On Wednesday, 30 September 2009 17:33:39 Scott Classen wrote:
Hello
I am running openldap 2.4.18 (BDB 4.8.24). Both of which I compiled from source. I compiled smbk5pwd with support ONLY for samba. I am using the samba that is distributed with CentOS 5.3 (3.0.33)
I use this module in my personal setup, and the last time I changed my password I have 2.4.17 installed, and my samba password works (and I am quite sure I didn't set it manually).
/me upgrades to 2.4.18 ...
On 2.4.18 (built from the same SRPM as the packages at http://staff.telkomsa.net/packages/rhel5/openldap/), it works for me:
[bgmilne@tiger ~]$ passwd Changing password for user bgmilne. Changing password for bgmilne. Enter current password: Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information changed for bgmilne passwd: all authentication tokens updated successfully. [bgmilne@tiger ~]$ ldapwhoami -x -D uid=bgmilne,ou=People,dc=ranger,dc=dnsalias,dc=com -W Enter LDAP Password: dn:uid=bgmilne,ou=People,dc=ranger,dc=dnsalias,dc=com [bgmilne@tiger ~]$ smbclient //localhost/bgmilne Enter bgmilne's password: Domain=[RANGER] OS=[Unix] Server=[Samba 3.4.1] smb: >
openldap does not crash or complain when it launches so I assume that:
moduleload /usr/local/libexec/smbk5pwd.la
is at least loading up the module correctly.
I have a user with the sambaSamAccount objectclass.
I have configured PAM to change the LDAP userPassword when invoked from the command line with /usr/bin/passwd
What is pam_password set to in /etc/ldap.conf ?
Have you tried this by changing the password with ldappasswd instead (which we know will do an ldap password change exop, which pam_ldap should do only if pam_password is set to 'exop'.
The userPassword hash gets successfully updated and the values of the sambaNTPassword and sambaLMPassword hashes are changed, but I am unable to authenticate as a samba user against these hashes... and they look sorta weird:
010000000000000090c9c94100000000
when I would expect them to look more "complicated" like:
552902031BEDE9EFAAD3B435B51404EE
Does this smell of a smbk5pwd bug/problem/misconfiguration or a samba/ PAM one?
Could be a combination, this is only going to work if pam_password is set to exop, if smbk5pwd gets a password hash, it shouldn't be setting any other hashes.
Regards, Buchan