Samba/LDAP password synchronization

From: David Jansen (jansen_at_strw.leidenuniv.nl)
Date: 09/08/04

  • Next message: Matthew Saltzman: "Re: tpb/xosd stopped working" 
    Date: Wed, 8 Sep 2004 15:39:58 +0200
To: fedora-list@redhat.com

    We have a setup here with a LDAP server (FC1) which also runs samba.
    Usernames, passwords (and more) are stored in LDAP, and with samba, this
    machine can also act as PDC for the windows machines in the network.

    A problem with such a setup is to keep passwords synchronized between
    unix and windows. We had a working setup to change passwords through
    samba so changing a password from windows, or from Linux with smbpasswd
    changed the unix passwrod, LM-hash and NT-hash in the LDAP database.

    Samba with LDAP as password backend seems to change only the windows
    password hashes, so for changing the unix password, we had a script
    which was called through the 'passwd program' and 'passwd chat' option
    in smb.conf . A bit of a hack, but it worked.

    ... until this setup was moved to a new machine on which FC2 was
    installed. Now the passwd program script is never called any more, so
    unix passwords are no longer being changed.
    To find out what went wrong, we upgraded the FC1 machine to the latest
    samba version (3.0.6-2.FC1) and now it exhibits the same behaviour: no
    password script or program is executed when a user changes his password.

    Does anyone know if something related to this behaviour was changed in
    the latest samba release? The release notes mention nothing that looks
    related.

    Or: does anyone know of another good way to make it possible to change
    all passwords of a user at once so a user will always have only one
    password?

    Relevant parts of the smb.conf file:

    [global]

       workgroup = STRW
       server string = noordzee
       netbios name = noordzee

    passdb backend = ldapsam:ldap://noordzee.our.domain
    ldap admin dn = "uid=admin,ou=administrative,dc=our,dc=domain"
    ldap ssl = no
    ldap suffix = dc=our,dc=domain"

    hosts allow = xxx.yyy.zzz.aaa

    security = user
      encrypt passwords = yes
      smb passwd file = /etc/samba/smbpasswd

    unix password sync = yes
    passwd program = /etc/samba/script %u
    passwd chat debug = yes
    passwd chat = "*New*UNIX*password*" %n\\n "*UNIX*password* %n\\n
    "*succesfully*"

       local master = yes
       os level = 50
       domain master = yes
       preferred master = yes
       domain logons = yes

    [homes]
       comment = Home Directories
       browseable = no
       writable = yes

    David Jansen 

    -- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: Matthew Saltzman: "Re: tpb/xosd stopped working"

    Relevant Pages

    • Re: LDAP madness! [u]
      ... I have gotten Samba to work with LDAP before; however, I don't currently have it setup as I'm re-structuring my LAN servers at the moment. ... Of interest in the LDAP entries is that Samba has it's own schema of attributes for which it looks for to authenticate and they are not the same used for POSIX authenticates typically used for PAM & NSS authentication. ...
      (Debian-User)
    • samba + ldap requires bind ?
      ... I am working to have a small setup in which I want user to be ... authenticated with Linux server and have printer shared among ... Now I want to know in order to LDAP and SAMBA ...
      (alt.linux)
    • can not log into a windows machine connected to a domain managed by samba/ldap
      ... by samba to create the entry in ldap when a machine joins the domain ... I have changed "smb.conf" so it calls a personal script instead of ... Once the this problem has been solved, I could not log into the windows ...
      (Debian-User)
    • URGENT: Samba Wont Substitute %u In "Logon *" When LDAP Is Used
      ... Part of that involved updating Samba to use that same directory ... I traced this to the "logon path" configuration item. ... within the LDAP directory; I just want to use the default generated one. ... in this server for every user accessing the server. ...
      (Debian-User)
    • [opensuse] Samba PDC + LDAP : NT_STATUS_LOGON_FAILURE
      ... I'm setting up Samba PDC + openLDAP. ... logon script = logon.bat ... # performance optimization all users stored in ldap ...
      (SuSE)