SSH + SAMBA + LDAP question

Question

I have SSH + LDAP working (I can log to Server2 with credentials from LDAP server Server1). Now, I would like to add Samba server (Server3) and it would be nice if it authenticates the users like Server2.

How can I achieve this ? As I see Samba schema and the schema used for storing Unix users are different. So if I change password in Samba schema, I would be able to log in with the old password. I need centralized storage of username/passwords. If I change it once in phpldapadmin, it means for samba and ssh.

Thanks.

Answer 1

You have to use some extra mechanism to synchronize the passwords.

I know of two ways to do this:

1. In Samba, you can set

   ldap passwd sync = yes
   

   This will update all three password hashes in LDAP when a user changes their password via Samba. You will also need to set an expect script in the Samba configuration for changing the userPassword attribute. There is a working sample in the default configuration file.

2. Use an overlay in your LDAP server. For OpenLDAP, you will need smbk5pwd. It seems to be quite an ordeal. There is a write up on configuration from 2005. http://student.physik.uni-mainz.de/~reiffert/smbk5pwd.html

   At this point, you could set Samba to only change the UNIX password and let your overlay do the rest.

   Other LDAP servers might also have this feature.

Answer 2

To have samba use an ldap as password backend you add this to the config:

passdb backend = ldapsam:ldap://

ldap suffix =

alternatively also:

ldap admin dn =

There is more information on this here:

Samba_&_LDAP