Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the minimum permissions for the attributes sambaLMPassword/sambaNTPassword for the the LDAP administrator account so that Samba is just enabled to use it for authentication for ldapsam backend.

It seems like auth is not enough, is this true?!

share|improve this question

In cn=config form I've used something like:

olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous
  auth by dn="cn=admin,dc=example,dc=org" write by * none
olcAccess: {1}to attrs=sambaLMPassword,sambaNTPassword  by dn.base="cn=admin,d
 c=example,dc=org" write  by dn.base="cn=sambaservers,dc=example,dc=org"
  write  by anonymous auth  by self write by * none
olcAccess: {2}to dn.subtree="ou=Computers,dc=example,dc=org" by dn.base="
 cn=sambaservers,dc=example,dc=org" manage by * read
olcAccess: {3}to dn.subtree="ou=Group,dc=example,dc=org" by dn.base="cn=s
 ambaservers,dc=example,dc=org" manage by * read
olcAccess: {4}to dn.exact="sambaDomainName=DOMAINNAME,dc=example,dc=org" by 
  dn.base="cn=sambaservers,dc=example,dc=org" write by * read
olcAccess: {5}to dn.base="" by * read

The ou=Computers and ou=Group entries are optional and only matter for smbldap-tools. The write access for the passwords by samba is also optional too. You can actually get away without giving samba write access to sambaDomainName=DOMAINNAME,dc=example,dc=org if you wanted to.

Samba reads the hashes, it doesn't do authentication using them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.