I have set up an ubuntu lucid LDAP+SAMBA PDC, mainly based on this article: http://ubuntuforums.org/showthread.php?t=1499753 - it works. Users can change their password by logging on to a Win Pc, and hitting Ctrl+Alt+Del. This way the unix passwords are changed as well - samba takes care of that.

I use that LDAP server for authentication from ubuntu desktops as well. They can logon, and change their password using /usr/bin/passwd, but this way the samba password does not change.


1) Is there a way to change not only the userPassword, but the sambaNTpassword attribute as well? I've read of pam_smbpass.so but I have no clue how to use that - I've even read somewhere that this way only the local smb passwords can be updated.

2) If the answer would be "no" for the 1st question, then is there a way to have slapd sync sambaNTPassword based on unixPassword? Maybe setting up the "exop" to do that?

3) If once again the answer is "no", then I could live with clear thext passwords in the userPassword and run an external script to calculate the hash for sambaNTpassword. I tried jacksum -a md4 -q "txt:password" but the calculated hash is not equal to the ones stored in the ldap. I have no idea why.

4) What else could I do?


You can achieve this by using OpenLDAP's smbk5pwd overlay.

This overlay needs to be added to your slapd configuration. Then, any password changes via the exop "Change password" operation will also update Samba (and optionally Kerberos) passwords.

You can simply configure your Ubuntu desktops to use the exop password change operation through /etc/ldap.conf.

| improve this answer | |
  • I am currently not at that project, but I wil revisit this problem - by about 15th of Aug. Gosh I hope that this is going to work. – raerek Jul 20 '10 at 6:22
  • i finally went back to this issue. Unfortunately cannot set it up in production, as we are using Ubuntu Lucid, and smbk5pwd is not part of that release :((( Anyway, thank you for your help. – raerek Aug 16 '10 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.