Samba - user auth against AD and local passdb

Question

I have only a short question. Is it possible to set up a samba server, who's able to authenticate some users against Active Directory and some users against a local passdb file?

We want to exchange (large) files between company users and our customer. So I cant add the customer users into our AD - the win Admins don't want it. So at the moment I have a separate account db. The company users exists in AD and separately with additional accounts on my linux samba box

Now it would be nice, if i can get the company users via AD and then I'll add the customer (by hand) to a local passdb.

Thanks for you help peter

Answer 1

This is possible (perhaps in more recent versions of samba):

If you are using security = ads in your smb.conf file, to be part of a domain, you can still add users locally (using useradd) and then use smbpasswd -a username to add a password for them (to the default tdb backend, as I hadn't configured this explicitly).

You'll need to use SERVERNAME\username as the name to connect as, rather than DOMAIN\username, but otherwise this appears to work just fine.

This worked for me on CentOS 7 with samba 4.2.3 with a Windows 7 (domain-joined) client, but I cannot vouch for any other versions.

Note: You'll still need the user to be added to the local passwd file (or another user information source which is in use via NSS, such as LDAP or NIS) so that getent passwd username works, but they don't need to have a valid shell or a system password for samba to work OK.

Answer 2

If you got two ips, you can run two instances of samba one that authenticates against ad and one against the local db. see http://wiki.samba.org/index.php/Multiple_Server_Instances, i do not think it is possible to mix authentication methods on one samba host.