[Samba] pam_smbpass migrate & null passwords

Jaka Jančar jaka at kubje.org
Sun May 13 21:51:54 GMT 2007


I'm configuring Samba for Unix<->Samba account synchronization and have 
come across a situation which I like, but cannot explain with absolute 
certainty, and am therefore worried about security.

I have set the following:
(Debian uses a bit different structure, but I have expanded @includes in 
this email)

1) Samba -> Unix password sync

      unix password sync = yes
      pam password change = yes

      auth     requisite pam_unix.so nullok_secure
      auth     optional  pam_smbpass.so migrate
      account  required  pam_unix.so
      session  required  pam_unix.so

      (don't know why auth, account and session are @included in Debian
       by default, doesn't Samba only use pam for password updates?)

      password requisite pam_unix.so nullok obscure min=4 max=8 md5
      password required  pam_smbpass.so nullok use_authtok try_first_pass

2) Unix -> Samba password sync

      auth     requisite pam_unix.so nullok_secure
      auth     optional  pam_smbpass.so migrate

Now here's what concerns me.

If I do "smbpasswd -an someuser" to add a user with a null password, 
that user will not be able to set his password using smbpasswd, if he 
leaves the old password field empty. Is this observation correct?

Users also cannot smbpasswd -a(dd) themselves; this requires root 
access(direct access to smbpasswd file), right?

I understand that pam_smbpass's migrate option is meant for 
cleartext->encrypted password transition, and that makes perfect sense, 
since in that case the user (-> pam) knows the old password, and can 
just set the password again, this time using encryption.

The thing is, migrate does even more for me when I login using SSH!

It creates the samba user, if it doesn't exist, and it set's the user's 
Samba password, to his Unix password, regardless of what it is.

Now, while this seems very useful to me, I am worried because I haven't 
seen it used like this in any of the guides on the web.

I assume what's going on is that pam_smbpass is executed by SSH before 
dropping privileges, and it thus enables it to directly access the 
smbpasswd file. Is this what's going on here?

If it is, why is this a silent feature? I haven't seen it mentioned in 
anywhere. Are there any security considerations (besides any possible 
vulnerabilities in pam_smbpass itself)?



Jaka Jančar

More information about the samba mailing list