Thomas Reifferscheid

The goal is to change Samba and Unix-Passwords in an LDAP-Directory with the commands

```
/usr/bin/smbpasswd
```
```
(/usr)/bin/passwd
```

A common LDAP Setup on Debian Sarge with Samba
Installation of smbk5pwd on Debian Sarge

host 192.168.0.225
base dc=mydomain
ldap_version 3
rootbinddn cn=admin,dc=mydomain
nss_base_passwd ou=users,dc=mydomain
nss_base_shadow ou=users,dc=mydomain
nss_base_group          ou=groups,dc=mydomain

/etc/pam_ldap.conf

host 192.168.0.225
base dc=mydomain
ldap_version 3
rootbinddn cn=admin,dc=mydomain
pam_password exop
exop_arguments id

/etc/ldap/slapd.conf

password-hash {SSHA} {SHA} {SMD5} {MD5}
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/samba.schema
schemacheck     on
modulepath      /usr/lib/ldap
moduleload      back_bdb
backend         bdb

checkpoint 512 30
cachesize       6000
database        bdb
overlay smbk5pwd
suffix          "dc=mydomain"
rootdn          "cn=admin, dc=mydomain
rootpw          secret
index objectclass             eq
index cn                      pres,sub,eq
index sn                      pres,sub,eq
index uid                     pres,sub,eq
index displayName             pres,sub,eq
index   sambaSID              eq
index   sambaPrimaryGroupSID  eq
index   sambaDomainName       eq
index   default               sub
access to attrs=userPassword
  by dn="cn=admin,dc=mydomain" write
  by anonymous auth
  by self write
  by * none

access to attrs=SambaLMPassword,SambaNTPassword
     by dn="cn=admin,dc=mydomain" write
     by * none

access to * by * read
access to dn.base="ou=users,dc=mydomain" by * read
access to * by dn="cn=admin,dc=mydomain" write
            by * read

/etc/samba/smb.conf

	security = user
   	encrypt passwords = yes
        ldap admin dn = "cn=admin,dc=mydomain"
        passdb backend = ldapsam:ldap://192.168.0.225
        ldap ssl = off
        ldap delete dn = no
        ldap user suffix = ou=users
        ldap group suffix = ou=groups
        ldap suffix = dc=mydomain
        ldap filter = (uid=%u)
        ldap passwd sync = yes
   	obey pam restrictions = yes

ldapsearch before smbpasswd

ldapsearch -W -x -D "cn=admin,dc=mydomain" -b "dc=mydomain" uid=sebi

dn: uid=sebi,ou=users,dc=mydomain
objectClass: top
objectClass: account
objectClass: posixAccount
uid: sebi
cn: sebi
userPassword:: somescrambledbase64-encodedstring=
homeDirectory: /home/users/sebi
uidNumber: 1000
gidNumber: 100
loginShell: /bin/bash
description: Administrator

smbpasswd

root@thomas:~# smbpasswd -a sebi
New SMB password:
Retype new SMB password:
Added user sebi.
root@thomas:~# ldapsearch -W -x -D "cn=admin,dc=mydomain" -b "dc=mydomain" uid=sebi
Enter LDAP Password: 

dn: uid=sebi,ou=users,dc=mydomain
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: sambaSamAccount
uid: sebi
cn: sebi
homeDirectory: /home/users/sebi
uidNumber: 1000
gidNumber: 100
loginShell: /bin/bash
description: Administrator
sambaSID: S-1-5-21-2632658502-2305551154-663445729-3000
sambaPrimaryGroupSID: S-1-5-21-2632658502-2305551154-663445729-1201
displayName: sebi
sambaPwdCanChange: 1117662148
sambaPwdMustChange: 1119476548
sambaPasswordHistory: 0000000000000000000000000000000000000000000000000000000000000000
sambaAcctFlags: [U          ]
userPassword:: e1NTSEF9T28zMEgzT3FrV0pINWVDU0pSbGxlQUVCTGIxT3czaU8=
userPassword:: e1NIQX12MURMMHU5cnNBU1BkdFBBVzdYN2NjaGg5bm89
userPassword:: e1NNRDV9Q1pMNW4yK3NzaHlKNWhVVnNwVWE1d2FOOG5ZPQ==
userPassword:: e01ENX00aUo2OENCK1lBa2FvdWRHc0VwK1NRPT0=
sambaPwdLastSet: 1117662148
sambaLMPassword: 88e6e8fec9316019aad3b435b51404ee
sambaNTPassword: 947b4114d06d1fa2a429f

2. Installation of smbk5pwd on debian sarge

apt-get source slapd

wget ftp://ftp.openldap.org/pub/OpenLDAP/openldap-test/openldap-2.3.3beta.tgz

tar xvzf openldap-2.3.3beta.tgz

mv openldap-2.3.3beta/contrib/slapd-modules/smbk5pwd/ openldap2.2-2.2.23/contrib/slapd-modules/

cd openldap2.2-2.2.23

dpkg-buildpackage -uc -nc <- satisfy it, you may need install additional libraries, like eg.

apt-get install libdb4.2-dev libiodbc2-dev libsasl2-dev libslp-dev

Just build the package, dont install it! We just need a compiled slapd for building smbk5pwd

cd contrib/slapd-modules/smbk5pwd

Patch / Fix Makefile, note no Kerberos here!
wget http://student.physik.uni-mainz.de/~reiffert/smbk5pwd.diff
patch -p4 < smbk5pwd.diff

openldap2.2-2.2.23/contrib/slapd-modules/smbk5pwd/Makefile

--- openldap-2.3.3beta/contrib/slapd-modules/smbk5pwd/Makefile  2004-04-02
13:06:38.000000000 +0200
+++ openldap2.2-2.2.23/contrib/slapd-modules/smbk5pwd/Makefile  2005-06-02
11:23:25.000000000 +0200
@@ -9,19 +9,19 @@
 # top-level directory of the distribution or, alternatively, at
 # .

-LIBTOOL=../../../libtool
+LIBTOOL=libtool
 OPT=-g -O2
 CC=gcc

 # Omit DO_KRB5 or DO_SAMBA if you don't want to support it.
-DEFS=-DDO_KRB5 -DDO_SAMBA
+DEFS=-DDO_SAMBA

-HEIMDAL_INC=-I/usr/heimdal/include
+HEIMDAL_INC=
 SSL_INC=
-LDAP_INC=-I../../../include -I../../../servers/slapd
+LDAP_INC=-I../../../debian/build/include -I../../../include
-I../../../servers/slapd
 INCS=$(LDAP_INC) $(HEIMDAL_INC) $(SSL_INC)

-HEIMDAL_LIB=-L/usr/heimdal/lib -lkrb5 -lkadm5srv
+HEIMDAL_LIB=
 SSL_LIB=-lcrypto
 LDAP_LIB=-lldap_r -llber
 LIBS=$(LDAP_LIB) $(HEIMDAL_LIB) $(SSL_LIB)
@@ -29,9 +29,12 @@
 all:   smbk5pwd.la


-smbk5pwd.lo:   smbk5pwd.c
+smbk5pwd.lo:    smbk5pwd.c
        $(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $?

-smbk5pwd.la:   smbk5pwd.lo
+smbk5pwd.la:    smbk5pwd.lo
        $(LIBTOOL) --mode=link $(CC) $(OPT) -version-info 0:0:0 \
        -rpath /usr/local/libexec/openldap -module -o $@ $? $(LIBS)
+
+clean:
+       rm -rf *~ *.lo *.o *.so *.la .libs

cd /usr/lib
ln -s liblber.so.2 liblber.so
ln -s libldap_r.so.2 libldap_r.so
cd -

make

root@thomas:~/openldap2.2-2.2.23/contrib/slapd-modules/smbk5pwd# make
libtool --mode=compile gcc -g -O2 -DDO_SAMBA -I../../../debian/build/include -I../../../include -I../../../servers/slapd   -c smbk5pwd.c
mkdir .libs
 gcc -g -O2 -DDO_SAMBA -I../../../debian/build/include -I../../../include -I../../../servers/slapd -c smbk5pwd.c  -fPIC -DPIC -o .libs/smbk5pwd.o
 gcc -g -O2 -DDO_SAMBA -I../../../debian/build/include -I../../../include -I../../../servers/slapd -c smbk5pwd.c -o smbk5pwd.o >/dev/null 2>&1
libtool --mode=link gcc -g -O2 -version-info 0:0:0 \
-rpath /usr/local/libexec/openldap -module -o smbk5pwd.la smbk5pwd.lo -lldap_r -llber  -lcrypto
gcc -shared  .libs/smbk5pwd.o  -lldap_r -llber -lcrypto  -Wl,-soname -Wl,smbk5pwd.so.0 -o .libs/smbk5pwd.so.0.0.0
(cd .libs && rm -f smbk5pwd.so.0 && ln -s smbk5pwd.so.0.0.0 smbk5pwd.so.0)
(cd .libs && rm -f smbk5pwd.so && ln -s smbk5pwd.so.0.0.0 smbk5pwd.so)
ar cru .libs/smbk5pwd.a  smbk5pwd.o
ranlib .libs/smbk5pwd.a
creating smbk5pwd.la
(cd .libs && rm -f smbk5pwd.la && ln -s ../smbk5pwd.la smbk5pwd.la)
root@thomas:~/openldap2.2-2.2.23/contrib/slapd-modules/smbk5pwd#

cd .libs
cp -a * /usr/lib/ldap
cd ..
cp smbk5pwd.la /usr/lib

Additional lines to /etc/ldap/slapd.conf


moduleload      smbk5pwd.so
...
...
database bdb
overlay smbk5pwd

/usr/bin/passwd

root@thomas:~# passwd sebi
New password: 
Re-enter new password: 
LDAP password information changed for sebi
passwd: password updated successfully
root@thomas:~# ldapsearch -W -x -D "cn=admin,dc=mydomain" -b "dc=mydomain" uid=sebi
Enter LDAP Password: 

dn: uid=sebi,ou=users,dc=mydomain
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: sambaSamAccount
uid: sebi
cn: sebi
homeDirectory: /home/users/sebi
uidNumber: 1000
gidNumber: 100
loginShell: /bin/bash
description: Administrator
sambaSID: S-1-5-21-2632658502-2305551154-663445729-3000
sambaPrimaryGroupSID: S-1-5-21-2632658502-2305551154-663445729-1201
displayName: sebi
sambaPwdCanChange: 1117662148
sambaPwdMustChange: 1119476548
sambaPasswordHistory: 00000000000000000000000000000000000000000000000000000000
 00000000
sambaAcctFlags: [U          ]
userPassword:: e1NTSEF9VC9sQi9rUEIvUTkrOFQ3OGhENkJPby84TlpiZHg1ZUE=
userPassword:: e1NIQX1DKzdIdGVvL0Q5dkpYUTNVZnp4YnduWGFpak09
userPassword:: e1NNRDV9bWhJcWowMVhxQWF5aDJ1YlZjMEY3c3JLOEFVPQ==
userPassword:: e01ENX1yTDBZMjB6QytGenQ3MlZQek1TazJBPT0=
sambaPwdLastSet: 1117662323
sambaLMPassword: 5bfafbebfb6a0942aad3b435b51404ee
sambaNTPassword: ac8e657f83df82beea5d43bdaf7800cc

As you can see, passwords a) get generated and b) changed.

From: Erik Forsberg forsberg@XXXX
To: reiffert@XXXX
Subject: http://student.physik.uni-mainz.de/~reiffert/smbk5pwd.html

Hi!

Found http://student.physik.uni-mainz.de/~reiffert/smbk5pwd.html, and
it was exactly what I was looking for. Thanks!

Btw, may I suggest changing the instruction about satisfying the
build-dependencies. Instead of adding the packages manually, you can
use 'apt-get build-dep slapd' to automatically fetch all required
packages.