We have a server that is configured using Chef.

Currently, the way that chef manages the passwords is by simply copying down the samba tdb databases and updating the shadow hashes of each user. Since the encryption algorithm is different between these systems, it is impossible to use the shadow hash to create passwords in samba through chef.

Adding these lines to our smb.conf broke all password authentication:

encrypt passwords = no
obey pam restrictions = yes

We tried enabling unix password sync, but that doesn't take effect until someone changes their password.

We tried using the samba cookbook, but that requires knowledge of our user's passwords, which we can't have.

We tried setting the password backend to smbpasswd, and piping /etc/shadow through mksmbpasswd, but all that gave us was this garbage:


I've looked around the internet, and found very no information about setting samba passwords using encrypted hashes though chef, which anybody using samba and chef together would want to do.

I would like to use the same hash to set both the unix password and the samba password, but I don't have to, as generating two hashes is a simple problem. Generating two hashes and manually inserting one into a tdb file is more difficult than it needs to be.


You are, basically, doomed. By design, you can't convert a hash to a different hash algorithm (unless you brute-force the original password back out, and then hash it using the new algorithm). You'll need to have the users enter their password into something that produces all the hashes you need, put them into Chef, and have that populate the various databases. Alternately, you could just use LDAP, which is designed to handle these kinds of things.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.