
CRTUSRPRF USRPRF(GUEST) PASSWORD(xxxxx) INLMNU(*SIGNOFF).To configure NetServer to use the GUEST profile, do the following:
- Open your system in Navigator for i (for example, https://MySystem:2003/Navigator/login).
- Double-click your system node or right-click it and select 'Manage Node' to open the Navigator menu for that node.
- Expand Network, Servers, 'TCP/IP Servers'.
- Right-click 'IBM i NetServer' and select Properties
- Click the Security tab
- Click 'Expand Next Start'
- Type the name of the user profile to be used for guest access in the field labeled 'Guest user ID:'
- Click Save and OK buttons.
- Guest support is enabled when the NetServer is restarted.
Notes:
- *IOSYSCFG special authority is required to configure IBM i NetServer. *SECADM special authority is required to configure GUEST profile support.
- If the GUEST connection is used to connect to shares in the QDLS file system, the GUEST profile must be added to the IBM i System Directory. Failure to do so results in an access denied message. To add the GUEST profile to the System Directory, on the IBM i command enter the following command:
ADDDIRE USRID(GUEST MYSYSTEM) +
USRD('Guest Profile for NetServer') USER(GUEST) - The NetServer GUEST profile cannot have any special authorities. The profile must have no special privileges such as a copy of the QUSER profile (or equivalent). Attempting to add a GUEST profile with special privileges as the NetServer GUEST results in message CPFB68C 'Requested guest user profile &2 has incorrect authority'. After the GUEST profile is set, it can be given special privileges, however it is not recommended. Any user who does not have an IBM i profile can connect to NetServer as the GUEST profile.
[{"Type":"MASTER","Line of Business":{"code":"LOB57","label":"Power"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CLSAA2","label":"Integrated File System-\u003ENetServer"}],"ARM Case Number":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"All Versions"}]
Historical Number
27094741
Was this topic helpful?
Document Information
Modified date:
17 May 2022
UID
nas8N1016971