Diff for "SambaPasswordSync"

This page describes how to "fix" Fedora core installations so samba passwords are correctly updated at the same time as system passwords.

Note: this is still not perfect. Configuration on Caesars is ongoing. stay tuned.

Note: The addusr and ccpass script will now update the Linux and SAMBA password for you in one go.

For more information on pam_smbpass see http://www.samba.org/samba/docs/man/Samba3-HOWTO/pam.html

The configuration files controlling unix authentication and password updates reside under /etc/pam.d/

The changes required to update samba passwords are in /etc/pam.d/system-auth (system-auth-ac under FC5)

Before changes, this file will look like:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so
account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so
password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so
session     required      pam_limits.so
session     required      pam_unix.so

We need to add the following line into the file BEFORE pam_unix.so

Make sure you match any style differences with the original. (e.g. FC3 prepends /lib/security/$ISA/)

password    sufficient    pam_smbpass.so nullok use_authtok try_first_pass

The password section of the file should then appear similar to below:

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_smbpass.so nullok use_authtok try_first_pass
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

If enabling users to set stupid passwords is desired (this is STRONGLY discouraged or the machine could be hacked) then the pam_cracklib line can be commented out.