4

I am setting up a home server with file sharing using Samba. It has XUbuntu 15.10.
Samba uses passwords specified in shares-admin by default. However, I want Samba to use users from /etc/passwd and passwords from /etc/shadow.
I managed to find many manuals on Google which are using /etc/pam.d/samba, but I do not understand them and I do not know if this is a good way to do this.

Is it correct to do it this way? If yes, then what should I write in /etc/pam.d/samba? If not, what is the correct way?

2 Answers 2

8

tl;dr: There is no correct way.

Samba does use accounts from /etc/passwd by default – it will pick up UIDs, home directories, and such. However, it cannot use /etc/shadow as it doesn't have sufficient information for SMB logins.

To authenticate via PAM (or /etc/shadow), the server must receive the plain-text password, which is then given to pam_unix, hashed, & the hash compared. This does not work with SMB.

On workgroup systems, SMB always uses the NTLMv2 protocol, which requires knowledge of the password's "NT hash" (unsalted MD4); it's impossible to derive that from the hashes contained in /etc/passwd, nor vice versa.

The only reasons Samba uses PAM are for authorization (access control), session setup (SELinux, logging…), and remote password change using smbpasswd.

2
  • 1
    So it is not possible to make Samba use Unix passwords from /etc/shadow?
    – Vilican
    Nov 12, 2015 at 13:01
  • 3
    Well the entire post basically says "no" Nov 12, 2015 at 13:04
0

I think that all that grawity says is correct. But I think that you can use /etc/shadow with pam_unix ONLY if you put encrypt passwords to no:

encrypt passwords = no;

And then change a registry on Windows to say it that not hash the password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .