Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having a problem with smbpasswd, an LDAP backend server and SSL/TLS certificates. The client machine that I run smbpasswd on is a Debian Etch machine, and the Ldap server is Sun DS running on Solaris. All the following occurs on the client.

When I disable SSL, by setting "ldap ssl = no" in smb.conf, the smbpasswd program works without errors.

When I set "ldap ssl = start tls", the following messages are printed by smbpasswd and there is a long timeout period before any password is asked by it

Failed to issue the StartTLS instruction: Connect error
Connection to LDAP server failed for the 1 try!
..... long delay .....
New SMB password:
Retype new SMB password:
Failed to issue the StartTLS instruction: Connect error
Connection to LDAP server failed for the 1 try!
smbpasswd: /tmp/buildd/openldap2-2.1.30/libraries/liblber/io.c:702: ber_get_next: Assertion `0' failed.

I conducted some tests with "ldapsearch -ZZ". It was not working at first, but after I added the TLS_CACERT line to /etc/ldap/ldap.conf, /etc/libnss-ldap.conf and /etc/pam_ldap.conf, it started working. So relevant TLS sections in all those files are:

ssl start_tls
tls_checkpeer no
tls_cacertfile /path/to/ca-root.pem
TLS_CACERT /path/to/ca-root.pem

But the smbpasswd program continued giving the error.

I tried creating /etc/smbldap-tools/smbldap.conf file with following content (after consulting debian docs for smbldap-tools package) But as I see, smbpasswd comes with samba-common package and does not use the configuration for smbldap-tools utilities.


My question is: How can I set which SSL CA Certificate is used by smbpasswd program ?

share|improve this question
up vote 1 down vote accepted

You don't specify which CA cert should the SSL client use; instead, you just append all CA certs to same file. Based on which CA signed the server cert, it tries to locate it in that root certs file.

You have run into a bug, and you are running openldap 2.2; upgrade it to the latest one: 2.4.x ldap. You would be fine then.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.