Hi, The way it works is something like this:
PAM uses either a global configuration file which specifies the module configuration for each service (i.e., httpd, samba, login, xauth, pop, imap, etc...the OLD way), or individual files within a directory - one per service. The directory is usually /etc/pam.d. This is the new and "preferred" (by me, at least! :) ) way of doing PAM configurations. You would use pam_smbpass wherever needed to allow particular services to sync /etc/shadow with samba passwords as needed. See the configuration examples below to get an idea. Also, you would activate the "pam password change" and "unix password sync" options in smb.conf. You would also add a configuration file for the service "samba", such that Samba knows what passwords to sync with its own (thanks to the aforementioned parameters). My setup is as follows: - All PAM service configurations (exception noted below) use pam_stack.so to forward operation to the "passwd" service (i.e., when the "httpd" service requests a password change, the request is actually done using the configuration for the "passwd" service). - Only the "passwd" service configuration has the actual rules for changing passwords (i.e, change it in ldap, samba, shadow, etc.). I use only ldap, not shadow, but I list them both here to illustrate. - The only other module that has password configuration is (you guessed it!) the samba module. Its configuration excludes the config for pam_smbpass, since Samba already does that for us - we just need to cover the areas Samba doesn't cover by itself (i.e., ldap and shadow, for example). Here's an example with three config files (irrelevant areas ommitted for brevety): /etc/pam.d/httpd ====================== auth ... account ... session ... # This next line causes the service config to "include" the # config from the passwd service and execute it as part of its own passwd required /lib/security/pam_stack.so service=passwd ====================== /etc/pam.d/passwd ====================== auth ... account ... session ... # enforce strong passwords password required pam_cracklib.so ..... # change the LDAP password password required pam_ldap.so ... # change the /etc/shadow password password required pam_unix.so ... # change the Samba password password required pam_smbpass.so ... # Add others as needed password ... ====================== /etc/pam.d/samba ====================== auth ... account ... session ... # change the LDAP password password required pam_ldap.so ... # change the /etc/shadow password password required pam_unix.so ... # Add others as needed password required ... # Note the absence of pam_smbpass.so!!! Samba already does this ====================== This causes the following (note that all other PAM services use pam_stack in the same fashion as the first config file, this avoids having to configure password changes all over the place): - When any service executes a password change outside Samba, the samba password will be updated with the new value, along with all the other named services like LDAP, Shadow, etc. This is the case for any and all services which do NOT rely on Samba for password maintenance (like, for example, the /usr/bin/passwd program). - When any service executes a password change THROUGH Samba, all the *other* password repositories will also be kept in sync (thanks to the third PAM configuration file and the smb.conf parameters I mentioned before). This is the case if your Samba box is doing password maitenance, and a Samba client requests a password change going through Samba. I hope this is specific enough to help you find your answer. I would refer you to the PAM Admin documentation for more details on PAM operation (it's quite simple, really), and also to the Samba docs pertaining to PAM operation. If you're going to be messing with stuff like this, you should read as much of both docs as you can - I did and it paid off in the end! Best Diego Rivera Nomadic Solutions "Taking Linux to the Next Level" Cell: (506) 393-0772 E-mail: [EMAIL PROTECTED] On Thu, 2002-10-24 at 20:39, fred pasteck wrote: > Hi all. > > I've spent the last several days trying to get > pam_smbpass working on my RH62 box with samba-2.2.x > unsuccessfully, and hoped someone could help. > > I've tried versions 2.2.2 and 2.2.6, but I suspect > it's perhaps a misunderstanding of what exactly > pam_smbpass is used for. > > There are a few things I'm trying to do: > > - sync /etc/shadow with /etc/samba/smbpasswd > - sync /etc/samba/smbpasswd with /etc/shadow > > So, if someone uses passwd to change their password it > will automatically also update the samba password. If > a windows user changes their password, it should also > update /etc/shadow. Is this correct? > > There are several examples in the sample/ directory > included with the samba source, but it is unclear > where these files actually go. I'm not terribly > familiar with PAM. > > Can someone forward me their working copies of the PAM > config files that apply to do what I've described > above? > > Even when enabling "debug level = 10" it doesn't > appear like /etc/shadow is being consulted. I've also > tried strace'ing "passwd username" and it never > updates smbpasswd. Same when doing vice-versa. > > I've searched the net and there are mentions of > various smb.conf config settings that are supposed to > work, all of which I've tried to no avail. What are > the known-good smb.conf settings necessary to make > this happen? > > Is it necessary for the samba server to be a domain > controller? Does it work successfully with modern > encrypted passwords? > > Thanks, > Fred > > > __________________________________________________ > Do you Yahoo!? > Y! Web Hosting - Let the expert host your web site > http://webhosting.yahoo.com/ > -- > To unsubscribe from this list go to the following URL and read the > instructions: http://lists.samba.org/mailman/listinfo/samba -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
