Account Information Databases in Samba-3

This chapter is from the book

Official Samba-3 HOWTO and Reference Guide, The, 2nd Edition

Learn More Buy

This chapter is from the book

This chapter is from the book 

Official Samba-3 HOWTO and Reference Guide, The, 2nd Edition

Learn More Buy

10.4 Password Backends

Samba offers the greatest flexibility in backend account database design of any SMB/CIFS server technology available today. The flexibility is immediately obvious as one begins to explore this capability.

It is possible to specify not only multiple password backends, but even multiple backends of the same type. For example, to use two different tdbsam databases:

passdb backend = tdbsam : / etc /samba/ passdb . tdb tdbsam : / etc / samba/ old—passdb . tdb

What is possible is not always sensible. Be careful to avoid complexity to the point that it may be said that the solution is "too clever by half!"

10.4.1 Plaintext

Older versions of Samba retrieved user information from the UNIX user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd. When password encryption is disabled, no SMB-specific data is stored at all. Instead, all operations are conducted via the way that the Samba host OS will access its /etc/passwd database. On most Linux systems, for example, all user and group resolution is done via PAM.

10.4.2 smbpasswd: Encrypted Password Database

Traditionally, when configuring encrypt passwords = yes in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account flags have been stored in the smbpasswd(5) file. There are several disadvantages to this approach for sites with large numbers of users (counted in the thousands).

• The first problem is that all lookups must be performed sequentially. Given that there are approximately two lookups per domain logon (one during intial logon validation and one for a session connection setup, such as when mapping a network drive or printer), this is a performance bottleneck for large sites. What is needed is an indexed approach such as that used in databases.
• The second problem is that administrators who desire to replicate an smbpasswd file to more than one Samba server are left to use external tools such as rsync(1) and ssh(1) and write custom, in-house scripts.
• Finally, the amount of information that is stored in an smbpasswd entry leaves no room for additional attributes such as a home directory, password expiration time, or even a relative identifier (RID).

As a result of these deficiencies, a more robust means of storing user attributes used by smbd was developed. The API that defines access to user accounts is commonly referred to as the samdb interface (previously, this was called the passdb API and is still so named in the Samba source code trees).

Samba provides an enhanced set of passdb backends that overcome the deficiencies of the smbpasswd plaintext database. These are tdbsam, ldapsam, and xmlsam. Of these, ldapsam will be of most interest to large corporate or enterprise sites.

10.4.3 tdbsam

Samba can store user and machine account data in a "TDB" (trivial database). Using this backend does not require any additional configuration. This backend is recommended for new installations that do not require LDAP.

As a general guide, the Samba Team does not recommend using the tdbsam backend for sites that have 250 or more users. Additionally, tdbsam is not capable of scaling for use in sites that require PDB/BDC implementations that require replication of the account database. Clearly, for reason of scalability, the use of ldapsam should be encouraged.

The recommendation of a 250-user limit is purely based on the notion that this would generally involve a site that has routed networks, possibly spread across more than one physical location. The Samba Team has not at this time established the performance-based scalability limits of the tdbsam architecture.

There are sites that have thousands of users and yet require only one server. One site recently reported having 4,500 user accounts on one UNIX system and reported excellent performance with the tdbsam passdb backend. The limitation of where the tdbsam passdb backend can be used is not one pertaining to a limitation in the TDB storage system, it is based only on the need for a reliable distribution mechanism for the SambaSAMAccount backend.

10.4.4 ldapsam

There are a few points to stress that the ldapsam does not provide. The LDAP support referred to in this documentation does not include:

• A means of retrieving user account information from a Windows 200x Active Directory server.
• A means of replacing /etc/passwd.

The second item can be accomplished by using LDAP NSS and PAM modules. LGPL versions of these libraries can be obtained from PADL Software ^[3] . More information about the configuration of these packages may be found in LDAP, System Administration by Gerald Carter, Chapter 6, Replacing NIS" ^[4] .

This document describes how to use an LDAP directory for storing Samba user account information traditionally stored in the smbpasswd(5) file. It is assumed that the reader already has a basic understanding of LDAP concepts and has a working directory server already installed. For more information on LDAP architectures and directories, please refer to the following sites:

• OpenLDAP ^[5]
• Sun One Directory Server ^[6]
• Novell eDirectory ^[7]
• IBM Tivoli Directory Server ^[8]
• Red Hat Directory Server ^[9]
• Fedora Directory Server ^[10]

Two additional Samba resources that may prove to be helpful are:

• The Samba-PDC-LDAP-HOWTO ^[11] maintained by Ignacio Coupeau.
• The NT migration scripts from IDEALX ^[12] that are geared to manage users and groups in such a Samba-LDAP domain controller configuration. Idealx also produced the smbldap-tools and the Interactive Console Management tool.

10.4.4.1 Supported LDAP Servers

The LDAP ldapsam code was developed and tested using the OpenLDAP 2.x server and client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs. These should not be hard to fix. Please submit fixes via the process outlined in Chapter 39, "Reporting Bugs".

Samba is capable of working with any standards-compliant LDAP server.

10.4.4.2 Schema and Relationship to the RFC 2307 posixAccount

Samba-3.0 includes the necessary schema file for OpenLDAP 2.x in the examples/LDAP/ samba.schema directory of the source code distribution tarball. The schema entry for the sambaSamAccount ObjectClass is shown here:

ObjectClass (1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY
    DESC 'Samba-3.0 Auxiliary SAM Account'
    MUST ( uid $ sambaSID )
    MAY  ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $
          sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $
          sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $
          displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $
          sambaProfilePath $ description $ sambaUserWorkstations $
          sambaPrimaryGroupSID $ sambaDomainName ))

The samba.schema file has been formatted for OpenLDAP 2.0/2.1. The Samba Team owns the OID space used by the above schema and recommends its use. If you translate the schema to be used with Netscape DS, please submit the modified schema file as a patch to <jerry@samba.org> ^[13] .

Just as the smbpasswd file is meant to store information that provides information additional to a user's /etc/passwd entry, so is the sambaSamAccount object meant to supplement the UNIX user account information. A sambaSamAccount is an AUXILIARY ObjectClass, so it can be used to augment existing user account information in the LDAP directory, thus providing information needed for Samba account handling. However, there are several fields (e.g., uid) that overlap with the posixAccount ObjectClass outlined in RFC 2307. This is by design.

In order to store all user account information (UNIX and Samba) in the directory, it is necessary to use the sambaSamAccount and posixAccount ObjectClasses in combination. However, smbd will still obtain the user's UNIX account information via the standard C library calls, such as getpwnam(). This means that the Samba server must also have the LDAP NSS library installed and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure.

10.4.4.3 OpenLDAP Configuration

To include support for the sambaSamAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory. The samba.schema file can be found in the directory examples/LDAP in the Samba source distribution.

root# cp samba.schema /etc/openldap/schema/

Next, include the samba.schema file in slapd.conf. The sambaSamAccount object contains two attributes that depend on other schema files. The uid attribute is defined in cosine. schema and the displayName attribute is defined in the inetorgperson.schema file. Both of these must be included before the samba.schema file.

## /etc/openldap/slapd.conf

## schema files (core.schema is required by default)
include              /etc/openldap/schema/core.schema

## needed for sambaSamAccount
include            /etc/openldap/schema/cosine.schema
include            /etc/openldap/schema/inetorgperson.schema
include            /etc/openldap/schema/nis.schema
include            /etc/openldap/schema/samba.schema
....

It is recommended that you maintain some indices on some of the most useful attributes, as in the following example, to speed up searches made on sambaSamAccount ObjectClasses (and possibly posixAccount and posixGroup as well):

# Indices to maintain
## required by OpenLDAP
index objectclass             eq

index cn                      pres,sub,eq
index sn                      pres,sub,eq
## required to support pdb_getsampwnam
index uid                     pres,sub,eq
## required to support pdb_getsambapwrid()
index displayName             pres,sub,eq

## uncomment these if you are storing posixAccount and
## posixGroup entries in the directory as well
##index uidNumber               eq
##index gidNumber               eq
##index memberUid               eq

index   sambaSID             eq
index   sambaPrimaryGroupSID eq
index   sambaDomainName      eq
index   default              sub

Create the new index by executing:

root# ./sbin/slapindex -f slapd.conf

Remember to restart slapd after making these changes:

root# /etc/init.d/slapd restart

10.4.4.4 Initialize the LDAP Database

Before you can add accounts to the LDAP database, you must create the account containers that they will be stored in. The following LDIF file should be modified to match your needs (DNS entries, and so on):

# Organization for Samba Base
dn: dc=quenya,dc=org
objectclass: dcObject
objectclass: organization
dc: quenya
o: Quenya Org Network
description: The Samba-3 Network LDAP Example

# Organizational Role for Directory Management
dn: cn=Manager,dc=quenya,dc=org
objectclass: organizationalRole
cn: Manager
description: Directory Manager

# Setting up container for Users OU
dn: ou=People,dc=quenya,dc=org
objectclass: top
objectclass: organizationalUnit
ou: People

# Setting up admin handle for People OU
dn: cn=admin,ou=People,dc=quenya,dc=org
cn: admin
objectclass: top
objectclass: organizationalRole
objectclass: simpleSecurityObject
userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz

# Setting up container for groups
dn: ou=Groups,dc=quenya,dc=org
objectclass: top
objectclass: organizationalUnit
ou: Groups

# Setting up admin handle for Groups OU
dn: cn=admin,ou=Groups,dc=quenya,dc=org
cn: admin
objectclass: top
objectclass: organizationalRole
objectclass: simpleSecurityObject
userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz

# Setting up container for computers
dn: ou=Computers,dc=quenya,dc=org
objectclass: top
objectclass: organizationalUnit
ou: Computers

# Setting up admin handle for Computers OU
dn: cn=admin,ou=Computers,dc=quenya,dc=org
cn: admin
objectclass: top
objectclass: organizationalRole
objectclass: simpleSecurityObject
userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz

The userPassword shown above should be generated using slappasswd.

The following command will then load the contents of the LDIF file into the LDAP database.

$ slapadd -v -l initldap.dif

Do not forget to secure your LDAP server with an adequate access control list as well as an admin password.

root# smbpasswd -w secret

10.4.4.5 Configuring Samba

The following parameters are available in smb.conf only if your version of Samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found. The best method to verify that Samba was built with LDAP support is:

root# smbd -b | grep LDAP
   HAVE_LDAP_H
   HAVE_LDAP
   HAVE_LDAP_DOMAIN2HOSTLIST
   HAVE_LDAP_INIT
   HAVE_LDAP_INITIALIZE
   HAVE_LDAP_SET_REBIND_PROC
   HAVE_LIBLDAP
   LDAP_SET_REBIND_PROC_ARGS

If the build of the smbd command you are using does not produce output that includes HAVE_LDAP_H it is necessary to discover why the LDAP headers and libraries were not found during compilation.

LDAP-related smb.conf options include these:

         passdb backend = ldapsam : url
         ldap admin dn
         ldap delete dn
         ldap filter
         ldap group suffix
         ldap idmap suffix
         ldap machine suffix
         ldap passwd sync
         ldap ssl
         ldap suffix
         ldap user suffix
         ldap replication sleep
         ldap timeout
         ldap page size

These are described in the smb.conf man page and so are not repeated here. However, an example for use with an LDAP directory is shown in Example 10.4.1

Example 10.4.1. Configuration with LDAP

[global]
        security = user
        encrypt passwords = yes
        netbios name = MORIA
        workgroup = NOLDOR
# LDAP related parameters :
# Define the DN used when binding to the LDAP servers.
# The password for this DN is not stored in smb.conf
# Set it using 'smbpasswd —w secret' to store the
# passphrase in the secrets.tdb file.
# If the "ldap admin dn" value changes, it must be reset.
        ldap admin dn = "cn=Manager, dc=quenya, dc=org"
# SSL directory connections can be configured by:
# ('off', 'starttls', or 'on' (default) )
        ldap ssl = start tls
# syntax: passdb backend = ldapsam:ldap://server—name [:port]
        passdb backend = ldapsam:ldap:// frodo.quenya.org
# smbpasswd —x delete the entire dn—entry
        ldap delete dn = no
# The machine and user suffix are added to the base suffix
# wrote WITHOUT quotes. NULL suffixes by default
        ldap user suffix = ou=People
        ldap group suffix = ou=Groups
        ldap machine suffix = ou=Computers
# Trust UNIX account information in LDAP
# (see the smb.conf man page for details)
# Specify the base DN to use when searching the directory
        ldap suffix = dc=quenya , dc=org

10.4.4.6 Accounts and Groups Management

Because user accounts are managed through the sambaSamAccount ObjectClass, you should modify your existing administration tools to deal with sambaSamAccount attributes.

Machine accounts are managed with the sambaSamAccount ObjectClass, just like user accounts. However, it is up to you to store those accounts in a different tree of your LDAP namespace. You should use "ou=Groups,dc=quenya,dc=org" to store groups and "ou=People,dc=quenya,dc=org" to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/openldap/sldap.conf configuration file).

In Samba-3, the group management system is based on POSIX groups. This means that Samba makes use of the posixGroup ObjectClass. For now, there is no NT-like group system management (global and local groups). Samba-3 knows only about Domain Groups and, unlike MS Windows 2000 and Active Directory, Samba-3 does not support nested groups.

10.4.4.7 Security and sambaSamAccount

There are two important points to remember when discussing the security of sambaSAMAccount entries in the directory.

• Never retrieve the SambaLMPassword or SambaNTPassword attribute values over an unencrypted LDAP session.
• Never allow non-admin users to view the SambaLMPassword or SambaNTPassword attribute values.

These password hashes are clear-text equivalents and can be used to impersonate the user without deriving the original clear-text strings. For more information on the details of LM/NT password hashes, refer to Chapter 10, "Account Information Databases".

To remedy the first security issue, the ldap ssl smb.conf parameter defaults to require an encrypted session (ldap ssl = on) using the default port of 636 when contacting the directory server. When using an OpenLDAP server, it is possible to use the StartTLS LDAP extended operation in the place of LDAPS. In either case, you are strongly encouraged to use secure communications protocols (so do not set ldap ssl = off).

Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS extended operation. However, the OpenLDAP library still provides support for the older method of securing communication between clients and servers.

The second security precaution is to prevent non-administrative users from harvesting password hashes from the directory. This can be done using the following ACL in slapd.conf:

## allow the "ldap admin dn" access, but deny everyone else
access to attrs=SambaLMPassword,SambaNTPassword
     by dn="cn=Samba Admin,ou=People,dc=quenya,dc=org" write
     by * none

10.4.4.8 LDAP Special Attributes for sambaSamAccounts

The sambaSamAccount ObjectClass is composed of the attributes shown in next tables: Table 10.2, and Table 10.3.

Table 10.2. Attributes in the sambaSamAccount ObjectClass (LDAP), Part A

Table 10.3. Attributes in the sambaSamAccount ObjectClass (LDAP), Part B

The majority of these parameters are only used when Samba is acting as a PDC of a domain (refer to Chapter 4, "Domain Control", for details on how to configure Samba as a PDC). The following four attributes are only stored with the sambaSamAccount entry if the values are non-default values:

• sambaHomePath
• sambaLogonScript
• sambaProfilePath
• sambaHomeDrive

These attributes are only stored with the sambaSamAccount entry if the values are non-default values. For example, assume MORIA has now been configured as a PDC and that logon home = \\%L\%u was defined in its smb.conf file. When a user named "becky" logs on to the domain, the logon home string is expanded to \\MORIA\becky. If the smbHome attribute exists in the entry "uid=becky,ou=People,dc=samba,dc=org", this value is used. However, if this attribute does not exist, then the value of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is something other than the default (e.g., \\MOBY\becky).

10.4.4.9 Example LDIF Entries for a sambaSamAccount

The following is a working LDIF that demonstrates the use of the SambaSamAccount ObjectClass:

dn: uid=guest2, ou=People,dc=quenya,dc=org
sambaLMPassword: 878D8014606CDA29677A44EFA1353FC7
sambaPwdMustChange: 2147483647
sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-513
sambaNTPassword: 552902031BEDE9EFAAD3B435B51404EE
sambaPwdLastSet: 1010179124
sambaLogonTime: 0
objectClass: sambaSamAccount
uid: guest2
sambaKickoffTime: 2147483647
sambaAcctFlags: [UX         ]
sambaLogoffTime: 2147483647
sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5006
sambaPwdCanChange: 0

The following is an LDIF entry for using both the sambaSamAccount and posixAccount ObjectClasses:

dn: uid=gcarter, ou=People,dc=quenya,dc=org
sambaLogonTime: 0
displayName: Gerald Carter
sambaLMPassword: 552902031BEDE9EFAAD3B435B51404EE
sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-1201
objectClass: posixAccount
objectClass: sambaSamAccount
sambaAcctFlags: [UX         ]
userPassword: {crypt}BpM2ej8Rkzogo
uid: gcarter
uidNumber: 9000
cn: Gerald Carter
loginShell: /bin/bash
logoffTime: 2147483647
gidNumber: 100
sambaKickoffTime: 2147483647
sambaPwdLastSet: 1010179230
sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5004
homeDirectory: /home/moria/gcarter
sambaPwdCanChange: 0
sambaPwdMustChange: 2147483647
sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7

10.4.4.10 Password Synchronization

Samba-3 and later can update the non-Samba (LDAP) password stored with an account. When using pam_ldap, this allows changing both UNIX and Windows passwords at once.

The ldap passwd sync options can have the values shown in Table 10.4.

Table 10.4. Possible ldap passwd sync Values

More information can be found in the smb.conf man page.

10.4.4.11 Using OpenLDAP Overlay for Password Syncronization

Howard Chu has written a special overlay called smbk5pwd. This tool modifies the Samba NTPassword, SambaLMPassword and Heimdal hashes in an OpenLDAP entry when an LDAP_EXOP_X_MODIFY_PASSWD operation is performed.

The overlay is shipped with OpenLDAP-2.3 and can be found in the contrib/slapd-modules/smbk5pwd subdirectory. This module can also be used with OpenLDAP-2.2.

10.4.5 MySQL

Every so often someone comes along with what seems (to them) like a great new idea. Storing user accounts in an SQL backend is one of them. Those who want to do this are in the best position to know what the specific benefits are to them. This may sound like a cop-out, but in truth we cannot document every little detail of why certain things of marginal utility to the bulk of Samba users might make sense to the rest. In any case, the following instructions should help the determined SQL user to implement a working system. These account storage methods are not actively maintained by the Samba Team.

10.4.5.1 Creating the Database

You can set up your own table and specify the field names to pdb_mysql (see Table 10.6 for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump contains the correct queries to create the required tables. Use the command:

root# mysql -uusername -hhostname -ppassword    databasename < /path/to/samba/examples/pdb/mysql/mysql.dump

10.4.5.2 Configuring

This plug-in lacks some good documentation, but here is some brief information. Add the following to the passdb backend variable in your smb.conf:

passdb backend = [other—plugins] mysql:identifier [other—plugins]

The identifier can be any string you like, as long as it does not collide with the identifiers of other plugins or other instances of pdb_mysql. If you specify multiple pdb_mysql.so entries in passdb backend, you also need to use different identifiers.

Additional options can be given through the smb.conf file in the [global] section. Refer to Table 10.5.

Table 10.5. Basic smb.conf Options for MySQL passdb Backend

Names of the columns are given in Table 10.6. The default column names can be found in the example table dump.

Table 10.6. MySQL field names for MySQL passdb backend

You can put a colon (:) after the name of each column, which should specify the column to update when updating the table. You can also specify nothing behind the colon, in which case the field data will not be updated. Setting a column name to NULL means the field should not be used.

Example 10.4.2 is shown in Example 10.4.2.

10.4.5.3 Using Plaintext Passwords or Encrypted Password

I strongly discourage the use of plaintext passwords; however, you can use them.

If you would like to use plaintext passwords, set 'identifier:lanman pass column' and 'identifier:nt pass column' to 'NULL' (without the quotes) and 'identifier:plain pass column' to the name of the column containing the plaintext passwords.

If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default.

Example 10.4.2. Example Configuration for the MySQL passdb Backend

[global]
          passdb backend = mysql:foo
          foo:mysql user = samba
          foo:mysql password = abmas
          foo:mysql database = samba
# domain name is static and can't be changed
          foo:domain column = 'MYWORKGROUP':
# The fullname column comes from several other columns
          foo:fullname column = CONCAT( firstname, ' ' , surname):
# Samba should never write to the password columns
          foo:lanman pass column = lm_pass:
          foo:nt pass column = nt_pass:
# The unknown 3 column is not stored
          foo:unknown 3 column = NULL

10.4.5.4 Getting Non-Column Data from the Table

It is possible to have not all data in the database by making some "constant."

For example, you can set 'identifier:fullname column' to something like CONCAT(Firstname,' ',Surname)

Or, set 'identifier:workstations column' to: NULL. See the MySQL documentation for more language constructs.

10.4.6 XML

This module requires libxml2 to be installed.

The usage of pdb_xml is fairly straightforward. To export data, use:

$ pdbedit -e xml:filename

where filename is the name of the file to put the data in.

To import data, use: $ pdbedit -i xml:filename