Samba File Server + PAM + Berkeley DB or Samba + PAM

authenticationpamsamba

I've set up VSFTPD with PAM and Berkeley DB before using this article. It's a great article and was really easy to walk through setting it up.

Now that I'm setting up Samba, I would like to do the same thing. I've seen information on using PAM with Samba, but nothing regarding Berkeley DB. If this is not possible, even just implementing PAM would be nice, however the articles out there aren't that easy to follow… for me anyways.

Can anyone create a quick tutorial here that I would be able to use to set up Samba + PAM + Berkeley DB or Samba + PAM?

Link to a good tutorial would work as well.

UPDATE:

I've set up Samba smb.conf using the following for the PAM config variables.

#security = user (Commented out, not sure if it should or shouldn't be with PAM)

pam password change = no 

obey pam restrictions = yes

encrypted passwords = no

created a samba-virtual-users.db file following the VSFTPD article using vusers.txt and db4.8_load -T -t hash -f vusers.txt samba-virtual-user.db

and set up /etc/pam.d/samba as the following:

#%PAM-1.0
auth       required     pam_userdb.so db=/etc/samba/samba-virtual-user
account    required     pam_userdb.so db=/etc/samba/samba-virtual-user
session    required     pam_loginuid.so

This setup seems to reflect fairly closely to the VSFTPD and I figured it should work. As long as samba is using PAM and the /etc/pam.d/samba file, which it does by default, then all the /etc/pam.d/samba file needs to do is declare the authorization method as using the .db file that was created.

Does this make sense to anyone? Can anyone see any reason why this isn't working? Tips for things to try maybe?

UPDATE:

The machine is showing on the network now, however I'm not able to log on. Is there any way to check the authentication method samba is using? Anything to do with verifying the setup or the settings it's currently using would be helpful…

Best Answer

Samba can not use PAM because the SMB protocol specific a (set of) incompatible hashes which can not be used with PAM (which requires the cleartext password, or certain hashed versions of the password).

This is what was explained to me a while ago when I tried to accomplish the same thing.

Related Topic