Only admin can access share points.

Question

I have OS 10.4.3 server running on a G4 xServe. It was previously running 10.2.8, but it was compromised. So I zeroed the boot drive and did a clean install of 10.4 Server and upgraded it from there. I have rebuilt all the accounts, but only my admin can access the share points from the mac's and pc's on my network. I've tried mounting them with AFP, SMB and FTP, but the server won't accept any of the user/pass combinations. It is set up as a standalone server. The only groups the other users are in are the groups I created for sharing purposes, ie. they aren't in Users or staff or anything that comes as part of the OS. Nobody, including my admin account, has a login shell, and we are all using Shadow Passwords with all of the Security options checked. The only services I have running are AFP, Firewall, FTP, Web and Windows.
Since I can log in with my admin account through SMB and AFP, I think it's a matter of not having users in the correct group. The ones that look like candidates to me are Application Server, App Server Admins, Administrators, and com.apple.accessallservices. They all seem to indicate more than file sharing access to me and I want to keep this server as bulletproof as possible. Any help would be appreciated.

Answer 1

Check the following:
In Server Admin, select your server, click Settings (near the bottom), then Access (near the top). Make sure that you have not restricted just one user to use the Apple File and Windows services. You should allow all users to access both of these, then prevent outside access by configuring your server's firewall.
The groups you've listed are system groups. Do not delete them and do not add users to them, or you'll have unexpected results. The Administrators group contains all administrators. By adding a user account to that group, you have made that account an administrator for the directory domain in which the account resides. (For standalone server configurations, you've made the user an administrator of the server.) The groups beginning with com.apple assist Mac OS X Server in allowing access for certain services. These are system groups that control the SACLs (service access control lists). Again, if you want to make a user an administrator or if you want to edit the SACLs, use Workgroup Manager or Server Admin.
My recommendation would be to configure your server as an Open Directory Master. You can use Server Admin to start Open Directory and set the server's role to Master. With this in place, you can use Password Server and Kerberos to authenticate users and you can back up your user database for restoration in case of a future problem. As Standalone Server, all of your users and groups are stored in the server's local NetInfo domain, so all authentication happens locally (at the server). Creating a directory domain allows authentication to take place within the domain (e.g., from the login windows of client computers).
--Gerit