Samba keeps warning 'Session closed for user nobody'. Why?

Solution 1:

I had this concern myself so I did some digging and ran into a lot of unanswered forum questions, but then I found this answer:

nobody is a system user that is used to run services e.g. apache and samba on Linux distros. Root has to start the service and then pass on control to the user nobody.

Solution 2:

The same issue happened to me, at that time I failed to access the shared folder from Windows (by adding the location and access it without configuring the credential on Windows first) and commenting the following line in /etc/samba/smb.conf worked for me.

map to guest = bad user

"pam_unix(samba:session): session closed for user nobody" appeared right after trying to access the share folder from Windows or other clients. It seems Windows client tries to contact samba as guest (not verified) especially when no credential is configured in the credential manager.

You may also need to change the following if you do not need guest accessing (default = yes).

usershare allow guests = no

After updating /etc/samba/smb.conf and starting the service, samba clients are able to access the shared folder.

service smbd status

Starting Samba SMB Daemon...
Started Samba SMB Daemon.
pam_unix(samba:session): session opened for user (username) by (uid=0)
pam_unix(samba:session): session closed for user (username)
pam_unix(samba:session): session opened for user (username) by (uid=0)
pam_unix(samba:session): session opened for user (username) by (uid=0)
pam_unix(samba:session): session closed for user (username)

Whether this works may depend on the samba version, the issue happened on a machine with samba 4.9.5, but no issue happened on my another machine where samba has version 4.7.6.

According to this page:

The nobody user is used when you try to access to a share as a guest. Since you didn’t set a Samba password for your user, each time you tried to authenticate as your user, it failed and fell back on a guest access instead.