| blob | 8edbdb26ca14d0ada3edc3631ee9055cadd60fb8 |
1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 25. PAM based Distributed Authentication</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><link rel="home" href="samba-doc.html" title="SAMBA Project Documentation"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="previous" href="ProfileMgmt.html" title="Chapter 24. Desktop Profile Management"><link rel="next" href="integrate-ms-networks.html" title="Chapter 26. Integrating MS Windows networks with Samba"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 25. PAM based Distributed Authentication</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ProfileMgmt.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="integrate-ms-networks.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="pam"></a>Chapter 25. PAM based Distributed Authentication</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Stephen</span> <span class="surname">Langasek</span></h3><div class="affiliation"><div class="address"><p><tt class="email"><<a href="mailto:vorlon@netexpress.net">vorlon@netexpress.net</a>></tt></p></div></div></div></div><div><p class="pubdate">May 31, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="pam.html#id2949695">Features and Benefits</a></dt><dt><a href="pam.html#id2949942">Technical Discussion</a></dt><dd><dl><dt><a href="pam.html#id2949960">PAM Configuration Syntax</a></dt><dt><a href="pam.html#id2950624">Example System Configurations</a></dt><dt><a href="pam.html#id2950929">smb.conf PAM Configuration</a></dt><dt><a href="pam.html#id2951007">Remote CIFS Authentication using winbindd.so</a></dt><dt><a href="pam.html#id2951091">Password Synchronization using pam_smbpass.so</a></dt></dl></dd><dt><a href="pam.html#id2951474">Common Errors</a></dt><dd><dl><dt><a href="pam.html#id2951487">pam_winbind problem</a></dt><dt><a href="pam.html#id2951576">Winbind is not resolving users and groups</a></dt></dl></dd></dl></div><p>
2 This chapter you should help you to deploy winbind based authentication on any PAM enabled
3 UNIX/Linux system. Winbind can be used to enable user level application access authentication
4 from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba
5 based domain environment. It will also help you to configure PAM based local host access
6 controls that are appropriate to your Samba configuration.
7 </p><p>
8 In addition to knowing how to configure winbind into PAM, you will learn generic PAM management
9 possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage.
10 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
11 The use of Winbind require more than PAM configuration alone. Please refer to <a href="winbind.html" title="Chapter 21. Winbind: Use of Domain Accounts">the Winbind chapter</a>.
12 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2949695"></a>Features and Benefits</h2></div></div><div></div></div><p>
13 A number of UNIX systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux,
14 now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication,
15 authorization and resource control services. Prior to the introduction of PAM, a decision
17 would require the provision of alternatives for all programs that provide security services.
18 Such a choice would involve provision of alternatives to such programs as: <b class="command">login</b>,
20 </p><p>
21 PAM provides a mechanism that disconnects these security programs from the underlying
22 authentication/authorization infrastructure. PAM is configured either through one file
25 </p><p>
26 On PAM enabled UNIX/Linux systems it is an easy matter to configure the system to use any
27 authentication backend, so long as the appropriate dynamically loadable library modules
28 are available for it. The backend may be local to the system, or may be centralised on a
29 remote server.
30 </p><p>
31 PAM support modules are available for:
32 </p><div class="variablelist"><dl><dt><span class="term"><tt class="filename">/etc/passwd</tt>:</span></dt><dd><p>
33 There are several PAM modules that interact with this standard UNIX user
34 database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so
35 and pam_userdb.so.
37 The pam_krb5.so module allows the use of any Kerberos compliant server.
38 This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially
39 Microsoft Active Directory (if enabled).
41 The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend
42 server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1,
43 Sun ONE iDentity server, Novell eDirectory server, Microsoft Active Directory.
45 The pam_ncp_auth.so module allows authentication off any bindery enabled
46 NetWare Core Protocol based server.
48 This module, called pam_smbpass.so, will allow user authentication off
51 The pam_smb_auth.so module is the original MS Windows networking authentication
52 tool. This module has been somewhat outdated by the Winbind module.
54 The pam_winbind.so module allows Samba to obtain authentication from any
55 MS Windows Domain Controller. It can just as easily be used to authenticate
56 users for access to any PAM enabled application.
58 There is a PAM RADIUS (Remote Access Dial-In User Service) authentication
59 module. In most cases the administrator will need to locate the source code
60 for this tool and compile and install it themselves. RADIUS protocols are
61 used by many routers and terminal servers.
62 </p></dd></dl></div><p>
63 Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone.
64 </p><p>
65 Once configured, these permit a remarkable level of flexibility in the location and use
66 of distributed samba domain controllers that can provide wide are network bandwidth
67 efficient authentication services for PAM capable systems. In effect, this allows the
68 deployment of centrally managed and maintained distributed authentication from a single
69 user account database.
70 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2949942"></a>Technical Discussion</h2></div></div><div></div></div><p>
71 PAM is designed to provide the system administrator with a great deal of flexibility in
72 configuration of the privilege granting applications of their system. The local
73 configuration of system security controlled by PAM is contained in one of two places:
74 either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory.
75 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949960"></a>PAM Configuration Syntax</h3></div></div><div></div></div><p>
76 In this section we discuss the correct syntax of and generic options respected by entries to these files.
77 PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case
78 sensitive since they indicate a file's name and reflect the case dependence of typical file-systems.
79 The case-sensitivity of the arguments to any given module is defined for each module in turn.
80 </p><p>
81 In addition to the lines described below, there are two special characters provided for the convenience
82 of the system administrator: comments are preceded by a `#' and extend to the next end-of-line; also,
83 module specification lines may be extended with a `\' escaped newline.
84 </p><p>
85 If the PAM authentication module (loadable link library file) is located in the
86 default location then it is not necessary to specify the path. In the case of
88 is located outside the default then the path must be specified as:
89 </p><p>
91 auth required /other_path/pam_strange_module.so
92 </pre><p>
93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2950018"></a>Anatomy of <tt class="filename">/etc/pam.d</tt> Entries</h4></div></div><div></div></div><p>
94 The remaining information in this subsection was taken from the documentation of the Linux-PAM
95 project. For more information on PAM, see
96 <a href="http://ftp.kernel.org/pub/linux/libs/pam/" target="_top">The Official Linux-PAM home page</a>
97 </p><p>
98 A general configuration line of the /etc/pam.conf file has the following form:
99 </p><p>
101 service-name module-type control-flag module-path args
102 </pre><p>
103 </p><p>
104 Below, we explain the meaning of each of these tokens. The second (and more recently adopted)
105 way of configuring Linux-PAM is via the contents of the <tt class="filename">/etc/pam.d/</tt> directory.
106 Once we have explained the meaning of the above tokens, we will describe this method.
108 The name of the service associated with this entry. Frequently the service name is the conventional
109 name of the given application. For example, `ftpd', `rlogind' and `su', etc. .
110 </p><p>
111 There is a special service-name, reserved for defining a default authentication mechanism. It has
112 the name `OTHER' and may be specified in either lower or upper case characters. Note, when there
113 is a module specified for a named service, the `OTHER' entries are ignored.
115 One of (currently) four types of module. The four types are as follows:
117 <span class="emphasis"><em>auth:</em></span> this module type provides two aspects of authenticating the user.
118 Firstly, it establishes that the user is who they claim to be, by instructing the application
119 to prompt the user for a password or other means of identification. Secondly, the module can
120 grant group membership (independently of the <tt class="filename">/etc/groups</tt> file discussed
121 above) or other privileges through its credential granting properties.
122 </p></li><li><p>
123 <span class="emphasis"><em>account:</em></span> this module performs non-authentication based account management.
124 It is typically used to restrict/permit access to a service based on the time of day, currently
125 available system resources (maximum number of users) or perhaps the location of the applicant
126 user `root' login only on the console.
127 </p></li><li><p>
128 <span class="emphasis"><em>session:</em></span> primarily, this module is associated with doing things that need
129 to be done for the user before/after they can be given service. Such things include the logging
130 of information concerning the opening/closing of some data exchange with a user, mounting
131 directories, etc.
132 </p></li><li><p>
133 <span class="emphasis"><em>password:</em></span> this last module type is required for updating the authentication
134 token associated with the user. Typically, there is one module for each `challenge/response'
135 based authentication (auth) module-type.
137 The control-flag is used to indicate how the PAM library will react to the success or failure of the
138 module it is associated with. Since modules can be stacked (modules of the same type execute in series,
139 one after another), the control-flags determine the relative importance of each module. The application
140 is not made aware of the individual success or failure of modules listed in the
141 <tt class="filename">/etc/pam.conf</tt> file. Instead, it receives a summary success or fail response from
142 the Linux-PAM library. The order of execution of these modules is that of the entries in the
144 As of Linux-PAM v0.60, this control-flag can be defined with one of two syntaxes.
145 </p><p>
146 The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the
147 severity of concern associated with the success or failure of a specific module. There are four such
149 </p><p>
150 The Linux-PAM library interprets these keywords in the following manner:
152 <span class="emphasis"><em>required:</em></span> this indicates that the success of the module is required for the
153 module-type facility to succeed. Failure of this module will not be apparent to the user until all
154 of the remaining modules (of the same module-type) have been executed.
155 </p></li><li><p>
156 <span class="emphasis"><em>requisite:</em></span> like required, however, in the case that such a module returns a
157 failure, control is directly returned to the application. The return value is that associated with
158 the first required or requisite module to fail. Note, this flag can be used to protect against the
159 possibility of a user getting the opportunity to enter a password over an unsafe medium. It is
160 conceivable that such behavior might inform an attacker of valid accounts on a system. This
161 possibility should be weighed against the not insignificant concerns of exposing a sensitive
162 password in a hostile environment.
163 </p></li><li><p>
164 <span class="emphasis"><em>sufficient:</em></span> the success of this module is deemed `sufficient' to satisfy
165 the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no
166 previous required module has failed, no more `stacked' modules of this type are invoked. (Note,
167 in this case subsequent required modules are not invoked.). A failure of this module is not deemed
168 as fatal to satisfying the application that this module-type has succeeded.
169 </p></li><li><p>
170 <span class="emphasis"><em>optional:</em></span> as its name suggests, this control-flag marks the module as not
171 being critical to the success or failure of the user's application for service. In general,
172 Linux-PAM ignores such a module when determining if the module stack will succeed or fail.
173 However, in the absence of any definite successes or failures of previous or subsequent stacked
174 modules this module will determine the nature of the response to the application. One example of
175 this latter case, is when the other modules return something like PAM_IGNORE.
176 </p></li></ul></div><p>
177 The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control
178 over how the user is authenticated. This form of the control flag is delimited with square brackets and
179 consists of a series of value=action tokens:
181 [value1=action1 value2=action2 ...]
182 </pre><p>
183 Here, value1 is one of the following return values: success; open_err; symbol_err; service_err;
184 system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries;
185 new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err;
186 authtok_err; authtok_recover_err; authtok_lock_busy; authtok_disable_aging; try_again; ignore; abort;
187 authtok_expired; module_unknown; bad_item; and default. The last of these (default) can be used to set
188 the action for those return values that are not explicitly defined.
189 </p><p>
190 The action1 can be a positive integer or one of the following tokens: ignore; ok; done; bad; die; and reset.
191 A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the
192 current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated
193 stack of modules with a number of different paths of execution. Which path is taken can be determined by the
194 reactions of individual modules.
196 <span class="emphasis"><em>ignore:</em></span> when used with a stack of modules, the module's return status will not
197 contribute to the return code the application obtains.
198 </p></li><li><p>
199 <span class="emphasis"><em>bad:</em></span> this action indicates that the return code should be thought of as indicative
200 of the module failing. If this module is the first in the stack to fail, its status value will be used
201 for that of the whole stack.
202 </p></li><li><p>
203 <span class="emphasis"><em>die:</em></span> equivalent to bad with the side effect of terminating the module stack and
204 PAM immediately returning to the application.
205 </p></li><li><p>
206 <span class="emphasis"><em>ok:</em></span> this tells PAM that the administrator thinks this return code should
207 contribute directly to the return code of the full stack of modules. In other words, if the former
208 state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override
209 this value. Note, if the former state of the stack holds some value that is indicative of a modules
210 failure, this 'ok' value will not be used to override that value.
211 </p></li><li><p>
212 <span class="emphasis"><em>done:</em></span> equivalent to ok with the side effect of terminating the module stack and
213 PAM immediately returning to the application.
214 </p></li><li><p>
215 <span class="emphasis"><em>reset:</em></span> clear all memory of the state of the module stack and start again with
216 the next stacked module.
217 </p></li></ul></div><p>
218 Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in
219 terms of the [...] syntax. They are as follows:
220 </p><p>
222 required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad]
223 </p></li><li><p>
224 requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die]
225 </p></li><li><p>
226 sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore]
227 </p></li><li><p>
228 optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore]
229 </p></li></ul></div><p>
230 </p><p>
231 Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63,
232 the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support
233 machine-machine authentication using the transport protocol inherent to the client/server application. With the
234 <span class="emphasis"><em>[ ... value=action ... ]</em></span> control syntax, it is possible for an application to be configured
235 to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication
236 mode for older, legacy, applications.
238 The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the
239 module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended
241 </p><p>
242 The args are a list of tokens that are passed to the module when it is invoked. Much like arguments to a typical
243 Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments
244 are ignored by a module, however, when encountering an invalid argument, the module is required to write an error
245 to syslog(3). For a list of generic options see the next section.
246 </p><p>
247 Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example:
249 squid auth required pam_mysql.so user=passwd_query passwd=mada \
250 db=eminence [query=select user_name from internet_service where \
251 user_name='%u' and password=PASSWORD('%p') and \
252 service='web_proxy']
253 </pre><p>
254 Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]'
255 character inside the string that will survive the argument parsing, you should use `\['. In other words:
257 [..[..\]..] --> ..[..]..
258 </pre><p>
259 Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the
260 side of caution) to make the authentication process fail. A corresponding error is written to the system log files
261 with a call to syslog(3).
262 </p></dd></dl></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950624"></a>Example System Configurations</h3></div></div><div></div></div><p>
264 This example had all options been uncommented is probably not usable
265 as it stacks many conditions before allowing successful completion
266 of the login process. Essentially all conditions can be disabled
268 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2950655"></a>PAM: original login config</h4></div></div><div></div></div><pre class="programlisting">
269 #%PAM-1.0
270 # The PAM configuration file for the `login' service
271 #
272 auth required pam_securetty.so
273 auth required pam_nologin.so
274 # auth required pam_dialup.so
275 # auth optional pam_mail.so
276 auth required pam_pwdb.so shadow md5
277 # account requisite pam_time.so
278 account required pam_pwdb.so
279 session required pam_pwdb.so
280 # session optional pam_lastlog.so
281 # password required pam_cracklib.so retry=3
282 password required pam_pwdb.so shadow md5
283 </pre></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2950683"></a>PAM: login using pam_smbpass</h4></div></div><div></div></div><p>
284 PAM allows use of replaceable modules. Those available on a sample system include:
287 pam_access.so pam_ftp.so pam_limits.so
288 pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so
289 pam_cracklib.so pam_group.so pam_listfile.so
290 pam_nologin.so pam_rootok.so pam_tally.so
291 pam_deny.so pam_issue.so pam_mail.so
292 pam_permit.so pam_securetty.so pam_time.so
293 pam_dialup.so pam_lastlog.so pam_mkhomedir.so
294 pam_pwdb.so pam_shells.so pam_unix.so
295 pam_env.so pam_ldap.so pam_motd.so
296 pam_radius.so pam_smbpass.so pam_unix_acct.so
297 pam_wheel.so pam_unix_auth.so pam_unix_passwd.so
298 pam_userdb.so pam_warn.so pam_unix_session.so
299 </pre><p>
300 The following example for the login program replaces the use of
305 database which contains the Microsoft MD4 encrypted password
306 hashes. This database is stored in either
310 Samba implementation for your UNIX/Linux system. The
312 Samba version 2.2.1 or later. It can be compiled by specifying the
317 source distribution.
319 #%PAM-1.0
320 # The PAM configuration file for the `login' service
321 #
322 auth required pam_smbpass.so nodelay
323 account required pam_smbpass.so nodelay
324 session required pam_smbpass.so nodelay
325 password required pam_smbpass.so nodelay
326 </pre><p>
327 The following is the PAM configuration file for a particular
330 #%PAM-1.0
331 # The PAM configuration file for the `samba' service
332 #
333 auth required pam_pwdb.so nullok nodelay shadow audit
334 account required pam_pwdb.so audit nodelay
335 session required pam_pwdb.so nodelay
336 password required pam_pwdb.so shadow md5
337 </pre><p>
338 In the following example the decision has been made to use the
339 smbpasswd database even for basic samba authentication. Such a
340 decision could also be made for the passwd program and would
341 thus allow the smbpasswd passwords to be changed using the passwd
342 program.
344 #%PAM-1.0
345 # The PAM configuration file for the `samba' service
346 #
347 auth required pam_smbpass.so nodelay
348 account required pam_pwdb.so audit nodelay
349 session required pam_pwdb.so nodelay
350 password required pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf
351 </pre><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>PAM allows stacking of authentication mechanisms. It is
352 also possible to pass information obtained within one PAM module through
353 to the next module in the PAM stack. Please refer to the documentation for
354 your particular system implementation for details regarding the specific
355 capabilities of PAM in this environment. Some Linux implementations also
357 authentication to be configured in a single central file. The
359 on the basis that it allows for easier administration. As with all issues in
360 life though, every decision makes trade-offs, so you may want examine the
361 PAM documentation for further helpful information.
362 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950929"></a>smb.conf PAM Configuration</h3></div></div><div></div></div><p>
363 There is an option in smb.conf called <a class="indexterm" name="id2950938"></a><i class="parameter"><tt>obey pam restrictions</tt></i>.
364 The following is from the on-line help for this option in SWAT;
365 </p><p>
366 When Samba is configured to enable PAM support (i.e.
368 control whether or not Samba should obey PAM's account
369 and session management directives. The default behavior
370 is to use PAM for clear text authentication only and to
371 ignore any account or session management. Note that Samba always
372 ignores PAM for authentication in the case of
373 <a class="indexterm" name="id2950969"></a><i class="parameter"><tt>encrypt passwords</tt></i> = yes.
374 The reason is that PAM modules cannot support the challenge/response
375 authentication mechanism needed in the presence of SMB
376 password encryption.
377 </p><p>Default: <a class="indexterm" name="id2950990"></a><i class="parameter"><tt>obey pam restrictions</tt></i> = no</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951007"></a>Remote CIFS Authentication using winbindd.so</h3></div></div><div></div></div><p>
378 All operating systems depend on the provision of users credentials acceptable to the platform.
379 UNIX requires the provision of a user identifier (UID) as well as a group identifier (GID).
380 These are both simple integer type numbers that are obtained from a password backend such
382 </p><p>
383 Users and groups on a Windows NT server are assigned a relative id (rid) which is unique for
384 the domain when the user or group is created. To convert the Windows NT user or group into
385 a unix user or group, a mapping between rids and unix user and group ids is required. This
386 is one of the jobs that winbind performs.
387 </p><p>
388 As winbind users and groups are resolved from a server, user and group ids are allocated
389 from a specified range. This is done on a first come, first served basis, although all
390 existing users and groups will be mapped as soon as a client performs a user or group
391 enumeration command. The allocated unix ids are stored in a database file under the Samba
392 lock directory and will be remembered.
393 </p><p>
394 The astute administrator will realize from this that the combination of <tt class="filename">pam_smbpass.so</tt>,
395 <b class="command">winbindd</b>, and a distributed passdb backend, such as ldap, will allow the establishment of a
396 centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware
397 programs and applications. This arrangement can have particularly potent advantages compared with the use of
398 Microsoft Active Directory Service (ADS) in so far as reduction of wide area network authentication traffic.
399 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
400 The rid to unix id database is the only location where the user and group mappings are
401 stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd
402 to determine which user and group ids correspond to Windows NT user and group rids.
403 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951091"></a>Password Synchronization using pam_smbpass.so</h3></div></div><div></div></div><p>
404 pam_smbpass is a PAM module which can be used on conforming systems to
405 keep the smbpasswd (Samba password) database in sync with the unix
406 password file. PAM (Pluggable Authentication Modules) is an API supported
407 under some Unices, such as Solaris, HPUX and Linux, that provides a
408 generic interface to authentication mechanisms.
409 </p><p>
410 This module authenticates a local smbpasswd user database. If you require
411 support for authenticating against a remote SMB server, or if you're
412 concerned about the presence of suid root binaries on your system, it is
413 recommended that you use pam_winbind instead.
414 </p><p>
415 Options recognized by this module are as follows:
416 </p><div class="table"><a name="id2951123"></a><p class="title"><b>Table 25.1. Options recognized by pam_smbpass</b></p><table summary="Options recognized by pam_smbpass" border="1"><colgroup><col align="left"><col align="justify"></colgroup><tbody><tr><td align="left">debug</td><td align="justify">log more debugging info</td></tr><tr><td align="left">audit</td><td align="justify">like debug, but also logs unknown usernames</td></tr><tr><td align="left">use_first_pass</td><td align="justify">don't prompt the user for passwords; take them from PAM_ items instead</td></tr><tr><td align="left">try_first_pass</td><td align="justify">try to get the password from a previous PAM module, fall back to prompting the user</td></tr><tr><td align="left">use_authtok</td><td align="justify">like try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only)</td></tr><tr><td align="left">not_set_pass</td><td align="justify">don't make passwords used by this module available to other modules.</td></tr><tr><td align="left">nodelay</td><td align="justify">don't insert ~1 second delays on authentication failure.</td></tr><tr><td align="left">nullok</td><td align="justify">null passwords are allowed.</td></tr><tr><td align="left">nonull</td><td align="justify">null passwords are not allowed. Used to override the Samba configuration.</td></tr><tr><td align="left">migrate</td><td align="justify">only meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication.</td></tr><tr><td align="left">smbconf=<i class="replaceable"><tt>file</tt></i></td><td align="justify">specify an alternate path to the <tt class="filename">smb.conf</tt> file.</td></tr></tbody></table></div><p>
417 </p><p>
418 </p><div class="itemizedlist"><ul type="disc"><li><p><a href="mailto:morgan@transmeta.com" target="_top">Andrew Morgan</a>, for providing the Linux-PAM
419 framework, without which none of this would have happened</p></li><li><p><a href="mailto:gafton@redhat.com" target="_top">Christian Gafton</a> and Andrew Morgan again, for the
420 pam_pwdb module upon which pam_smbpass was originally based</p></li><li><p><a href="mailto:lkcl@switchboard.net" target="_top">Luke Leighton</a> for being receptive to the idea,
421 and for the occasional good-natured complaint about the project's status
422 that keep me working on it :)</p></li></ul></div><p>.
423 </p><p>
424 The following are examples of the use of pam_smbpass.so in the format of Linux
426 tool on other platforms will need to adapt this appropriately.
427 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2951339"></a>Password Synchronisation Configuration</h4></div></div><div></div></div><p>
428 A sample PAM configuration that shows the use of pam_smbpass to make
429 sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow)
430 is changed. Useful when an expired password might be changed by an
431 application (such as ssh).
433 #%PAM-1.0
434 # password-sync
435 #
436 auth requisite pam_nologin.so
437 auth required pam_unix.so
438 account required pam_unix.so
439 password requisite pam_cracklib.so retry=3
440 password requisite pam_unix.so shadow md5 use_authtok try_first_pass
441 password required pam_smbpass.so nullok use_authtok try_first_pass
442 session required pam_unix.so
443 </pre></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2951372"></a>Password Migration Configuration</h4></div></div><div></div></div><p>
444 A sample PAM configuration that shows the use of pam_smbpass to migrate
445 from plaintext to encrypted passwords for Samba. Unlike other methods,
446 this can be used for users who have never connected to Samba shares:
447 password migration takes place when users ftp in, login using ssh, pop
448 their mail, etc.
450 #%PAM-1.0
451 # password-migration
452 #
453 auth requisite pam_nologin.so
454 # pam_smbpass is called IF pam_unix succeeds.
455 auth requisite pam_unix.so
456 auth optional pam_smbpass.so migrate
457 account required pam_unix.so
458 password requisite pam_cracklib.so retry=3
459 password requisite pam_unix.so shadow md5 use_authtok try_first_pass
460 password optional pam_smbpass.so nullok use_authtok try_first_pass
461 session required pam_unix.so
462 </pre></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2951407"></a>Mature Password Configuration</h4></div></div><div></div></div><p>
463 A sample PAM configuration for a 'mature' smbpasswd installation.
464 private/smbpasswd is fully populated, and we consider it an error if
465 the smbpasswd doesn't exist or doesn't match the UNIX password.
467 #%PAM-1.0
468 # password-mature
469 #
470 auth requisite pam_nologin.so
471 auth required pam_unix.so
472 account required pam_unix.so
473 password requisite pam_cracklib.so retry=3
474 password requisite pam_unix.so shadow md5 use_authtok try_first_pass
475 password required pam_smbpass.so use_authtok use_first_pass
476 session required pam_unix.so
477 </pre></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2951440"></a>Kerberos Password Integration Configuration</h4></div></div><div></div></div><p>
478 A sample PAM configuration that shows pam_smbpass used together with
479 pam_krb5. This could be useful on a Samba PDC that is also a member of
480 a Kerberos realm.
482 #%PAM-1.0
483 # kdc-pdc
484 #
485 auth requisite pam_nologin.so
486 auth requisite pam_krb5.so
487 auth optional pam_smbpass.so migrate
488 account required pam_krb5.so
489 password requisite pam_cracklib.so retry=3
490 password optional pam_smbpass.so nullok use_authtok try_first_pass
491 password required pam_krb5.so use_authtok try_first_pass
492 session required pam_krb5.so
493 </pre></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2951474"></a>Common Errors</h2></div></div><div></div></div><p>
494 PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from
495 the Samba mailing list.
496 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951487"></a>pam_winbind problem</h3></div></div><div></div></div><p>
498 I have the following PAM configuration:
500 </p><p>
502 auth required /lib/security/pam_securetty.so
503 auth sufficient /lib/security/pam_winbind.so
504 auth sufficient /lib/security/pam_unix.so use_first_pass nullok
505 auth required /lib/security/pam_stack.so service=system-auth
506 auth required /lib/security/pam_nologin.so
507 account required /lib/security/pam_stack.so service=system-auth
508 account required /lib/security/pam_winbind.so
509 password required /lib/security/pam_stack.so service=system-auth
510 </pre><p>
511 </p><p>
513 When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie".
516 </p><p>
518 service=system-auth</tt></i>. That file often contains a lot of stuff that may
519 duplicate what you're already doing. Try commenting out the pam_stack lines
520 for auth and account and see if things work. If they do, look at
523 winbind, you can put the winbind-specific stuff in <tt class="filename">/etc/pam.d/system-auth</tt>.
524 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951576"></a>Winbind is not resolving users and groups</h3></div></div><div></div></div><p>
526 My smb.conf file is correctly configured. I have specified
528 and <a class="indexterm" name="id2951604"></a><i class="parameter"><tt>idmap gid</tt></i> = 3000-3500
533 MIDEARTH+maryo
534 MIDEARTH+jackb
535 MIDEARTH+ameds
536 ...
537 MIDEARTH+root
540 MIDEARTH+Domain Users
541 MIDEARTH+Domain Admins
542 MIDEARTH+Domain Guests
543 ...
544 MIDEARTH+Accounts
549 ...
551 </pre><p>
553 But the following command just fails:
557 chown: `maryo': invalid user
558 </pre><p>
560 This is driving me nuts! What can be wrong?
562 </p><p>
564 caching daemon. Shut it down, do NOT restart it! You will find your problem resolved.
565 </p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ProfileMgmt.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="integrate-ms-networks.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 24. Desktop Profile Management </td><td width="20%" align="center"><a accesskey="h" href="samba-doc.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 26. Integrating MS Windows networks with Samba</td></tr></table></div></body></html>