3

I am trying to set up a Samba server to use an LDAP server for authentication only, but pull all account information (user ID etc.) from SSSD, PAM etc. Basically, the server should act as a standalone server except that the user names and passwords will be checked against LDAP.

The LDAP server only provides the posixAccount and InetOrgPerson object classes, and it is not under my control; I cannot change it.

There is a lot of information out on the Internet about making Samba work with LDAP, but invariably it involves modifying the LDAP schema. That is not an option in our situation. Nor should it be necessary, since I only want to authenticate the users against the user name and password.

Incidentally, I know that Samba does not allow authenticating with an anonymous bind (because the passwords are transmitted hashed). As far as I can tell, that's a separate issue addressed by providing an LDAP admin DN.

The system is already set up to authenticate local logins, SSH etc. via SSSD to the same LDAP server. This works and is well-tested.

Software: RedHat 7.3, Samba 4.4.4, LDAP server is Oracle LDAP (probably based on OpenLDAP, but it is outside my control).

I am looking for instructions on how to accomplish this.

  • Hi Kevin, I've edited your question to remove the request for documentation. Your question had been nominated for closure (requests for off-site resources are off-topic). Your question is a good one and I thought it would be a shame for it to be closed for that reason. – Anthony Geoghegan Jul 17 '17 at 8:40
  • Thanks for the edit, @AnthonyGeoghegan . Things like that are the reason I only turn to stackexchange as a last resort nowadays. But your edit is appreciated! – Kevin Keane Aug 21 '17 at 2:39
0

The answer appears that it cannot be done, at least not without turning password hashing off and severely compromising security.

The problem is basically the same that first led to the creation of the smbpasswd file and utility: the Samba server never sees the plaintext password. The password is always hashed. The hashing algorithm has changed over the years. The password stored in the ordinary LDAP schema is also hashed, but using a different algorithm.

The only way to solve this is by either modifying the LDAP schema (as many sites suggest), use smbpasswd, or use Kerberos for authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.