Samba – How to run smbpasswd as root on AIX

aixpassword-managementsambasudo

I have Hitachi ID Password Manager (formerly p-synch) set up to change the password on (among other systems) an aix 6.1 server running samba. p-synch has the capability of executing additional commands by configuring "chat script" in the conf file. But p-sync does not send the old password and runs the script as the "p-sync admin ID".

Only root can change the samba password without the old password. I could get around this problem with sudo, but it is not currently installed on the aix system, and I want to make sure that sudo is the only option before installing and configuring it.

Any suggestions?

Best Answer

Sudo is by far the best solution for this, and if I recall from my days working in their support department, the documentation might actually call for that when you are using the legacy unix listener.

You could probably hack around it by changing the service account it uses to root, but that is a bit ugly, and running network listeners as root is undesirable.

You'd be better off using the newer SSH connector, assuming your support contract is current and you'd be willing to upgrade.

Related Solutions

AIX: how to change a password as root without setting the ADMCHG flag

man pwdadm
pwdadm -c

Samba Permissions – I’m going to throw it!

This might help. I do something similar, but only one share is open to the group's users. Other shares are read-only except for a single maintainer user. The [global] section of my smb.conf is almost identical to yours, except I don't use the force create/directory mode directives (in my case, they'd interfere with the other shares).

Here's the share definition:

[shared stuff]
        comment = blah, blah, etc
        path = /path/to/share
        write list = @sambagroup
        force group = +sambagroup
        read only = yes
        directory mask = 0775
        create mask = 0664
        guest ok = yes
        invalid users = root
        case sensitive = True
        default case = lower
        preserve case = yes
        short preserve case = yes

The important stuff here are these:

read only = yes -- by default, read only.
guest ok = yes -- guests can browse.
write list = @sambagroup -- Authenticated members of sambagroup can write.
force group = +sambagroup -- The + means that the force only applies to existing members of sambagroup. They're already the only ones who can write. I think, without the +, guest is given sambagroup credentials, which is not wanted (particularly with the write list directive above).
directory mask = 0775
create mask = 0664

These do exactly what you want yours to do: "drwxrwxr-x" on directories, "rwxrwxr-x" on files, and newly created files are owned by the user and sambagroup. The maintainers of the other shares get the same permissions as everyone else when working in shared stuff, and permissions & groups are normal when they work in the other shares.

My smb.conf has been working with only minor tweaks through several different versions of Samba, and currently is used with Samba 3.2.5. I never had it running on Ubuntu 8.04, but it ran on Ubuntu 7.04 for a long time before getting migrated to a recent Debian Lenny install.

Best Answer

Related Solutions

AIX: how to change a password as root without setting the ADMCHG flag

Samba Permissions – I’m going to throw it!

Related Topic