I am using Apache Directory Studio to administer a small LDAP database, and I am planning to stop using LAM for user and group management because it lacks groupOfUniqueNames support.

I have only one problem: how can I change SAMBA passwords? There is a tool that checks and generates hashes, but apparently it doesn't recognize SAMBA NTLM. Is there a script or something?



The best way to keep Samba and LDAP passwords in sync is to deploy the smbk5pwd overlay (despite the name, it can be configured without Kerberos), which updates Samba password hashes in response to LDAP Password Modify operations, and configure Samba with ldap password sync = only. Note that this depends on your clients properly issuing Password Modify operations and not simply writing to the userPassword attribute.

  • Thanks! Will try it now. Do you know if Apache Directory Studio sends this command? – John White Aug 20 '14 at 9:26
  • I don't use Apache DS so I can't say for sure, but it looks like it does not, as the ticket is open and unresolved: issues.apache.org/jira/browse/DIRSTUDIO-648 – rtandy Aug 20 '14 at 18:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.