0

I installed a Debian server into a Windows controlled domain. I then tried to give to LDAP users from this domain access to my Debian via Samba, Winbind and Kerberos, which works almost perfectly.

In fact, my problem is that it looks like my pam checks aren't used at all (I made a call to pam_exec.so, which only calls a script to log data, in the /etc/pam.d/samba file AND in the /etc/pam.d/common-session, and none of them runs...)

So, if anyone could give me a hint on how could I troubleshoot this problem, that would be nice :)

0

I'm not sure I understand your question because it appears to miss the crucial bit—exactly when and in which cases you expect the PAM subsystem to kick in when the users access your Debian server via the SMB/CIFS protocol.

But nevertheless I'll give it a go—to cite the smb.conf(5) manual page:

obey pam restrictions (G)

When Samba 3.0 is configured to enable PAM support (i.e. --with-pam), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management.

Note that Samba always ignores PAM for authentication in the case of encrypt passwords = yes. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption.

Default: obey pam restrictions = no

So I guess you simply have samba not reaching for the PAM subsystem at all.

  • Well, thanks for your answer, even if it's just the documentation, looks like it was enough,... I forgot this line here => Note that Samba always ignores PAM for authentication in the case of encrypt passwords = yes. – hurin Apr 15 '16 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.