[Samba] ldap passwd sync not working

[Jerome Tournier]

Le Wed, Feb 13, 2008 at 11:25:41PM -0200, Fabiano Caixeta Duarte a ecrit:
> I assume that your ldap sync passwd is enough (like I wanted to) because 
> smb.conf tells us that passwd chat is not used if unix password sync is set 
> to no.
>
> passwd chat (G)
>     Note that this parameter only is only used if the unix password sync 
> parameter is set to yes.

You must effectively be right. I'll try this evening to be sure.

> and it sort of worked. Both samba and unix passwords were changed, but 
> users get a message telling they don't have permission to change passwords. 
> In addition, it takes too long since user try the operation until system 
> respond.

Isn't it related to the workstation ? Have you tried with another ?
Have you informations in Samba log ?
Have you try 'access to * by * write' in slapd.conf (don't think it come
from here as passwords are changed, but maybe users don't have write access
to attributes such as shadowLastChange) ?

> Could you post (or send me in PVT) your smb.conf. I think this will help a 
> lot. Please inform either the version of OS, samba and openldap.

I tried on CentOS release 4.6 (Final)
samba-3.0.25b-1.el4_6.4
openldap-servers-2.2.13-8.el4_6.2
smbldap-tools-0.9.5-pre4 (but changing password work with latest
packages)

> I'm using FreeBSD 6.3 in both samba and openldap servers, Samba 3.0.26a and 
> openldap 2.3.38. Not using PAM.

Don't think PAM matter here.



My smb.conf:
# Global parameters
[global]
  workgroup = DOMSMB
  netbios name = PDC-SRV
  security = user
  enable privileges = yes
  server string = Samba Server %v
  encrypt passwords = Yes
  unix password sync = No
  ldap passwd sync = Yes
  passwd program = /usr/sbin/smbldap-passwd -u %u
  passwd chat = "Changing password for*\nNew password*" %n\n "*Retype new password*" %n\n"
  #passwd chat debug = Yes
  log level = 0
  syslog = 0
  log file = /var/log/samba/log.%U
  max log size = 100000
  time server = Yes
  socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
  mangling method = hash2
  Dos charset = 850
  Unix charset = ISO8859-1

  logon script = logon.bat
  logon drive = H:
  logon home =
  logon path =

  domain logons = Yes
  domain master = Yes
  os level = 65
  preferred master = Yes
  wins support = yes
  passdb backend = ldapsam:ldap://127.0.0.1/
  ldap admin dn = cn=Manager,dc=company,dc=com
  #ldap admin dn = cn=samba,ou=DSA,dc=company,dc=com
  ldap suffix = dc=company,dc=com
  ldap group suffix = ou=Groups
  ldap user suffix = ou=Users
  ldap machine suffix = ou=Computers
  #ldap idmap suffix = ou=Idmap
  add user script = /usr/sbin/smbldap-useradd -m "%u"
  #ldap delete dn = Yes
  delete user script = /usr/sbin/smbldap-userdel "%u"
  add machine script = /usr/sbin/smbldap-useradd -t 0 -w "%u"
  add group script = /usr/sbin/smbldap-groupadd -p "%g"
  #delete group script = /usr/sbin/smbldap-groupdel "%g"
  add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
  delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
  set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'

  # printers configuration
  printer admin = @"Print Operators"
  load printers = Yes
  create mask = 0640
  directory mask = 0750
  #force create mode = 0640
  #force directory mode = 0750
  nt acl support = No
  printing = cups
  printcap name = cups
  deadtime = 10
  guest account = nobody
  map to guest = Bad User
  dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
  show add printer wizard = yes
  ; to maintain capital letters in shortcuts in any of the profile folders:
  preserve case = yes
  short preserve case = yes
  case sensitive = no
  template shell = /bin/false
  winbind use default domain = no
[netlogon]
  path = /home/netlogon/
  browseable = No
  read only = yes


-- 
Jerome Tournier              
GPG key ID (pgp.mit.edu): 75FE0A51