Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have SSH + LDAP working (I can log to Server2 with credentials from LDAP server Server1). Now, I would like to add Samba server (Server3) and it would be nice if it authenticates the users like Server2.

How can I achieve this ? As I see Samba schema and the schema used for storing Unix users are different. So if I change password in Samba schema, I would be able to log in with the old password. I need centralized storage of username/passwords. If I change it once in phpldapadmin, it means for samba and ssh.

Thanks.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

You have to use some extra mechanism to synchronize the passwords.

I know of two ways to do this:

  1. In Samba, you can set

    ldap passwd sync = yes
    

    This will update all three password hashes in LDAP when a user changes their password via Samba. You will also need to set an expect script in the Samba configuration for changing the userPassword attribute. There is a working sample in the default configuration file.

  2. Use an overlay in your LDAP server. For OpenLDAP, you will need smbk5pwd. It seems to be quite an ordeal. There is a write up on configuration from 2005. http://student.physik.uni-mainz.de/~reiffert/smbk5pwd.html

    At this point, you could set Samba to only change the UNIX password and let your overlay do the rest.

    Other LDAP servers might also have this feature.

share|improve this answer
    
All three being what? Samba, LDAP and which third? –  ptman Jan 14 '11 at 16:16
    
Samba has two hashes: sambaLMpassword and sambaNTpassword. –  Jeff Strunk Jan 24 '11 at 17:25
add comment

To have samba use an ldap as password backend you add this to the config:

passdb backend = ldapsam:ldap://

ldap suffix =

alternatively also:

ldap admin dn =

There is more information on this here:

Samba_&_LDAP

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.