Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The former jackass IT-guy that I'm taking over for had a Samba share setup on a Fedora server that uses our OpenLDAP server to authenticate users who want to log in from Windows.

We recently added a new employee and I jumped through the LDAP hoops to add them to the system. However, I can't seem to use their login to access the Samba share. I'm looking through the LDAP settings and Groups and comparing the new user account to existing ones, and I can't figure out what settings in LDAP are required for this user to be able to access the Samba share.

Of course the former idiotic IT-guy didn't document a single thing and has all sorts of weird setups on the network. So I'm at a bit of a loss on knowing what to look for here.

Where should I start?

On the server that is hosting the Samba share, he has samba running obviously but also has smbldap-tools loaded as well.

share|improve this question
1  
Post the smb.conf? –  James Jun 8 '10 at 21:36
add comment

4 Answers

Are you sure its using LDAP for authentication and not just authorization? If you change your password in LDAP does the share allow logins with the old password or the new one? Thats an important question to answer-if you change your password and it doesn't seem to pick it up on the Samba server, the Samba server may be using locally setup Samba users and checking their group membership in LDAP.

share|improve this answer
add comment

You should be careful if you are not familar with Openldap / Samba Domain Controllers. You could end up with noone able to login to the domain if your break things.

Generally most people would you smbldap-tools ... ie /opt/IDEALX/...smbldap-useradd -m -a username ; smbldap-passwd username ; smbpasswd usernane.

There are many tools how to add users to samba/openldap. The "net" tools are included in the samba suite; they are general purpose tools and designed to have similar use to that of the Windows tools available in dos.

Testlabs Team

share|improve this answer
add comment

pdbedit on the Samba controller is a good place to start. Does the user show up in pdbedit -L? You can also use net rpc users to do something similar, but that works over the network rather than querying the password database directly.

If the user doesn't show up in the output, that means that the necessary attributes aren't there. We don't use smbldap-tools, so we can just use smbpasswd -a $username or pdbedit -a $username, but that may not be the case for you.

If the user does show up in the output, then I would start looking higher up the stack. Can you login as the user with net -U $username rpc share?

The log files are often useful, too - ours live in /var/log/samba/ under the machine name and IP address. You can use smbcontrol smbd debug to turn up the appropriate debugging sections, such as passdb.

share|improve this answer
add comment

There's a LDAP GUI tool for windows called ldapadmin. It presents the data in the LDAP directory necessary for samba in a simple human-readable format. You can also look at all the nitty-gritty stuff in the entry.

Also, have you looked at the LDAP config stuff in smb.conf? It will tell you what LDAP attributes are used if they're customized.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.