mirror of
https://github.com/samba-team/samba.git
synced 2025-01-15 23:24:37 +03:00
1625 lines
38 KiB
HTML
1625 lines
38 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML
|
|
><HEAD
|
|
><TITLE
|
|
>User information database</TITLE
|
|
><META
|
|
NAME="GENERATOR"
|
|
CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK
|
|
REL="HOME"
|
|
TITLE="SAMBA Project Documentation"
|
|
HREF="samba-howto-collection.html"><LINK
|
|
REL="UP"
|
|
TITLE="General installation"
|
|
HREF="introduction.html"><LINK
|
|
REL="PREVIOUS"
|
|
TITLE="Quick Cross Subnet Browsing / Cross Workgroup Browsing guide"
|
|
HREF="browsing-quick.html"><LINK
|
|
REL="NEXT"
|
|
TITLE="Type of installation"
|
|
HREF="type.html"></HEAD
|
|
><BODY
|
|
CLASS="CHAPTER"
|
|
BGCOLOR="#FFFFFF"
|
|
TEXT="#000000"
|
|
LINK="#0000FF"
|
|
VLINK="#840084"
|
|
ALINK="#0000FF"
|
|
><DIV
|
|
CLASS="NAVHEADER"
|
|
><TABLE
|
|
SUMMARY="Header navigation table"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
CELLPADDING="0"
|
|
CELLSPACING="0"
|
|
><TR
|
|
><TH
|
|
COLSPAN="3"
|
|
ALIGN="center"
|
|
>SAMBA Project Documentation</TH
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="10%"
|
|
ALIGN="left"
|
|
VALIGN="bottom"
|
|
><A
|
|
HREF="browsing-quick.html"
|
|
ACCESSKEY="P"
|
|
>Prev</A
|
|
></TD
|
|
><TD
|
|
WIDTH="80%"
|
|
ALIGN="center"
|
|
VALIGN="bottom"
|
|
></TD
|
|
><TD
|
|
WIDTH="10%"
|
|
ALIGN="right"
|
|
VALIGN="bottom"
|
|
><A
|
|
HREF="type.html"
|
|
ACCESSKEY="N"
|
|
>Next</A
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
><HR
|
|
ALIGN="LEFT"
|
|
WIDTH="100%"></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><H1
|
|
><A
|
|
NAME="PASSDB"
|
|
></A
|
|
>Chapter 3. User information database</H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN335"
|
|
>3.1. Introduction</A
|
|
></H1
|
|
><P
|
|
>Old windows clients send plain text passwords over the wire.
|
|
Samba can check these passwords by crypting them and comparing them
|
|
to the hash stored in the unix user database.
|
|
</P
|
|
><P
|
|
> Newer windows clients send encrypted passwords (so-called
|
|
Lanman and NT hashes) over
|
|
the wire, instead of plain text passwords. The newest clients
|
|
will only send encrypted passwords and refuse to send plain text
|
|
passwords, unless their registry is tweaked.
|
|
</P
|
|
><P
|
|
>These passwords can't be converted to unix style encrypted
|
|
passwords. Because of that you can't use the standard unix
|
|
user database, and you have to store the Lanman and NT hashes
|
|
somewhere else. </P
|
|
><P
|
|
>Next to a differently encrypted passwords,
|
|
windows also stores certain data for each user
|
|
that is not stored in a unix user database, e.g.
|
|
workstations the user may logon from, the location where his/her
|
|
profile is stored, etc.
|
|
Samba retrieves and stores this information using a "passdb backend".
|
|
Commonly
|
|
available backends are LDAP, plain text file, MySQL and nisplus.
|
|
For more information, see the documentation about the
|
|
<B
|
|
CLASS="COMMAND"
|
|
>passdb backend = </B
|
|
> parameter.
|
|
</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN342"
|
|
>3.2. Important Notes About Security</A
|
|
></H1
|
|
><P
|
|
>The unix and SMB password encryption techniques seem similar
|
|
on the surface. This similarity is, however, only skin deep. The unix
|
|
scheme typically sends clear text passwords over the network when
|
|
logging in. This is bad. The SMB encryption scheme never sends the
|
|
cleartext password over the network but it does store the 16 byte
|
|
hashed values on disk. This is also bad. Why? Because the 16 byte hashed
|
|
values are a "password equivalent". You cannot derive the user's
|
|
password from them, but they could potentially be used in a modified
|
|
client to gain access to a server. This would require considerable
|
|
technical knowledge on behalf of the attacker but is perfectly possible.
|
|
You should thus treat the data stored in whatever
|
|
passdb backend you use (smbpasswd file, ldap, mysql) as though it contained the
|
|
cleartext passwords of all your users. Its contents must be kept
|
|
secret, and the file should be protected accordingly.</P
|
|
><P
|
|
>Ideally we would like a password scheme which neither requires
|
|
plain text passwords on the net or on disk. Unfortunately this
|
|
is not available as Samba is stuck with being compatible with
|
|
other SMB systems (WinNT, WfWg, Win95 etc). </P
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="25"
|
|
ALIGN="CENTER"
|
|
VALIGN="TOP"
|
|
><IMG
|
|
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif"
|
|
HSPACE="5"
|
|
ALT="Warning"></TD
|
|
><TD
|
|
ALIGN="LEFT"
|
|
VALIGN="TOP"
|
|
><P
|
|
>Note that Windows NT 4.0 Service pack 3 changed the
|
|
default for permissible authentication so that plaintext
|
|
passwords are <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>never</I
|
|
></SPAN
|
|
> sent over the wire.
|
|
The solution to this is either to switch to encrypted passwords
|
|
with Samba or edit the Windows NT registry to re-enable plaintext
|
|
passwords. See the document WinNT.txt for details on how to do
|
|
this.</P
|
|
><P
|
|
>Other Microsoft operating systems which also exhibit
|
|
this behavior includes</P
|
|
><P
|
|
> These versions of MS Windows do not support full domain
|
|
security protocols, although they may log onto a domain environment.
|
|
Of these Only MS Windows XP Home does NOT support domain logons.</P
|
|
><P
|
|
></P
|
|
><TABLE
|
|
BORDER="0"
|
|
><TBODY
|
|
><TR
|
|
><TD
|
|
>MS DOS Network client 3.0 with
|
|
the basic network redirector installed</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Windows 95 with the network redirector
|
|
update installed</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Windows 98 [se]</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Windows Me</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Windows XP Home</TD
|
|
></TR
|
|
></TBODY
|
|
></TABLE
|
|
><P
|
|
></P
|
|
><P
|
|
> The following versions of MS Windows fully support domain
|
|
security protocols.</P
|
|
><P
|
|
></P
|
|
><TABLE
|
|
BORDER="0"
|
|
><TBODY
|
|
><TR
|
|
><TD
|
|
>Windows NT 3.5x</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Windows NT 4.0</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Windows 2000 Professional</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Windows 200x Server/Advanced Server</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Windows XP Professional</TD
|
|
></TR
|
|
></TBODY
|
|
></TABLE
|
|
><P
|
|
></P
|
|
><P
|
|
><SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Note :</I
|
|
></SPAN
|
|
>All current release of
|
|
Microsoft SMB/CIFS clients support authentication via the
|
|
SMB Challenge/Response mechanism described here. Enabling
|
|
clear text authentication does not disable the ability
|
|
of the client to participate in encrypted authentication.</P
|
|
><P
|
|
>MS Windows clients will cache the encrypted password alone.
|
|
Even when plain text passwords are re-enabled, through the appropriate
|
|
registry change, the plain text password is NEVER cached. This means that
|
|
in the event that a network connections should become disconnected (broken)
|
|
only the cached (encrypted) password will be sent to the resource server
|
|
to affect a auto-reconnect. If the resource server does not support encrypted
|
|
passwords the auto-reconnect will fail. <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>USE OF ENCRYPTED PASSWORDS
|
|
IS STRONGLY ADVISED.</I
|
|
></SPAN
|
|
></P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN368"
|
|
>3.2.1. Advantages of SMB Encryption</A
|
|
></H2
|
|
><P
|
|
></P
|
|
><TABLE
|
|
BORDER="0"
|
|
><TBODY
|
|
><TR
|
|
><TD
|
|
>Plain text passwords are not passed across
|
|
the network. Someone using a network sniffer cannot just
|
|
record passwords going to the SMB server.</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>WinNT doesn't like talking to a server
|
|
that SM not support encrypted passwords. It will refuse
|
|
to browse the server if the server is also in user level
|
|
security mode. It will insist on prompting the user for the
|
|
password on each connection, which is very annoying. The
|
|
only things you can do to stop this is to use SMB encryption.
|
|
</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Encrypted password support allows automatic share
|
|
(resource) reconnects.</TD
|
|
></TR
|
|
></TBODY
|
|
></TABLE
|
|
><P
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN374"
|
|
>3.2.2. Advantages of non-encrypted passwords</A
|
|
></H2
|
|
><P
|
|
></P
|
|
><TABLE
|
|
BORDER="0"
|
|
><TBODY
|
|
><TR
|
|
><TD
|
|
>Plain text passwords are not kept
|
|
on disk, and are NOT cached in memory. </TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Uses same password file as other unix
|
|
services such as login and ftp</TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
>Use of other services (such as telnet and ftp) which
|
|
send plain text passwords over the net, so sending them for SMB
|
|
isn't such a big deal.</TD
|
|
></TR
|
|
></TBODY
|
|
></TABLE
|
|
><P
|
|
></P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN380"
|
|
>3.3. The smbpasswd Command</A
|
|
></H1
|
|
><P
|
|
>The smbpasswd utility is a utility similar to the
|
|
<B
|
|
CLASS="COMMAND"
|
|
>passwd</B
|
|
> or <B
|
|
CLASS="COMMAND"
|
|
>yppasswd</B
|
|
> programs.
|
|
It maintains the two 32 byte password fields in the passdb backend. </P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>smbpasswd</B
|
|
> works in a client-server mode
|
|
where it contacts the local smbd to change the user's password on its
|
|
behalf. This has enormous benefits - as follows.</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>smbpasswd</B
|
|
> has the capability
|
|
to change passwords on Windows NT servers (this only works when
|
|
the request is sent to the NT Primary Domain Controller if you
|
|
are changing an NT Domain user's password).</P
|
|
><P
|
|
>To run smbpasswd as a normal user just type :</P
|
|
><P
|
|
><SAMP
|
|
CLASS="PROMPT"
|
|
>$ </SAMP
|
|
><KBD
|
|
CLASS="USERINPUT"
|
|
>smbpasswd</KBD
|
|
></P
|
|
><P
|
|
><SAMP
|
|
CLASS="PROMPT"
|
|
>Old SMB password: </SAMP
|
|
><KBD
|
|
CLASS="USERINPUT"
|
|
><type old value here -
|
|
or hit return if there was no old password></KBD
|
|
></P
|
|
><P
|
|
><SAMP
|
|
CLASS="PROMPT"
|
|
>New SMB Password: </SAMP
|
|
><KBD
|
|
CLASS="USERINPUT"
|
|
><type new value>
|
|
</KBD
|
|
></P
|
|
><P
|
|
><SAMP
|
|
CLASS="PROMPT"
|
|
>Repeat New SMB Password: </SAMP
|
|
><KBD
|
|
CLASS="USERINPUT"
|
|
><re-type new value
|
|
</KBD
|
|
></P
|
|
><P
|
|
>If the old value does not match the current value stored for
|
|
that user, or the two new values do not match each other, then the
|
|
password will not be changed.</P
|
|
><P
|
|
>If invoked by an ordinary user it will only allow the user
|
|
to change his or her own Samba password.</P
|
|
><P
|
|
>If run by the root user smbpasswd may take an optional
|
|
argument, specifying the user name whose SMB password you wish to
|
|
change. Note that when run as root smbpasswd does not prompt for
|
|
or check the old password value, thus allowing root to set passwords
|
|
for users who have forgotten their passwords.</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>smbpasswd</B
|
|
> is designed to work in the same way
|
|
and be familiar to UNIX users who use the <B
|
|
CLASS="COMMAND"
|
|
>passwd</B
|
|
> or
|
|
<B
|
|
CLASS="COMMAND"
|
|
>yppasswd</B
|
|
> commands.</P
|
|
><P
|
|
>For more details on using <B
|
|
CLASS="COMMAND"
|
|
>smbpasswd</B
|
|
> refer
|
|
to the man page which will always be the definitive reference.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN411"
|
|
>3.4. Plain text</A
|
|
></H1
|
|
><P
|
|
>Older versions of samba retrieved user information from the unix user database
|
|
and eventually some other fields from the file <TT
|
|
CLASS="FILENAME"
|
|
>/etc/samba/smbpasswd</TT
|
|
>
|
|
or <TT
|
|
CLASS="FILENAME"
|
|
>/etc/smbpasswd</TT
|
|
>. When password encryption is disabled, no
|
|
data is stored at all.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN416"
|
|
>3.5. TDB</A
|
|
></H1
|
|
><P
|
|
>Samba can also store the user data in a "TDB" (Trivial Database). Using this backend
|
|
doesn't require any additional configuration. This backend is recommended for new installations who
|
|
don't require LDAP.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN419"
|
|
>3.6. LDAP</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN421"
|
|
>3.6.1. Introduction</A
|
|
></H2
|
|
><P
|
|
>This document describes how to use an LDAP directory for storing Samba user
|
|
account information traditionally stored in the smbpasswd(5) file. It is
|
|
assumed that the reader already has a basic understanding of LDAP concepts
|
|
and has a working directory server already installed. For more information
|
|
on LDAP architectures and Directories, please refer to the following sites.</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>OpenLDAP - <A
|
|
HREF="http://www.openldap.org/"
|
|
TARGET="_top"
|
|
>http://www.openldap.org/</A
|
|
></P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>iPlanet Directory Server - <A
|
|
HREF="http://iplanet.netscape.com/directory"
|
|
TARGET="_top"
|
|
>http://iplanet.netscape.com/directory</A
|
|
></P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>Note that <A
|
|
HREF="http://www.ora.com/"
|
|
TARGET="_top"
|
|
>O'Reilly Publishing</A
|
|
> is working on
|
|
a guide to LDAP for System Administrators which has a planned release date of
|
|
early summer, 2002.</P
|
|
><P
|
|
>Two additional Samba resources which may prove to be helpful are</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>The <A
|
|
HREF="http://www.unav.es/cti/ldap-smb/ldap-smb-3-howto.html"
|
|
TARGET="_top"
|
|
>Samba-PDC-LDAP-HOWTO</A
|
|
>
|
|
maintained by Ignacio Coupeau.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>The NT migration scripts from <A
|
|
HREF="http://samba.idealx.org/"
|
|
TARGET="_top"
|
|
>IDEALX</A
|
|
> that are
|
|
geared to manage users and group in such a Samba-LDAP Domain Controller configuration.
|
|
</P
|
|
></LI
|
|
></UL
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN441"
|
|
>3.6.2. Introduction</A
|
|
></H2
|
|
><P
|
|
>Traditionally, when configuring <A
|
|
HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
|
|
TARGET="_top"
|
|
>"encrypt
|
|
passwords = yes"</A
|
|
> in Samba's <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
> file, user account
|
|
information such as username, LM/NT password hashes, password change times, and account
|
|
flags have been stored in the <TT
|
|
CLASS="FILENAME"
|
|
>smbpasswd(5)</TT
|
|
> file. There are several
|
|
disadvantages to this approach for sites with very large numbers of users (counted
|
|
in the thousands).</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>The first is that all lookups must be performed sequentially. Given that
|
|
there are approximately two lookups per domain logon (one for a normal
|
|
session connection such as when mapping a network drive or printer), this
|
|
is a performance bottleneck for lareg sites. What is needed is an indexed approach
|
|
such as is used in databases.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>The second problem is that administrators who desired to replicate a
|
|
smbpasswd file to more than one Samba server were left to use external
|
|
tools such as <B
|
|
CLASS="COMMAND"
|
|
>rsync(1)</B
|
|
> and <B
|
|
CLASS="COMMAND"
|
|
>ssh(1)</B
|
|
>
|
|
and wrote custom, in-house scripts.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>And finally, the amount of information which is stored in an
|
|
smbpasswd entry leaves no room for additional attributes such as
|
|
a home directory, password expiration time, or even a Relative
|
|
Identified (RID).</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>As a result of these defeciencies, a more robust means of storing user attributes
|
|
used by smbd was developed. The API which defines access to user accounts
|
|
is commonly referred to as the samdb interface (previously this was called the passdb
|
|
API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support
|
|
for a samdb backend (e.g. <VAR
|
|
CLASS="PARAMETER"
|
|
>--with-ldapsam</VAR
|
|
> or
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>--with-tdbsam</VAR
|
|
>) requires compile time support.</P
|
|
><P
|
|
>When compiling Samba to include the <VAR
|
|
CLASS="PARAMETER"
|
|
>--with-ldapsam</VAR
|
|
> autoconf
|
|
option, smbd (and associated tools) will store and lookup user accounts in
|
|
an LDAP directory. In reality, this is very easy to understand. If you are
|
|
comfortable with using an smbpasswd file, simply replace "smbpasswd" with
|
|
"LDAP directory" in all the documentation.</P
|
|
><P
|
|
>There are a few points to stress about what the <VAR
|
|
CLASS="PARAMETER"
|
|
>--with-ldapsam</VAR
|
|
>
|
|
does not provide. The LDAP support referred to in the this documentation does not
|
|
include:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>A means of retrieving user account information from
|
|
an Windows 2000 Active Directory server.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>A means of replacing /etc/passwd.</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>The second item can be accomplished by using LDAP NSS and PAM modules. LGPL
|
|
versions of these libraries can be obtained from PADL Software
|
|
(<A
|
|
HREF="http://www.padl.com/"
|
|
TARGET="_top"
|
|
>http://www.padl.com/</A
|
|
>). However,
|
|
the details of configuring these packages are beyond the scope of this document.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN470"
|
|
>3.6.3. Supported LDAP Servers</A
|
|
></H2
|
|
><P
|
|
>The LDAP samdb code in 2.2.3 (and later) has been developed and tested
|
|
using the OpenLDAP 2.0 server and client libraries.
|
|
The same code should be able to work with Netscape's Directory Server
|
|
and client SDK. However, due to lack of testing so far, there are bound
|
|
to be compile errors and bugs. These should not be hard to fix.
|
|
If you are so inclined, please be sure to forward all patches to
|
|
<A
|
|
HREF="mailto:samba-patches@samba.org"
|
|
TARGET="_top"
|
|
>samba-patches@samba.org</A
|
|
> and
|
|
<A
|
|
HREF="mailto:jerry@samba.org"
|
|
TARGET="_top"
|
|
>jerry@samba.org</A
|
|
>.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN475"
|
|
>3.6.4. Schema and Relationship to the RFC 2307 posixAccount</A
|
|
></H2
|
|
><P
|
|
>Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>examples/LDAP/samba.schema</TT
|
|
>. The sambaAccount objectclass is given here:</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL
|
|
DESC 'Samba Account'
|
|
MUST ( uid $ rid )
|
|
MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
|
|
logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
|
|
displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
|
|
description $ userWorkstations $ primaryGroupID $ domain ))</PRE
|
|
></P
|
|
><P
|
|
>The samba.schema file has been formatted for OpenLDAP 2.0. The OID's are
|
|
owned by the Samba Team and as such is legal to be openly published.
|
|
If you translate the schema to be used with Netscape DS, please
|
|
submit the modified schema file as a patch to <A
|
|
HREF="mailto:jerry@samba.org"
|
|
TARGET="_top"
|
|
>jerry@samba.org</A
|
|
></P
|
|
><P
|
|
>Just as the smbpasswd file is mean to store information which supplements a
|
|
user's <TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd</TT
|
|
> entry, so is the sambaAccount object
|
|
meant to supplement the UNIX user account information. A sambaAccount is a
|
|
<CODE
|
|
CLASS="CONSTANT"
|
|
>STRUCTURAL</CODE
|
|
> objectclass so it can be stored individually
|
|
in the directory. However, there are several fields (e.g. uid) which overlap
|
|
with the posixAccount objectclass outlined in RFC2307. This is by design.</P
|
|
><P
|
|
>In order to store all user account information (UNIX and Samba) in the directory,
|
|
it is necessary to use the sambaAccount and posixAccount objectclasses in
|
|
combination. However, smbd will still obtain the user's UNIX account
|
|
information via the standard C library calls (e.g. getpwnam(), et. al.).
|
|
This means that the Samba server must also have the LDAP NSS library installed
|
|
and functioning correctly. This division of information makes it possible to
|
|
store all Samba account information in LDAP, but still maintain UNIX account
|
|
information in NIS while the network is transitioning to a full LDAP infrastructure.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN487"
|
|
>3.6.5. Configuring Samba with LDAP</A
|
|
></H2
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN489"
|
|
>3.6.5.1. OpenLDAP configuration</A
|
|
></H3
|
|
><P
|
|
>To include support for the sambaAccount object in an OpenLDAP directory
|
|
server, first copy the samba.schema file to slapd's configuration directory.</P
|
|
><P
|
|
><SAMP
|
|
CLASS="PROMPT"
|
|
>root# </SAMP
|
|
><KBD
|
|
CLASS="USERINPUT"
|
|
>cp samba.schema /etc/openldap/schema/</KBD
|
|
></P
|
|
><P
|
|
>Next, include the <TT
|
|
CLASS="FILENAME"
|
|
>samba.schema</TT
|
|
> file in <TT
|
|
CLASS="FILENAME"
|
|
>slapd.conf</TT
|
|
>.
|
|
The sambaAccount object contains two attributes which depend upon other schema
|
|
files. The 'uid' attribute is defined in <TT
|
|
CLASS="FILENAME"
|
|
>cosine.schema</TT
|
|
> and
|
|
the 'displayName' attribute is defined in the <TT
|
|
CLASS="FILENAME"
|
|
>inetorgperson.schema</TT
|
|
>
|
|
file. Both of these must be included before the <TT
|
|
CLASS="FILENAME"
|
|
>samba.schema</TT
|
|
> file.</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>## /etc/openldap/slapd.conf
|
|
|
|
## schema files (core.schema is required by default)
|
|
include /etc/openldap/schema/core.schema
|
|
|
|
## needed for sambaAccount
|
|
include /etc/openldap/schema/cosine.schema
|
|
include /etc/openldap/schema/inetorgperson.schema
|
|
include /etc/openldap/schema/samba.schema
|
|
|
|
## uncomment this line if you want to support the RFC2307 (NIS) schema
|
|
## include /etc/openldap/schema/nis.schema
|
|
|
|
....</PRE
|
|
></P
|
|
><P
|
|
>It is recommended that you maintain some indices on some of the most usefull attributes,
|
|
like in the following example, to speed up searches made on sambaAccount objectclasses
|
|
(and possibly posixAccount and posixGroup as well).</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
># Indices to maintain
|
|
## required by OpenLDAP 2.0
|
|
index objectclass eq
|
|
|
|
## support pb_getsampwnam()
|
|
index uid pres,eq
|
|
## support pdb_getsambapwrid()
|
|
index rid eq
|
|
|
|
## uncomment these if you are storing posixAccount and
|
|
## posixGroup entries in the directory as well
|
|
##index uidNumber eq
|
|
##index gidNumber eq
|
|
##index cn eq
|
|
##index memberUid eq</PRE
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN506"
|
|
>3.6.5.2. Configuring Samba</A
|
|
></H3
|
|
><P
|
|
>The following parameters are available in smb.conf only with <VAR
|
|
CLASS="PARAMETER"
|
|
>--with-ldapsam</VAR
|
|
>
|
|
was included with compiling Samba.</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
><A
|
|
HREF="smb.conf.5.html#LDAPSSL"
|
|
TARGET="_top"
|
|
>ldap ssl</A
|
|
></P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><A
|
|
HREF="smb.conf.5.html#LDAPSERVER"
|
|
TARGET="_top"
|
|
>ldap server</A
|
|
></P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><A
|
|
HREF="smb.conf.5.html#LDAPADMINDN"
|
|
TARGET="_top"
|
|
>ldap admin dn</A
|
|
></P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><A
|
|
HREF="smb.conf.5.html#LDAPSUFFIX"
|
|
TARGET="_top"
|
|
>ldap suffix</A
|
|
></P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><A
|
|
HREF="smb.conf.5.html#LDAPFILTER"
|
|
TARGET="_top"
|
|
>ldap filter</A
|
|
></P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><A
|
|
HREF="smb.conf.5.html#LDAPPORT"
|
|
TARGET="_top"
|
|
>ldap port</A
|
|
></P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>These are described in the <A
|
|
HREF="smb.conf.5.html"
|
|
TARGET="_top"
|
|
>smb.conf(5)</A
|
|
> man
|
|
page and so will not be repeated here. However, a sample smb.conf file for
|
|
use with an LDAP directory could appear as</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>## /usr/local/samba/lib/smb.conf
|
|
[global]
|
|
security = user
|
|
encrypt passwords = yes
|
|
|
|
netbios name = TASHTEGO
|
|
workgroup = NARNIA
|
|
|
|
# ldap related parameters
|
|
|
|
# define the DN to use when binding to the directory servers
|
|
# The password for this DN is not stored in smb.conf. Rather it
|
|
# must be set by using 'smbpasswd -w <VAR
|
|
CLASS="REPLACEABLE"
|
|
>secretpw</VAR
|
|
>' to store the
|
|
# passphrase in the secrets.tdb file. If the "ldap admin dn" values
|
|
# changes, this password will need to be reset.
|
|
ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
|
|
|
|
# specify the LDAP server's hostname (defaults to locahost)
|
|
ldap server = ahab.samba.org
|
|
|
|
# Define the SSL option when connecting to the directory
|
|
# ('off', 'start tls', or 'on' (default))
|
|
ldap ssl = start tls
|
|
|
|
# define the port to use in the LDAP session (defaults to 636 when
|
|
# "ldap ssl = on")
|
|
ldap port = 389
|
|
|
|
# specify the base DN to use when searching the directory
|
|
ldap suffix = "ou=people,dc=samba,dc=org"
|
|
|
|
# generally the default ldap search filter is ok
|
|
# ldap filter = "(&(uid=%u)(objectclass=sambaAccount))"</PRE
|
|
></P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN534"
|
|
>3.6.6. Accounts and Groups management</A
|
|
></H2
|
|
><P
|
|
>As users accounts are managed thru the sambaAccount objectclass, you should
|
|
modify you existing administration tools to deal with sambaAccount attributes.</P
|
|
><P
|
|
>Machines accounts are managed with the sambaAccount objectclass, just
|
|
like users accounts. However, it's up to you to stored thoses accounts
|
|
in a different tree of you LDAP namespace: you should use
|
|
"ou=Groups,dc=plainjoe,dc=org" to store groups and
|
|
"ou=People,dc=plainjoe,dc=org" to store users. Just configure your
|
|
NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration
|
|
file).</P
|
|
><P
|
|
>In Samba release 3.0, the group management system is based on posix
|
|
groups. This means that Samba make usage of the posixGroup objectclass.
|
|
For now, there is no NT-like group system management (global and local
|
|
groups).</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN539"
|
|
>3.6.7. Security and sambaAccount</A
|
|
></H2
|
|
><P
|
|
>There are two important points to remember when discussing the security
|
|
of sambaAccount entries in the directory.</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
><SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Never</I
|
|
></SPAN
|
|
> retrieve the lmPassword or
|
|
ntPassword attribute values over an unencrypted LDAP session.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Never</I
|
|
></SPAN
|
|
> allow non-admin users to
|
|
view the lmPassword or ntPassword attribute values.</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>These password hashes are clear text equivalents and can be used to impersonate
|
|
the user without deriving the original clear text strings. For more information
|
|
on the details of LM/NT password hashes, refer to the <A
|
|
HREF="ENCRYPTION.html"
|
|
TARGET="_top"
|
|
>ENCRYPTION chapter</A
|
|
> of the Samba-HOWTO-Collection.</P
|
|
><P
|
|
>To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults
|
|
to require an encrypted session (<B
|
|
CLASS="COMMAND"
|
|
>ldap ssl = on</B
|
|
>) using
|
|
the default port of 636
|
|
when contacting the directory server. When using an OpenLDAP 2.0 server, it
|
|
is possible to use the use the StartTLS LDAP extended operation in the place of
|
|
LDAPS. In either case, you are strongly discouraged to disable this security
|
|
(<B
|
|
CLASS="COMMAND"
|
|
>ldap ssl = off</B
|
|
>).</P
|
|
><P
|
|
>Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS
|
|
extended operation. However, the OpenLDAP library still provides support for
|
|
the older method of securing communication between clients and servers.</P
|
|
><P
|
|
>The second security precaution is to prevent non-administrative users from
|
|
harvesting password hashes from the directory. This can be done using the
|
|
following ACL in <TT
|
|
CLASS="FILENAME"
|
|
>slapd.conf</TT
|
|
>:</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>## allow the "ldap admin dn" access, but deny everyone else
|
|
access to attrs=lmPassword,ntPassword
|
|
by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write
|
|
by * none</PRE
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN559"
|
|
>3.6.8. LDAP specials attributes for sambaAccounts</A
|
|
></H2
|
|
><P
|
|
>The sambaAccount objectclass is composed of the following attributes:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>lmPassword</CODE
|
|
>: the LANMAN password 16-byte hash stored as a character
|
|
representation of a hexidecimal string.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>ntPassword</CODE
|
|
>: the NT password hash 16-byte stored as a character
|
|
representation of a hexidecimal string.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>pwdLastSet</CODE
|
|
>: The integer time in seconds since 1970 when the
|
|
<CODE
|
|
CLASS="CONSTANT"
|
|
>lmPassword</CODE
|
|
> and <CODE
|
|
CLASS="CONSTANT"
|
|
>ntPassword</CODE
|
|
> attributes were last set.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>acctFlags</CODE
|
|
>: string of 11 characters surrounded by square brackets []
|
|
representing account flags such as U (user), W(workstation), X(no password expiration), and
|
|
D(disabled).</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>logonTime</CODE
|
|
>: Integer value currently unused</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>logoffTime</CODE
|
|
>: Integer value currently unused</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>kickoffTime</CODE
|
|
>: Integer value currently unused</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>pwdCanChange</CODE
|
|
>: Integer value currently unused</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>pwdMustChange</CODE
|
|
>: Integer value currently unused</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>homeDrive</CODE
|
|
>: specifies the drive letter to which to map the
|
|
UNC path specified by homeDirectory. The drive letter must be specified in the form "X:"
|
|
where X is the letter of the drive to map. Refer to the "logon drive" parameter in the
|
|
smb.conf(5) man page for more information.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>scriptPath</CODE
|
|
>: The scriptPath property specifies the path of
|
|
the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path
|
|
is relative to the netlogon share. Refer to the "logon script" parameter in the
|
|
smb.conf(5) man page for more information.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>profilePath</CODE
|
|
>: specifies a path to the user's profile.
|
|
This value can be a null string, a local absolute path, or a UNC path. Refer to the
|
|
"logon path" parameter in the smb.conf(5) man page for more information.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>smbHome</CODE
|
|
>: The homeDirectory property specifies the path of
|
|
the home directory for the user. The string can be null. If homeDrive is set and specifies
|
|
a drive letter, homeDirectory should be a UNC path. The path must be a network
|
|
UNC path of the form \\server\share\directory. This value can be a null string.
|
|
Refer to the "logon home" parameter in the smb.conf(5) man page for more information.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>userWorkstation</CODE
|
|
>: character string value currently unused.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>rid</CODE
|
|
>: the integer representation of the user's relative identifier
|
|
(RID).</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>primaryGroupID</CODE
|
|
>: the relative identifier (RID) of the primary group
|
|
of the user.</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>The majority of these parameters are only used when Samba is acting as a PDC of
|
|
a domain (refer to the <A
|
|
HREF="Samba-PDC-HOWTO.html"
|
|
TARGET="_top"
|
|
>Samba-PDC-HOWTO</A
|
|
> for details on
|
|
how to configure Samba as a Primary Domain Controller). The following four attributes
|
|
are only stored with the sambaAccount entry if the values are non-default values:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>smbHome</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>scriptPath</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>logonPath</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>homeDrive</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>These attributes are only stored with the sambaAccount entry if
|
|
the values are non-default values. For example, assume TASHTEGO has now been
|
|
configured as a PDC and that <B
|
|
CLASS="COMMAND"
|
|
>logon home = \\%L\%u</B
|
|
> was defined in
|
|
its <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
> file. When a user named "becky" logons to the domain,
|
|
the <VAR
|
|
CLASS="PARAMETER"
|
|
>logon home</VAR
|
|
> string is expanded to \\TASHTEGO\becky.
|
|
If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org",
|
|
this value is used. However, if this attribute does not exist, then the value
|
|
of the <VAR
|
|
CLASS="PARAMETER"
|
|
>logon home</VAR
|
|
> parameter is used in its place. Samba
|
|
will only write the attribute value to the directory entry is the value is
|
|
something other than the default (e.g. \\MOBY\becky).</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN629"
|
|
>3.6.9. Example LDIF Entries for a sambaAccount</A
|
|
></H2
|
|
><P
|
|
>The following is a working LDIF with the inclusion of the posixAccount objectclass:</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>dn: uid=guest2, ou=people,dc=plainjoe,dc=org
|
|
ntPassword: 878D8014606CDA29677A44EFA1353FC7
|
|
pwdMustChange: 2147483647
|
|
primaryGroupID: 1201
|
|
lmPassword: 552902031BEDE9EFAAD3B435B51404EE
|
|
pwdLastSet: 1010179124
|
|
logonTime: 0
|
|
objectClass: sambaAccount
|
|
uid: guest2
|
|
kickoffTime: 2147483647
|
|
acctFlags: [UX ]
|
|
logoffTime: 2147483647
|
|
rid: 19006
|
|
pwdCanChange: 0</PRE
|
|
></P
|
|
><P
|
|
>The following is an LDIF entry for using both the sambaAccount and
|
|
posixAccount objectclasses:</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
|
|
logonTime: 0
|
|
displayName: Gerald Carter
|
|
lmPassword: 552902031BEDE9EFAAD3B435B51404EE
|
|
primaryGroupID: 1201
|
|
objectClass: posixAccount
|
|
objectClass: sambaAccount
|
|
acctFlags: [UX ]
|
|
userPassword: {crypt}BpM2ej8Rkzogo
|
|
uid: gcarter
|
|
uidNumber: 9000
|
|
cn: Gerald Carter
|
|
loginShell: /bin/bash
|
|
logoffTime: 2147483647
|
|
gidNumber: 100
|
|
kickoffTime: 2147483647
|
|
pwdLastSet: 1010179230
|
|
rid: 19000
|
|
homeDirectory: /home/tashtego/gcarter
|
|
pwdCanChange: 0
|
|
pwdMustChange: 2147483647
|
|
ntPassword: 878D8014606CDA29677A44EFA1353FC7</PRE
|
|
></P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN637"
|
|
>3.7. MySQL</A
|
|
></H1
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN639"
|
|
>3.7.1. Creating the database</A
|
|
></H2
|
|
><P
|
|
>You either can set up your own table and specify the field names to pdb_mysql (see below
|
|
for the column names) or use the default table. The file <TT
|
|
CLASS="FILENAME"
|
|
>examples/pdb/mysql/mysql.dump</TT
|
|
>
|
|
contains the correct queries to create the required tables. Use the command :
|
|
|
|
<B
|
|
CLASS="COMMAND"
|
|
>mysql -u<VAR
|
|
CLASS="REPLACEABLE"
|
|
>username</VAR
|
|
> -h<VAR
|
|
CLASS="REPLACEABLE"
|
|
>hostname</VAR
|
|
> -p<VAR
|
|
CLASS="REPLACEABLE"
|
|
>password</VAR
|
|
> <VAR
|
|
CLASS="REPLACEABLE"
|
|
>databasename</VAR
|
|
> < <TT
|
|
CLASS="FILENAME"
|
|
>/path/to/samba/examples/pdb/mysql/mysql.dump</TT
|
|
></B
|
|
> </P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN649"
|
|
>3.7.2. Configuring</A
|
|
></H2
|
|
><P
|
|
>This plugin lacks some good documentation, but here is some short info:</P
|
|
><P
|
|
>Add a the following to the <B
|
|
CLASS="COMMAND"
|
|
>passdb backend</B
|
|
> variable in your <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
>:
|
|
<PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>passdb backend = [other-plugins] mysql:identifier [other-plugins]</PRE
|
|
></P
|
|
><P
|
|
>The identifier can be any string you like, as long as it doesn't collide with
|
|
the identifiers of other plugins or other instances of pdb_mysql. If you
|
|
specify multiple pdb_mysql.so entries in 'passdb backend', you also need to
|
|
use different identifiers!</P
|
|
><P
|
|
>Additional options can be given thru the smb.conf file in the [global] section.</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>identifier:mysql host - host name, defaults to 'localhost'
|
|
identifier:mysql password
|
|
identifier:mysql user - defaults to 'samba'
|
|
identifier:mysql database - defaults to 'samba'
|
|
identifier:mysql port - defaults to 3306
|
|
identifier:table - Name of the table containing users</PRE
|
|
></P
|
|
><DIV
|
|
CLASS="WARNING"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="WARNING"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="25"
|
|
ALIGN="CENTER"
|
|
VALIGN="TOP"
|
|
><IMG
|
|
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif"
|
|
HSPACE="5"
|
|
ALT="Warning"></TD
|
|
><TD
|
|
ALIGN="LEFT"
|
|
VALIGN="TOP"
|
|
><P
|
|
>Since the password for the mysql user is stored in the
|
|
smb.conf file, you should make the the smb.conf file
|
|
readable only to the user that runs samba. This is considered a security
|
|
bug and will be fixed soon.</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><P
|
|
>Names of the columns in this table(I've added column types those columns should have first):</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
>identifier:logon time column - int(9)
|
|
identifier:logoff time column - int(9)
|
|
identifier:kickoff time column - int(9)
|
|
identifier:pass last set time column - int(9)
|
|
identifier:pass can change time column - int(9)
|
|
identifier:pass must change time column - int(9)
|
|
identifier:username column - varchar(255) - unix username
|
|
identifier:domain column - varchar(255) - NT domain user is part of
|
|
identifier:nt username column - varchar(255) - NT username
|
|
identifier:fullname column - varchar(255) - Full name of user
|
|
identifier:home dir column - varchar(255) - Unix homedir path
|
|
identifier:dir drive column - varchar(2) - Directory drive path (eg: 'H:')
|
|
identifier:logon script column - varchar(255) - Batch file to run on client side when logging on
|
|
identifier:profile path column - varchar(255) - Path of profile
|
|
identifier:acct desc column - varchar(255) - Some ASCII NT user data
|
|
identifier:workstations column - varchar(255) - Workstations user can logon to (or NULL for all)
|
|
identifier:unknown string column - varchar(255) - unknown string
|
|
identifier:munged dial column - varchar(255) - ?
|
|
identifier:uid column - int(9) - Unix user ID (uid)
|
|
identifier:gid column - int(9) - Unix user group (gid)
|
|
identifier:user sid column - varchar(255) - NT user SID
|
|
identifier:group sid column - varchar(255) - NT group ID
|
|
identifier:lanman pass column - varchar(255) - encrypted lanman password
|
|
identifier:nt pass column - varchar(255) - encrypted nt passwd
|
|
identifier:plain pass column - varchar(255) - plaintext password
|
|
identifier:acct control column - int(9) - nt user data
|
|
identifier:unknown 3 column - int(9) - unknown
|
|
identifier:logon divs column - int(9) - ?
|
|
identifier:hours len column - int(9) - ?
|
|
identifier:unknown 5 column - int(9) - unknown
|
|
identifier:unknown 6 column - int(9) - unknown</PRE
|
|
></P
|
|
><P
|
|
>Eventually, you can put a colon (:) after the name of each column, which
|
|
should specify the column to update when updating the table. You can also
|
|
specify nothing behind the colon - then the data from the field will not be
|
|
updated. </P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN666"
|
|
>3.7.3. Using plaintext passwords or encrypted password</A
|
|
></H2
|
|
><P
|
|
>I strongly discourage the use of plaintext passwords, however, you can use them:</P
|
|
><P
|
|
>If you would like to use plaintext passwords, set 'identifier:lanman pass column' and 'identifier:nt pass column' to 'NULL' (without the quotes) and 'identifier:plain pass column' to the name of the column containing the plaintext passwords. </P
|
|
><P
|
|
>If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN671"
|
|
>3.7.4. Getting non-column data from the table</A
|
|
></H2
|
|
><P
|
|
>It is possible to have not all data in the database and making some 'constant'.</P
|
|
><P
|
|
>For example, you can set 'identifier:fullname column' to :
|
|
<B
|
|
CLASS="COMMAND"
|
|
>CONCAT(First_name,' ',Sur_name)</B
|
|
></P
|
|
><P
|
|
>Or, set 'identifier:workstations column' to :
|
|
<B
|
|
CLASS="COMMAND"
|
|
>NULL</B
|
|
></P
|
|
><P
|
|
>See the MySQL documentation for more language constructs.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN679"
|
|
>3.8. XML</A
|
|
></H1
|
|
><P
|
|
>This module requires libxml2 to be installed.</P
|
|
><P
|
|
>The usage of pdb_xml is pretty straightforward. To export data, use:
|
|
|
|
<KBD
|
|
CLASS="USERINPUT"
|
|
>pdbedit -e xml:filename</KBD
|
|
>
|
|
|
|
(where filename is the name of the file to put the data in)</P
|
|
><P
|
|
>To import data, use:
|
|
<KBD
|
|
CLASS="USERINPUT"
|
|
>pdbedit -i xml:filename -e current-pdb</KBD
|
|
>
|
|
|
|
Where filename is the name to read the data from and current-pdb to put it in.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="NAVFOOTER"
|
|
><HR
|
|
ALIGN="LEFT"
|
|
WIDTH="100%"><TABLE
|
|
SUMMARY="Footer navigation table"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
CELLPADDING="0"
|
|
CELLSPACING="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="left"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="browsing-quick.html"
|
|
ACCESSKEY="P"
|
|
>Prev</A
|
|
></TD
|
|
><TD
|
|
WIDTH="34%"
|
|
ALIGN="center"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="samba-howto-collection.html"
|
|
ACCESSKEY="H"
|
|
>Home</A
|
|
></TD
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="right"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="type.html"
|
|
ACCESSKEY="N"
|
|
>Next</A
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="left"
|
|
VALIGN="top"
|
|
>Quick Cross Subnet Browsing / Cross Workgroup Browsing guide</TD
|
|
><TD
|
|
WIDTH="34%"
|
|
ALIGN="center"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="introduction.html"
|
|
ACCESSKEY="U"
|
|
>Up</A
|
|
></TD
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="right"
|
|
VALIGN="top"
|
|
>Type of installation</TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
></BODY
|
|
></HTML
|
|
> |