[SOLVED] Add Samba users - match current Unix password (Samba 3.6.6 in Debian Wheezy)

gacanepa · 06-21-2013, 06:05 PM

Hi everyone,
I know that for a user to be granted access to a Samba server they need to have a valid UNIX account and a separate Samba password which is stored in the "smb password file", so in fact a user's password for his UNIX account may be different to the password for his Samba account.
Is there a way to 'sync' the passwords so that when I add an user to Samba, it will use by default the Unix password of that user?
Say the account for user 'alice' exists in my server.
When I add her to the list of Samba users

Code:

smbpasswd -a alice

I don't want the following dialog to appear

Code:

New SMB password:
Retype new SMB password:
Added user alice.

But use her Unix password as default.
Is there a way to do this?

cliffordw · 06-22-2013, 02:35 AM

Hi there,

I assume your Unix passwords are locally stored passwords in /etc/shadow or a similar file for your distro, and not in an external directory of some sort (LDAP/AD/etc). If so, what you're proposing is unfortunately not possible afaik. The reason for this is that the Unix passwords are encrypted with a one way hash (DES/MD5/SHA1/etc), and can't be decrypted to produce the plain text version fo the password again. The password in the smbpasswd file is encrypted using a different algorithm, so to create this from /etc/shadow would require the plain text password.

One alternative that might help to some degree is the Samba "unix password sync" option, which attempts to change the Unix password whenever you change the Samba password. See https://www.samba.org/samba/docs/usi...CHP-9-SECT-4.3 for details.

I believe PAM has some features that might also help with synchronizing passwords, but don't personally have any experience with that.

Using an LDAP server for authentication for both the Unix and Samba users would also solve the problem. The best way to go about this depends on your specific setup, though.

Good luck!

gacanepa · 06-22-2013, 08:43 AM

Quote:

Originally Posted by cliffordw

Hi there,

I assume your Unix passwords are locally stored passwords in /etc/shadow or a similar file for your distro, and not in an external directory of some sort (LDAP/AD/etc). If so, what you're proposing is unfortunately not possible afaik. The reason for this is that the Unix passwords are encrypted with a one way hash (DES/MD5/SHA1/etc), and can't be decrypted to produce the plain text version fo the password again. The password in the smbpasswd file is encrypted using a different algorithm, so to create this from /etc/shadow would require the plain text password.

One alternative that might help to some degree is the Samba "unix password sync" option, which attempts to change the Unix password whenever you change the Samba password. See https://www.samba.org/samba/docs/usi...CHP-9-SECT-4.3 for details.

I believe PAM has some features that might also help with synchronizing passwords, but don't personally have any experience with that.

Using an LDAP server for authentication for both the Unix and Samba users would also solve the problem. The best way to go about this depends on your specific setup, though.

Good luck!

Thank you very much! I will look into this.
I will mark this as solved and add to your rep.