Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When starting with the default samba configuration, what settings need to be changed to make samba authenticate it's users through pam?

I'm attempting to authenticate samba users via pam, and specifically pam_pwdfile. The trouble I'm running into is with the samba configuration file, I can't seem to get the right mix of settings in the global section of the file.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

This is from the Samba Howto: "There is an option in smb.conf called obey pam restrictions. The following is from the online help for this option in SWAT: When Samba is configured to enable PAM support (i.e., --with-pam), this parameter will control whether or not Samba should obey PAM’s account and session management directives. The default behavior is to use PAM for clear-text authentication only and to ignore any account or session management. Samba always ignores PAM for authentication in the case of encrypt passwords = yes. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. Default: obey pam restrictions = no"

share|improve this answer

When starting with the default samba configuration, what settings need to be changed to make samba authenticate it's users through pam?

Ah, it kinda-sorta-sounds-like you've got the cart before the horse. Hear me for a moment...

There's alot of information missing here - I'm working on the assumption that when you mean "authenticate", you really mean "my network file sharing client (usually Windows-based) is attempting to connect to a share or resource provided by Samba and the credentials being presented need to be authenticated by using the local /etc/passwd file." In which case, you kinda can't get there from here...without a lot of hoops. I also don't know how many servers you have to work with, if they are running Windows, BSD, Linux, or what-have-you. I don't know what the ultimate goal is - if you're just providing services to local users on a LAN, or you intend to use it in some other manner.

Samba usually has its own authentication hooks that do not rely on /etc/passwd because the requirements imposed by storing NTLM hashes. No hashes = no authentication. So there's a problem. Fortunately, there are several solutions.

The first is to use an existing Active Domain controller. Usually, you set up Winbind and put a shim into /etc/nsswitch.conf for both users and groups, which handles this issue (winbind then handles the authentication request, rather than pam). It requires a bit of hand-work, but is easiest to set up, because the user accounts are controlled and maintained by a Windows Server and requires basically little-to-no intervention with Samba on your part.

The second is to use LDAP. I haven't used this method but I hear it's fairly popular. It still requires another server.

The third is to turn your Samba install into a PDC. If you don't have an external AD controller, you can set yourself up an NT4-style PDC using the Samba installation you're working with, although you'll still have a need to authenticate users through *.tdb files. The smbpasswd command is used for this purpose.

share|improve this answer
    
Your assumption about my meaning of "authenticate" is correct. I am working with a lone linux server with windows and mac clients. I intend to provide simple smb/cifs file sharing for the LAN (and nothing more than that from samba). I was hoping that I could use PAM to basically replace the .tdb files that smbpasswd creates. I know samba can be setup to use PAM to access remote winbind authentication and reasoned that it might be able to re purpose it. My main goal here was to unify the passwords between different services, while making sure they were not linked to shell accounts. –  Charles Y. Sep 29 '09 at 20:58
    
Using pam and passwd will almost certainly require a stub account, even if it doesn't have a shell. The tdb files might really be the way to go. You might want to consider security=user or security=share if your security requirements are low. –  Avery Payne Sep 30 '09 at 7:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.