| Rev | Author | # | Line |
|---|---|---|---|
| 8 | DanielLawson | 1 | !!How to get [Samba] 3 working nicely with a [LDAP] backend. |
| 1 | DanielLawson | 2 | |
| 5 | CraigBox | 3 | Samba 3 allows samba accounts to not have corresponding unix accounts. This is the first time a Samba has allowed this. However, I've not set it up so I won't go into that. |
| 1 | DanielLawson | 4 | |
| 8 | DanielLawson | 5 | So this will - discuss setting up Samba 3 + LDAP in an environment where you already have LDAP handling your unix accounts. See [LDAPNotes] for information on that. |
| 9 | DanielLawson | 6 | |
| 7 | ! LDAP Schema | ||
| 8 | |||
| 9 | Get the samba.schema file from your samba distribution, and put this in /etc/ldap/schema, or wherever your distribution puts the LDAP schema files. Edit /etc/ldap/slapd.conf and add in a schema line pointing at this file. | ||
| 10 | |||
| 11 | Note: The debian package seems to have a samba.schema file which is old and out of date, and a samba.schema.gz file which is actually the correct one. ungzip this and put it in /etc/ldap/schema. | ||
| 12 | |||
| 13 | You'll also want to check that you have the newest schema every time you upgrade samba. The schema can change quite a bit, and some features won't work if you don't have the right schema installed. | ||
| 1 | DanielLawson | 14 | |
| 8 | DanielLawson | 15 | ! smb.conf modifications |
| 16 | |||
| 17 | There are a few ldap-specific smb.conf options you can set. I'd recommend reading the smb.conf manpage for the details on the options. As a quick start, here are the options I have set: | ||
| 18 | |||
| 19 | <verbatim> | ||
| 20 | ldap suffix=dc=your,dc=domain,dc=com | ||
| 21 | ldap user suffix=ou=SMBUsers | ||
| 22 | ldap machine suffix=ou=SMBMachines | ||
| 23 | ldap admin dn="cn=admin,ou=People,dc=your,dc=domain,dc=com" | ||
| 24 | ldap ssl = no | ||
| 25 | |||
| 26 | ldap passwd sync = yes | ||
| 27 | </verbatim> | ||
| 28 | |||
| 29 | The user and machine suffixes are entirely up to you. Just make sure you remember this, and update any other Samba / LDAP scripts you might have to use these suffixes too (such as the idealx scripts mentioned below) | ||
| 30 | |||
| 31 | If you change the ldap admin dn (or set it for the first time) you need to run smbpasswd and provide it with the ldap bind password: | ||
| 32 | |||
| 33 | <verbatim> | ||
| 34 | smbpasswd -w LDAPBINDPW | ||
| 35 | </verbatim> | ||
| 36 | |||
| 37 | The 'ldap passwd sync' parameter here is fairly important. Assuming your accounts are all stored in LDAP, this will let you easily change passwords via the windows change passwords mechanism (which is actually via samba). More on this later. | ||
| 38 | |||
| 39 | |||
| 40 | ! LDAP Password Sync | ||
| 41 | |||
| 42 | The default setting for this is 'no', which means 'Update the NT and LM passwords in LDAP, and update the last set time'. This *will* cause a lot of grief if you are trying to use another mechanism to set the password, such as a custom script. It can also be set to 'only' which means it will only update the LDAP password (which is the userPassword field, ie the password that unix services will use via pam_ldap). Setting it to 'yes' means it will attempt to update all three passwords and update the last set time. This is almost definitely what you want. | ||
| 14 | DanielLawson | 43 | |
| 44 | ! unix passwd sync | ||
| 45 | |||
| 46 | This is a slightly misleading name for this directive. It should really be 'external passwd sync'. The 'passwd program' and 'passwd sync' directives are _only_ called if this parameter is set to yes. | ||
| 47 | |||
| 48 | It is probably ok to set 'unix passwd sync = no' and 'ldap password sync = yes', and be fairly happy that your passwords are being updated correctly. However, I have found that this sets passwords that zimbra, for example, cannot deal with. If this is the case, or you want to do something special with your password update such as set other values as well, do the following: | ||
| 49 | |||
| 50 | <verbatim> | ||
| 51 | ldap password sync = No | ||
| 52 | unix passwd sync = Yes | ||
| 53 | passwd program = /path/to/program %u | ||
| 54 | passwd chat = *chat*script* | ||
| 15 | JeffDavis | 55 | </verbatim> |
| 56 | |||
| 57 | Additionally, you may need to tweak your slapd.conf acls to support password sync. The DSA needs access to the root DSE in order to determine the server's capabilities. If you are using the Idealx scripts, this should do the trick: | ||
| 58 | |||
| 59 | <verbatim> | ||
| 60 | access to * | ||
| 61 | by dn="cn=samba,ou=dsa,dc=example,dc=com" read | ||
| 62 | by dn="cn=smbldap-tools,ou=dsa,dc=example,dc=com" read | ||
| 63 | by * none | ||
| 14 | DanielLawson | 64 | </verbatim> |
| 65 | |||
| 66 | Obviously, the passwd program and passwd chat parameters need to be tailored to your script. I use the smbldap-passwd program from IdealX, and have it set to only update the 'userPassword' attribute in LDAP, not the NT/LM hashes (as samba will do this anyway): | ||
| 67 | |||
| 68 | <verbatim> | ||
| 69 | ldap passwd sync = No | ||
| 70 | unix password sync = Yes | ||
| 71 | passwd program = /usr/sbin/smbldap-passwd -u %u | ||
| 72 | passwd chat = *New*password* %n\n *Retype*new*password* %n\n | ||
| 73 | </verbatim> | ||
| 74 | |||
| 9 | DanielLawson | 75 | |
| 76 | !IdealX Samba Administration Scripts | ||
| 77 | |||
| 11 | CraigBox | 78 | The [IdealX smbldap-tools|http://samba.idealx.org/index.en.html] are, in my opinion, essential for running an LDAP-aware Samba server. |
| 9 | DanielLawson | 79 | |
| 80 | The smbldap-populate script will add in the "basic" builtin users and groups you need for decent windows interop. | ||
| 81 | |||
| 82 | The other scripts can be specified in smb.conf for things like adding users, adding machines (essential for joining a Windows client to a Samba domain run from LDAP), and so on. | ||
| 83 | |||
| 84 | There is a migrate script as well, which will take an existing smbpasswd file and move the accounts into LDAP for you. | ||
| 8 | DanielLawson | 85 | |
| 10 | DanielLawson | 86 | ---- |
| 5 | CraigBox | 87 | [Debian] users: Samba.org has [Woody] packages for Samba 3; you can get it out of testing/unstable otherwise. |
| 6 | DanielLawson | 88 | |
| 89 | The Samba 3 packages have a set of smbldap-tools - you really should set these up. | ||
| 1 | DanielLawson | 90 | |
| 91 | Now go and read the excellent [LDAP-SMB-2.2/HEAD HOWTO|http://www.unav.es/cti/ldap-smb/ldap-smb-2_2-howto.html]. | ||
| 92 | |||
| 93 | |||
| 10 | DanielLawson | 94 | There is a great howto for Samba 2.2.x and LDAP under Debian Woody at http://homex.subnet.at/~max/ldap/. Much of the content will migrate to other systems or to Samba 3 as well, so it's worth a read |
| 7 | AristotlePagaltzis | 95 | |
| 96 | http://www.idealx.org/prj/samba/smbldap-howto.en.html | ||
| 12 | DavidHarrison | 97 | |
| 98 | For SuSE or OpenSUSE users checkout the [Samba PDC/OpenLDAP howto|http://www.stress-free.co.nz/content/view/126/2/] as this takes advantage of the Yast administration tool to do a fair bit of the manual work for you. | ||
| 13 | PerryLorier | 99 | |
| 100 | * [Turn your world LDAP-tastic|http://usefulinc.com/edd/blog/contents/2005/09/25-ldap/read] |
lib/blame.php:177: Warning: Invalid argument supplied for foreach()