I am setting up a home server with file sharing using Samba. It has XUbuntu 15.10.
Samba uses passwords specified in shares-admin by default. However, I want Samba to use users from /etc/passwd and passwords from /etc/shadow.
I managed to find many manuals on Google which are using /etc/pam.d/samba, but I do not understand them and I do not know if this is a good way to do this.

Is it correct to do it this way? If yes, then what should I write in /etc/pam.d/samba? If not, what is the correct way?


tl;dr: There is no correct way.

Samba does use accounts from /etc/passwd by default – it will pick up UIDs, home directories, and such. However, it cannot use /etc/shadow as it doesn't have sufficient information for SMB logins.

To authenticate via PAM (or /etc/shadow), the server must receive the plain-text password, which is then given to pam_unix, hashed, & the hash compared. This does not work with SMB.

On workgroup systems, SMB always uses the NTLMv2 protocol, which requires knowledge of the password's "NT hash" (unsalted MD4); it's impossible to derive that from the hashes contained in /etc/passwd, nor vice versa.

The only reasons Samba uses PAM are for authorization (access control), session setup (SELinux, logging…), and remote password change using smbpasswd.

  • 1
    So it is not possible to make Samba use Unix passwords from /etc/shadow? – Vilican Nov 12 '15 at 13:01
  • 3
    Well the entire post basically says "no" – grawity Nov 12 '15 at 13:04

I think that all that grawity says is correct. But I think that you can use /etc/shadow with pam_unix ONLY if you put encrypt passwords to no:

encrypt passwords = no;

And then change a registry on Windows to say it that not hash the password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.