Samba Administration Guide - Using OpenLDAP Overlay for Password Syncronization

Configuring Samba

The following parameters are available in smb.conf only if your version of Samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found. The best method to verify that Samba was built with LDAP support is:

root#  smbd -b | grep LDAP
   HAVE_LDAP_H
   HAVE_LDAP
   HAVE_LDAP_DOMAIN2HOSTLIST
   HAVE_LDAP_INIT
   HAVE_LDAP_INITIALIZE
   HAVE_LDAP_SET_REBIND_PROC
   HAVE_LIBLDAP
   LDAP_SET_REBIND_PROC_ARGS

If the build of the smbd command you are using does not produce output that includes HAVE_LDAP_H it is necessary to discover why the LDAP headers and libraries were not found during compilation.

LDAP-related smb.conf options include these:

passdb backend = ldapsam:url

ldap admin dn

ldap delete dn

ldap filter

ldap group suffix

ldap idmap suffix

ldap machine suffix

ldap passwd sync

ldap ssl

ldap suffix

ldap user suffix

ldap replication sleep

ldap timeout

ldap page size

These are described in the smb.conf man page and so are not repeated here. However, an example for use with an LDAP directory is shown in the Configuration with LDAP.

Example10.2.Configuration with LDAP

[global]

security = user

encrypt passwords = yes

netbios name = MORIA

workgroup = NOLDOR

# LDAP related parameters:

# Define the DN used when binding to the LDAP servers.

# The password for this DN is not stored in smb.conf

# Set it using 'smbpasswd -w secret' to store the

# passphrase in the secrets.tdb file.

# If the "ldap admin dn" value changes, it must be reset.

ldap admin dn = "cn=Manager,dc=quenya,dc=org"

# SSL directory connections can be configured by:

# ('off', 'start tls', or 'on' (default))

ldap ssl = start tls

# syntax: passdb backend = ldapsam:ldap://server-name[:port]

passdb backend = ldapsam:ldap://frodo.quenya.org

# smbpasswd -x delete the entire dn-entry

ldap delete dn = no

# The machine and user suffix are added to the base suffix

# wrote WITHOUT quotes. NULL suffixes by default

ldap user suffix = ou=People

ldap group suffix = ou=Groups

ldap machine suffix = ou=Computers

# Trust UNIX account information in LDAP

# (see the smb.conf man page for details)

# Specify the base DN to use when searching the directory

ldap suffix = dc=quenya,dc=org

Accounts and Groups Management

Because user accounts are managed through the sambaSamAccount ObjectClass, you should modify your existing administration tools to deal with sambaSamAccount attributes.

Machine accounts are managed with the sambaSamAccount ObjectClass, just like user accounts. However, it is up to you to store those accounts in a different tree of your LDAP namespace. You should use “ou=Groups,dc=quenya,dc=org” to store groups and “ou=People,dc=quenya,dc=org” to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/openldap/sldap.conf configuration file).

In Samba-3, the group management system is based on POSIX groups. This means that Samba makes use of the posixGroup ObjectClass. For now, there is no NT-like group system management (global and local groups). Samba-3 knows only about Domain Groups and, unlike MS Windows 2000 and Active Directory, Samba-3 does not support nested groups.

Security and sambaSamAccount

There are two important points to remember when discussing the security of sambaSAMAccount entries in the directory.

Never retrieve the SambaLMPassword or SambaNTPassword attribute values over an unencrypted LDAP session.
Never allow non-admin users to view the SambaLMPassword or SambaNTPassword attribute values.

These password hashes are clear-text equivalents and can be used to impersonate the user without deriving the original clear-text strings. For more information on the details of LM/NT password hashes, refer to the Account Information Database section.

To remedy the first security issue, the ldap ssl smb.conf parameter defaults to require an encrypted session ( ldap ssl = on) using the default port of 636 when contacting the directory server. When using an OpenLDAP server, it is possible to use the StartTLS LDAP extended operation in the place of LDAPS. In either case, you are strongly encouraged to use secure communications protocols (so do not set ldap ssl = off).

Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS extended operation. However, the OpenLDAP library still provides support for the older method of securing communication between clients and servers.

The second security precaution is to prevent non-administrative users from harvesting password hashes from the directory. This can be done using the following ACL in slapd.conf:

## allow the "ldap admin dn" access, but deny everyone else
access to attrs=SambaLMPassword,SambaNTPassword
     by dn="cn=Samba Admin,ou=People,dc=quenya,dc=org" write
     by * none

LDAP Special Attributes for sambaSamAccounts

The sambaSamAccount ObjectClass is composed of the attributes shown in next tables: Part A, and Part B.

Table10.3.Attributes in the sambaSamAccount ObjectClass (LDAP), Part A

`sambaLMPassword`	The LanMan password 16-byte hash stored as a character representation of a hexadecimal string.
`sambaNTPassword`	The NT password 16-byte hash stored as a character representation of a hexadecimal string.
`sambaPwdLastSet`	The integer time in seconds since 1970 when the `sambaLMPassword` and `sambaNTPassword` attributes were last set.
`sambaAcctFlags`	String of 11 characters surrounded by square brackets [ ] representing account flags such as U (user), W (workstation), X (no password expiration), I (domain trust account), H (home dir required), S (server trust account), and D (disabled).
`sambaLogonTime`	Integer value currently unused.
`sambaLogoffTime`	Integer value currently unused.
`sambaKickoffTime`	Specifies the time (UNIX time format) when the user will be locked down and cannot login any longer. If this attribute is omitted, then the account will never expire. Using this attribute together with shadowExpire of the shadowAccount ObjectClass will enable accounts to expire completely on an exact date.
`sambaPwdCanChange`	Specifies the time (UNIX time format) after which the user is allowed to change his password. If this attribute is not set, the user will be free to change his password whenever he wants.
`sambaPwdMustChange`	Specifies the time (UNIX time format) when the user is forced to change his password. If this value is set to 0, the user will have to change his password at first login. If this attribute is not set, then the password will never expire.
`sambaHomeDrive`	Specifies the drive letter to which to map the UNC path specified by sambaHomePath. The drive letter must be specified in the form “X:” where X is the letter of the drive to map. Refer to the “logon drive” parameter in the smb.conf(5) man page for more information.
`sambaLogonScript`	The sambaLogonScript property specifies the path of the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path is relative to the netlogon share. Refer to the logon script parameter in the `smb.conf` man page for more information.
`sambaProfilePath`	Specifies a path to the user's profile. This value can be a null string, a local absolute path, or a UNC path. Refer to the logon path parameter in the `smb.conf` man page for more information.
`sambaHomePath`	The sambaHomePath property specifies the path of the home directory for the user. The string can be null. If sambaHomeDrive is set and specifies a drive letter, sambaHomePath should be a UNC path. The path must be a network UNC path of the form `\\server\share\directory`. This value can be a null string. Refer to the logon home parameter in the `smb.conf` man page for more information.

Table10.4.Attributes in the sambaSamAccount ObjectClass (LDAP), Part B

`sambaUserWorkstations`	Here you can give a comma-separated list of machines on which the user is allowed to login. You may observe problems when you try to connect to a Samba domain member. Because domain members are not in this list, the domain controllers will reject them. Where this attribute is omitted, the default implies no restrictions.
`sambaSID`	The security identifier(SID) of the user. The Windows equivalent of UNIX UIDs.
`sambaPrimaryGroupSID`	The security identifier (SID) of the primary group of the user.
`sambaDomainName`	Domain the user is part of.

The majority of these parameters are only used when Samba is acting as a PDC of a domain (refer to Domain Control, for details on how to configure Samba as a PDC). The following four attributes are only stored with the sambaSamAccount entry if the values are non-default values:

sambaHomePath
sambaLogonScript
sambaProfilePath
sambaHomeDrive

These attributes are only stored with the sambaSamAccount entry if the values are non-default values. For example, assume MORIA has now been configured as a PDC and that logon home = \\%L\%u was defined in its smb.conf file. When a user named “becky” logs on to the domain, the logon home string is expanded to \\MORIA\becky. If the smbHome attribute exists in the entry “uid=becky,ou=People,dc=samba,dc=org”, this value is used. However, if this attribute does not exist, then the value of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is something other than the default (e.g., \\MOBY\becky).

Example LDIF Entries for a sambaSamAccount

The following is a working LDIF that demonstrates the use of the SambaSamAccount ObjectClass:

dn: uid=guest2, ou=People,dc=quenya,dc=org
sambaLMPassword: 878D8014606CDA29677A44EFA1353FC7
sambaPwdMustChange: 2147483647
sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-513
sambaNTPassword: 552902031BEDE9EFAAD3B435B51404EE
sambaPwdLastSet: 1010179124
sambaLogonTime: 0
objectClass: sambaSamAccount
uid: guest2
sambaKickoffTime: 2147483647
sambaAcctFlags: [UX         ]
sambaLogoffTime: 2147483647
sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5006
sambaPwdCanChange: 0

The following is an LDIF entry for using both the sambaSamAccount and posixAccount ObjectClasses:

dn: uid=gcarter, ou=People,dc=quenya,dc=org
sambaLogonTime: 0
displayName: Gerald Carter
sambaLMPassword: 552902031BEDE9EFAAD3B435B51404EE
sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-1201
objectClass: posixAccount
objectClass: sambaSamAccount
sambaAcctFlags: [UX         ]
userPassword: {crypt}BpM2ej8Rkzogo
uid: gcarter
uidNumber: 9000
cn: Gerald Carter
loginShell: /bin/bash
logoffTime: 2147483647
gidNumber: 100
sambaKickoffTime: 2147483647
sambaPwdLastSet: 1010179230
sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5004
homeDirectory: /home/moria/gcarter
sambaPwdCanChange: 0
sambaPwdMustChange: 2147483647
sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7

Password Synchronization

Samba-3 and later can update the non-Samba (LDAP) password stored with an account. When using pam_ldap, this allows changing both UNIX and Windows passwords at once.

The ldap passwd sync options can have the values shown in Possible ldap passwd sync Values.

Table10.5.Possible ldap passwd sync Values

Value	Description
yes	When the user changes his password, update `SambaNTPassword`, `SambaLMPassword`, and the `password` fields.
no	Only update `SambaNTPassword` and `SambaLMPassword`.
only	Only update the LDAP password and let the LDAP server worry about the other fields. This option is only available on some LDAP servers and only when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD.

More information can be found in the smb.conf man page.

Using OpenLDAP Overlay for Password Syncronization

Howard Chu has written a special overlay called smbk5pwd . This tool modifies the SambaNTPassword, SambaLMPassword and Heimdal hashes in an OpenLDAP entry when an LDAP_EXOP_X_MODIFY_PASSWD operation is performed.

The overlay is shipped with OpenLDAP-2.3 and can be found in the contrib/slapd-modules/smbk5pwd subdirectory. This module can also be used with OpenLDAP-2.2.

Samba HowTo Guide
Prev	Home	Next