Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have SSH + LDAP working (I can log to Server2 with credentials from LDAP server Server1). Now, I would like to add Samba server (Server3) and it would be nice if it authenticates the users like Server2.

How can I achieve this ? As I see Samba schema and the schema used for storing Unix users are different. So if I change password in Samba schema, I would be able to log in with the old password. I need centralized storage of username/passwords. If I change it once in phpldapadmin, it means for samba and ssh.


share|improve this question
up vote 1 down vote accepted

You have to use some extra mechanism to synchronize the passwords.

I know of two ways to do this:

  1. In Samba, you can set

    ldap passwd sync = yes

    This will update all three password hashes in LDAP when a user changes their password via Samba. You will also need to set an expect script in the Samba configuration for changing the userPassword attribute. There is a working sample in the default configuration file.

  2. Use an overlay in your LDAP server. For OpenLDAP, you will need smbk5pwd. It seems to be quite an ordeal. There is a write up on configuration from 2005.

    At this point, you could set Samba to only change the UNIX password and let your overlay do the rest.

    Other LDAP servers might also have this feature.

share|improve this answer
All three being what? Samba, LDAP and which third? – ptman Jan 14 '11 at 16:16
Samba has two hashes: sambaLMpassword and sambaNTpassword. – Jeff Strunk Jan 24 '11 at 17:25

To have samba use an ldap as password backend you add this to the config:

passdb backend = ldapsam:ldap://

ldap suffix =

alternatively also:

ldap admin dn =

There is more information on this here:


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.