Follow Techotopia on Twitter

On-line Guides
All Guides
eBook Store
iOS / Android
Linux for Beginners
Office Productivity
Linux Installation
Linux Security
Linux Utilities
Linux Virtualization
Linux Kernel
System/Network Admin
Scripting Languages
Development Tools
Web Development
GUI Toolkits/Desktop
Mail Systems
Eclipse Documentation

How To Guides
General System Admin
Linux Security
Linux Filesystems
Web Servers
Graphics & Desktop
PC Hardware
Problem Solutions
Privacy Policy




Samba HowTo Guide
Prev Home Next


Before Samba can access the LDAP server, you need to store the LDAP admin password in the Samba-3 secrets.tdb database by:


smbpasswd -w 

Configuring Samba

The following parameters are available in smb.conf only if your version of Samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found. The best method to verify that Samba was built with LDAP support is:

root#  smbd -b | grep LDAP

If the build of the smbd command you are using does not produce output that includes HAVE_LDAP_H it is necessary to discover why the LDAP headers and libraries were not found during compilation.

LDAP-related smb.conf options include these:

passdb backend = ldapsam:url
ldap admin dn
ldap delete dn
ldap filter
ldap group suffix
ldap idmap suffix
ldap machine suffix
ldap passwd sync
ldap ssl
ldap suffix
ldap user suffix
ldap replication sleep
ldap timeout
ldap page size

These are described in the smb.conf man page and so are not repeated here. However, an example for use with an LDAP directory is shown in the Configuration with LDAP.

Example10.2.Configuration with LDAP

security = user
encrypt passwords = yes
netbios name = MORIA
workgroup = NOLDOR
# LDAP related parameters:
# Define the DN used when binding to the LDAP servers.
# The password for this DN is not stored in smb.conf
# Set it using 'smbpasswd -w secret' to store the
# passphrase in the secrets.tdb file.
# If the "ldap admin dn" value changes, it must be reset.
ldap admin dn = "cn=Manager,dc=quenya,dc=org"
# SSL directory connections can be configured by:
# ('off', 'start tls', or 'on' (default))
ldap ssl = start tls
# syntax: passdb backend = ldapsam:ldap://server-name[:port]
passdb backend = ldapsam:ldap://
# smbpasswd -x delete the entire dn-entry
ldap delete dn = no
# The machine and user suffix are added to the base suffix
# wrote WITHOUT quotes. NULL suffixes by default
ldap user suffix = ou=People
ldap group suffix = ou=Groups
ldap machine suffix = ou=Computers
# Trust UNIX account information in LDAP
# (see the smb.conf man page for details)
# Specify the base DN to use when searching the directory
ldap suffix = dc=quenya,dc=org

Accounts and Groups Management

Because user accounts are managed through the sambaSamAccount ObjectClass, you should modify your existing administration tools to deal with sambaSamAccount attributes.

Machine accounts are managed with the sambaSamAccount ObjectClass, just like user accounts. However, it is up to you to store those accounts in a different tree of your LDAP namespace. You should use “ou=Groups,dc=quenya,dc=org” to store groups and “ou=People,dc=quenya,dc=org” to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/openldap/sldap.conf configuration file).

In Samba-3, the group management system is based on POSIX groups. This means that Samba makes use of the posixGroup ObjectClass. For now, there is no NT-like group system management (global and local groups). Samba-3 knows only about Domain Groups and, unlike MS Windows 2000 and Active Directory, Samba-3 does not support nested groups.

Security and sambaSamAccount

There are two important points to remember when discussing the security of sambaSAMAccount entries in the directory.

  • Never retrieve the SambaLMPassword or SambaNTPassword attribute values over an unencrypted LDAP session.

  • Never allow non-admin users to view the SambaLMPassword or SambaNTPassword attribute values.

These password hashes are clear-text equivalents and can be used to impersonate the user without deriving the original clear-text strings. For more information on the details of LM/NT password hashes, refer to the Account Information Database section.

To remedy the first security issue, the ldap ssl smb.conf parameter defaults to require an encrypted session ( ldap ssl = on) using the default port of 636 when contacting the directory server. When using an OpenLDAP server, it is possible to use the StartTLS LDAP extended operation in the place of LDAPS. In either case, you are strongly encouraged to use secure communications protocols (so do not set ldap ssl = off).

Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS extended operation. However, the OpenLDAP library still provides support for the older method of securing communication between clients and servers.

The second security precaution is to prevent non-administrative users from harvesting password hashes from the directory. This can be done using the following ACL in slapd.conf:

## allow the "ldap admin dn" access, but deny everyone else
access to attrs=SambaLMPassword,SambaNTPassword
     by dn="cn=Samba Admin,ou=People,dc=quenya,dc=org" write
     by * none

LDAP Special Attributes for sambaSamAccounts

The sambaSamAccount ObjectClass is composed of the attributes shown in next tables: Part A, and Part B.

Table10.3.Attributes in the sambaSamAccount ObjectClass (LDAP), Part A

sambaLMPassword The LanMan password 16-byte hash stored as a character representation of a hexadecimal string.
sambaNTPassword The NT password 16-byte hash stored as a character representation of a hexadecimal string.
sambaPwdLastSet The integer time in seconds since 1970 when the sambaLMPassword and sambaNTPassword attributes were last set.
sambaAcctFlags String of 11 characters surrounded by square brackets [ ] representing account flags such as U (user), W (workstation), X (no password expiration), I (domain trust account), H (home dir required), S (server trust account), and D (disabled).
sambaLogonTime Integer value currently unused.
sambaLogoffTime Integer value currently unused.
sambaKickoffTime Specifies the time (UNIX time format) when the user will be locked down and cannot login any longer. If this attribute is omitted, then the account will never expire. Using this attribute together with shadowExpire of the shadowAccount ObjectClass will enable accounts to expire completely on an exact date.
sambaPwdCanChange Specifies the time (UNIX time format) after which the user is allowed to change his password. If this attribute is not set, the user will be free to change his password whenever he wants.
sambaPwdMustChange Specifies the time (UNIX time format) when the user is forced to change his password. If this value is set to 0, the user will have to change his password at first login. If this attribute is not set, then the password will never expire.
sambaHomeDrive Specifies the drive letter to which to map the UNC path specified by sambaHomePath. The drive letter must be specified in the form “X:” where X is the letter of the drive to map. Refer to the “logon drive” parameter in the smb.conf(5) man page for more information.
sambaLogonScript The sambaLogonScript property specifies the path of the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path is relative to the netlogon share. Refer to the logon script parameter in the smb.conf man page for more information.
sambaProfilePath Specifies a path to the user's profile. This value can be a null string, a local absolute path, or a UNC path. Refer to the logon path parameter in the smb.conf man page for more information.
sambaHomePath The sambaHomePath property specifies the path of the home directory for the user. The string can be null. If sambaHomeDrive is set and specifies a drive letter, sambaHomePath should be a UNC path. The path must be a network UNC path of the form \\server\share\directory. This value can be a null string. Refer to the logon home parameter in the smb.conf man page for more information.

Table10.4.Attributes in the sambaSamAccount ObjectClass (LDAP), Part B

sambaUserWorkstations Here you can give a comma-separated list of machines on which the user is allowed to login. You may observe problems when you try to connect to a Samba domain member. Because domain members are not in this list, the domain controllers will reject them. Where this attribute is omitted, the default implies no restrictions.
sambaSID The security identifier(SID) of the user. The Windows equivalent of UNIX UIDs.
sambaPrimaryGroupSID The security identifier (SID) of the primary group of the user.
sambaDomainName Domain the user is part of.

The majority of these parameters are only used when Samba is acting as a PDC of a domain (refer to Domain Control, for details on how to configure Samba as a PDC). The following four attributes are only stored with the sambaSamAccount entry if the values are non-default values:

  • sambaHomePath

  • sambaLogonScript

  • sambaProfilePath

  • sambaHomeDrive

These attributes are only stored with the sambaSamAccount entry if the values are non-default values. For example, assume MORIA has now been configured as a PDC and that logon home = \\%L\%u was defined in its smb.conf file. When a user named “becky” logs on to the domain, the logon home string is expanded to \\MORIA\becky. If the smbHome attribute exists in the entry “uid=becky,ou=People,dc=samba,dc=org”, this value is used. However, if this attribute does not exist, then the value of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is something other than the default (e.g., \\MOBY\becky).

Example LDIF Entries for a sambaSamAccount

The following is a working LDIF that demonstrates the use of the SambaSamAccount ObjectClass:

dn: uid=guest2, ou=People,dc=quenya,dc=org
sambaLMPassword: 878D8014606CDA29677A44EFA1353FC7
sambaPwdMustChange: 2147483647
sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-513
sambaNTPassword: 552902031BEDE9EFAAD3B435B51404EE
sambaPwdLastSet: 1010179124
sambaLogonTime: 0
objectClass: sambaSamAccount
uid: guest2
sambaKickoffTime: 2147483647
sambaAcctFlags: [UX         ]
sambaLogoffTime: 2147483647
sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5006
sambaPwdCanChange: 0

The following is an LDIF entry for using both the sambaSamAccount and posixAccount ObjectClasses:

dn: uid=gcarter, ou=People,dc=quenya,dc=org
sambaLogonTime: 0
displayName: Gerald Carter
sambaLMPassword: 552902031BEDE9EFAAD3B435B51404EE
sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-1201
objectClass: posixAccount
objectClass: sambaSamAccount
sambaAcctFlags: [UX         ]
userPassword: {crypt}BpM2ej8Rkzogo
uid: gcarter
uidNumber: 9000
cn: Gerald Carter
loginShell: /bin/bash
logoffTime: 2147483647
gidNumber: 100
sambaKickoffTime: 2147483647
sambaPwdLastSet: 1010179230
sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5004
homeDirectory: /home/moria/gcarter
sambaPwdCanChange: 0
sambaPwdMustChange: 2147483647
sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7

Password Synchronization

Samba-3 and later can update the non-Samba (LDAP) password stored with an account. When using pam_ldap, this allows changing both UNIX and Windows passwords at once.

The ldap passwd sync options can have the values shown in Possible ldap passwd sync Values.

Table10.5.Possible ldap passwd sync Values

Value Description

When the user changes his password, update SambaNTPassword, SambaLMPassword, and the password fields.


Only update SambaNTPassword and SambaLMPassword.


Only update the LDAP password and let the LDAP server worry about the other fields. This option is only available on some LDAP servers and only when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD.

More information can be found in the smb.conf man page.

Using OpenLDAP Overlay for Password Syncronization

Howard Chu has written a special overlay called smbk5pwd . This tool modifies the SambaNTPassword, SambaLMPassword and Heimdal hashes in an OpenLDAP entry when an LDAP_EXOP_X_MODIFY_PASSWD operation is performed.

The overlay is shipped with OpenLDAP-2.3 and can be found in the contrib/slapd-modules/smbk5pwd subdirectory. This module can also be used with OpenLDAP-2.2.

Samba HowTo Guide
Prev Home Next

  Published under the terms fo the GNU General Public License Design by Interspire