Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have set up a Linux system with its own user account administration. It is not part of any domain (other than DNS). Now I want to allow its users to mount their home directories on a Windows system.

One way of doing this is by keeping two user account administrations: one maintained with passwd, the other with smbpasswd. This seems needlessly complicated. I want to maintain just one.

How can I best arrange this? The system is running Ubuntu 12.04 (Desktop).

share|improve this question
up vote 2 down vote accepted

Use PAM's support module for /etc/passwd.


Update:

There is a fundamental reason why you cannot unify these authentication mechanisms in any simple way.

  • Unix and Linux /etc/passwd authentication requires that the user's password be presented to the server. This can be within an encrypted channel (as in SSH password authentication when not using private-key authentication).
  • NTLM and MS-Kerberos authentication don't transmit passwords they transmit a hash of a password and the authenticating server takes it's copy of the user's password, constructs a hash using the same algorithm and compares the hash result with the hash presented by the client. Since /etc/passwd doesn't store passwords and uses a different hashing algorithm, /etc/passwd has insufficient information for authenticating NTLM/Kerberos clients.
  • Really old SMB authentication protocols pass the password (in plaintext, i.e. unprotected) and a SMB server can therefore compute a /etc/passwd type hash of this and compare it to the hash stored in /etc/passwd.

From the above it follows that you need a separate file to store passwords (smbpasswd) or a domain controller if you want to avoid plain text passwords transiting your LAN.

share|improve this answer
    
To do what? To replace all use of /etc/passwd with the use of the password file managed by smbpasswd? – reinierpost Oct 1 '12 at 12:47
    
@reinerpost, I had in mind the opposite. Tell Samba to use /etc/passwd (via PAM). This seems a simpler proposition to me :-) The link in my answer points to Samba documentation, not to general Linux documentation. – RedGrittyBrick Oct 1 '12 at 13:35
    
I have tried to do that, but it seems to require the Windows client sending the password in cleartext (samba.org/samba/docs/man/Samba-HOWTO-Collection/…) or a password synchronization mechanism that appears to work only in one direction (samba.org/samba/docs/man/Samba-HOWTO-Collection/…), both rather suboptimal workarounds in my view. – reinierpost Oct 1 '12 at 13:41
    
@reinierpost: So far as I know, the most common solution for that set of requirements (encrypted credentials on wire, single point of user admin) is to authenticate through a Windows Domain Controller (or Samba acting as such). – RedGrittyBrick Oct 1 '12 at 13:50
    
That is also my impression, but it would be helpful to know for sure. Hence my question. – reinierpost Oct 1 '12 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .