Toon posts:

[Samba3 + OpenLDAP2] Kan password niet wijzigen

Pagina: 1
Acties:
  • 118 views sinds 30-01-2008
  • Reageer

zondag 13 juni 2004 17:31

Acties:
  • Tomaat
  • Registratie: November 2001
  • Laatst online: 19-02 14:23

Tomaat

Topicstarter
ik ben (nog steeds) bezig met een samba 3 server i.c.m. een OpenLDAP server voor de opslag van gebruikers e.d.

nu ben ik zover dat ik geruikers in de LDAP DB kan gooien, maar dat wil dus nog niet helemaal lukken.
code:
1
2
3
4
5
6
7
8

spinb03-vpc3:/etc/ldap# smbpasswd -a pieter
New SMB password:
Retype new SMB password:
ldapsam_modify_entry: LDAP Password could not be changed for user pieter: Internal (implementation specific) error
        entry modify failed
ldapsam_update_sam_account: failed to modify user with uid = pieter, error: entry modify failed (Success)
Failed to modify entry for user pieter.
Failed to modify password entry for user pieter

de user verschijnt vervolgens wel in users OU! en heeft een waarde in de password velden staan.

syslog heeft het volgende te melden
code:
1
2
3
4
5
6
7
8
9
10

Jun 13 17:10:04 spinb03-vpc3 slapd[1957]: conn=0 op=2 SRCH base="dc=bakmeel" scope=2 filter="(&(uid=pieter)(objectClass=sambaSamAccount))" 
Jun 13 17:10:04 spinb03-vpc3 slapd[1957]: conn=0 op=2 SRCH attr=uid uidNumber gidNumber homeDirectory sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime sambaLogoffTime sambaKickoffTime cn displayName sambaHomeDrive sambaHomePath sambaLogonScript sambaProfilePath description sambaUserWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword sambaNTPassword sambaDomainName objectClass sambaAcctFlags sambaMungedDial sambaBadPasswordCount sambaBadPasswordTime 
Jun 13 17:10:04 spinb03-vpc3 slapd[1957]: conn=0 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= 
Jun 13 17:10:04 spinb03-vpc3 slapd[1956]: conn=0 op=3 MOD dn="uid=pieter,ou=users,dc=bakmeel" 
Jun 13 17:10:04 spinb03-vpc3 slapd[1956]: conn=0 op=3 MOD attr=sambaPwdCanChange sambaPwdCanChange sambaLMPassword sambaLMPassword sambaNTPassword sambaNTPassword sambaPwdLastSet sambaPwdLastSet 
Jun 13 17:10:04 spinb03-vpc3 slapd[1956]: conn=0 op=3 RESULT tag=103 err=0 text= 
Jun 13 17:10:04 spinb03-vpc3 slapd[1956]: conn=0 op=3 RESULT tag=103 err=0 text= 
Jun 13 17:10:05 spinb03-vpc3 slapd[1957]: Entry (uid=pieter,ou=users,dc=bakmeel), attribute 'userPassword' not allowed 
Jun 13 17:10:05 spinb03-vpc3 slapd[1957]: entry failed schema check: attribute 'userPassword' not allowed 
Jun 13 17:10:05 spinb03-vpc3 slapd[1954]: conn=0 fd=13 closed

hier maak ik dus uit op dat de net aangemaakte gebruiker geen rechten heeft z'n eigen password te wijzigen. maar dat is vreemd, want ik heb in slapd.conf
code:
1
2

access  to *                                                                    
        by *            write
gezet, waardoor dus iedereen alles mag (of zie ik dat nu verkeerd :?)

smb.conf
code:
1
2
3
4
5
6
7
8
9
10
11
12
13

--snip--
    idmap uid = 15000-20000                                                     
    idmap gid = 15000-20000                                                     
                                                                                
    passdb backend = ldapsam:ldap://192.168.0.143                               
    ldap admin dn = "cn=admin,dc=bakmeel"                                       
    ldap suffix = dc=bakmeel                                                    
    ldap user suffix = ou=users                                                 
    ldap group suffix = ou=groups                                               
    ldap machine suffix = ou=computers                                          
    ldap idmap suffix = ou=users                                                
    ldap passwd sync = yes
--snap--

maandag 14 juni 2004 00:31

Acties:
  • Bas!
  • Registratie: April 2000
  • Laatst online: 30-11-2025

Bas!

Zit Userpasswd wel in je schema?
Zeg je wel dat account ook het posixaccount schema moet gebruiken en laat je die ook wel in in slapd?
Misschien even een samba-ldap howto raadplegen. Er zijn er een groot aantal

maandag 14 juni 2004 08:35

Acties:
  • _JGC_
  • Registratie: Juli 2000
  • Laatst online: 23:58

_JGC_

Hmm, ik lees LDAP, ik lees Samba, en dan ga jij smbpasswd gebruiken? :P

http://samba.idealx.org <-- smbldap-tools downloaden, ff wat configuratie doen, vervolgens kan je gewoon met die tools zowel unix als samba users aanmaken in je LDAP tree.

maandag 14 juni 2004 13:28

Acties:

Verwijderd

_JGC_ schreef op 14 juni 2004 @ 08:35:
Hmm, ik lees LDAP, ik lees Samba, en dan ga jij smbpasswd gebruiken? :P
En ik lees samba3 dus daar is niks mis mee. :)
http://samba.idealx.org <-- smbldap-tools downloaden, ff wat configuratie doen, vervolgens kan je gewoon met die tools zowel unix als samba users aanmaken in je LDAP tree.
Absoluut een aanrader ja, maar dat zal het probleem niet echt op gaan lossen ;)

Gezien de foutmelding acht ik de kans vrij groot dat de LDAP ACL's in de verkeerde volgorde staat.

maandag 14 juni 2004 17:25

Acties:
  • Tomaat
  • Registratie: November 2001
  • Laatst online: 19-02 14:23

Tomaat

Topicstarter
Ja van die scriptjes van Idealx had ik gehoord ja, en mijn volgende plan was ook deze te installeren, maar dat heeft weinig nut als ik nog niet eens 'met de hand' de userpasswords kan wijzigen.

het lijkt me wel (ja..verkeerd woord..) dat het attribuut userPassword in het schema zit aangezien dit schema (samba.schema) bij samba zat..

slapd.conf
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142

# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/samba.schema

# Schema check allows for forcing entries to
# match schemas for their objectClasses's
schemacheck     on

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile         /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile        /var/run/slapd.args

# Read slapd.conf(5) for possible values
loglevel        256

# Where the dynamically loaded modules are stored
modulepath      /usr/lib/ldap
moduleload      back_bdb

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend         bdb

#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend                <other>

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database        bdb

# The base of your directory in database #1
suffix          "dc=bakmeel"

# The root DN
rootdn          "cn=admin,dc=bakmeel"

# The root password
rootpw          {SSHA}S5GwIpgIDnyGUDM5sLwLJax/nyytj8d4

# Where the database file are physically stored for database #1
directory       "/var/lib/ldap"

# Indexing options for database #1
index cn,sn,uid,displayName     pres,sub,eq
index uidNumber,gidNumber       eq
index sambaSID                  eq
index sambaPrimaryGroupSID      eq
index sambaDomainName           eq
index objectClass               pres,eq
#index rid,primaryGroupID       eq
index default                   sub

# Save the time that the entry gets modified, for database #1
lastmod         on

# Where to store the replica logs for database #1
# replogfile    /var/lib/ldap/replog

#!!!!!!!!! CHANGE THIS !!!!!!!!!!
#access to dn=".*dc=bakmeel"
#       by self                 write
#       by *                    read

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below

#!!!!!!!!!!!!
# These access lines apply to database #1 only
#access to attribute=userPassword
#        by dn="cn=admin,dc=bakmeel" write
#        by anonymous auth
#        by self write
#        by * none
#!!!!!!!!!!!

# Ensure read access to the base for things like
# supportedSASLMechanisms.  Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work 
# happily.

#!!!!!!!!!!
#access to dn.base="" by * read
#!!!!!!!!!!

# The admin dn has full write access, everyone else
# can read everything.

#!!!!!!!!!!
#access to *
#        by dn="cn=admin,dc=bakmeel" write
#        by * read
#!!!!!!!!!!

# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
#        by dn="cn=admin,dc=bakmeel" write
#        by dnattr=owner write

#!!!!!!!!!!
#access to attrs=SambaLMPassword,SambaNTPassword
#       by dn="cn=admin,ou=users,dc=bakmeel" write
#       by * none
#!!!!!!!!!!

#######################################################################
# Specific Directives for database #2, of type 'other' (can be bdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database        <other>

# The base of your directory for database #2
#suffix         "dc=debian,dc=org"

zaterdag 3 juli 2004 16:08

Acties:
  • Tomaat
  • Registratie: November 2001
  • Laatst online: 19-02 14:23

Tomaat

Topicstarter
Ok, ik heb nu de idealx scripts geinstalleerd maar het nog steeds niet helemaal lukken..

mijn slapd.conf ziet er zo uit:
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/samba.schema

# Schema check allows for forcing entries to
# match schemas for their objectClasses's
schemacheck     on

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile         /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile        /var/run/slapd.args

# Read slapd.conf(5) for possible values
loglevel        0

# Where the dynamically loaded modules are stored
modulepath      /usr/lib/ldap
moduleload      back_bdb

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend         bdb

#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend                <other>

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database        bdb

# The base of your directory in database #1
suffix          "dc=bakmeel"

# The root DN
rootdn          "cn=admin,dc=bakmeel"

# The root password
rootpw          {SSHA}S5GwIpgIDnyGUDM5sLwLJax/nyytj8d4

# Where the database file are physically stored for database #1
directory       "/var/lib/ldap"

# Indexing options for database #1
index           objectClass eq

index cn        pres,sub,eq
index sn        pres,sub,eq
# required to support pdb_getsampwnam
index uid       pres,sub,eq
# required to support pdb_getsambapwrid()
index displayName       pres,sub,eq

index sambaSID          eq
index sambaPrimaryGroupSID      eq
index sambaDomainName           eq
index default           sub

# Save the time that the entry gets modified, for database #1
lastmod         on

# Where to store the replica logs for database #1
# replogfile    /var/lib/ldap/replog

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only

access to attrs=userPassword,SambaLMPassword,SambaNTPassword
        by dn="cn=admin,dc=bakmeel" write
        by self write
        by anonymous auth
        by * none

access to attrs=uid,uidNumber,gidNumber,homeDirectory
        by * read

# Ensure read access to the base for things like
# supportedSASLMechanisms.  Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work 
# happily.
#access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=admin,dc=bakmeel" write
        by self write
        by * read

# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
#        by dn="cn=admin,dc=spindent" write
#        by dnattr=owner write

#######################################################################
# Specific Directives for database #2, of type 'other' (can be bdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database        <other>

# The base of your directory for database #2
#suffix         "dc=debian,dc=org"

En mijn smb.conf zo:
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

[global]
    netbios name = spisvr03
    server string = "Test Enviorment"
    workgroup = bakmeel
    debug level = 3
    log file = /var/log/samba/%m.log
    max log size = 1024
    socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
    name resolve order = lmhosts host wins bcast
    os level = 255
    security = user
    bind interfaces only = yes
    interfaces = eth0

# Functions
#   preferred master = yes
    domain master = yes
    local master = yes
    domain logons = yes
    wins support = yes
    time server = yes

# Password
#    smb passwd file = /etc/samba/smbpasswd
    passdb backend = ldapsam:ldap://127.0.0.1/
    passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updated*
    passwd program = /usr/local/sbin/smbldap-passwd %u
    unix password sync = yes
    pam password change = yes
    encrypt passwords = true
    min passwd length = 3
    obey pam restrictions = no

# LDAP
    ldap passwd sync = yes
    mangling method = hash2
    ldap admin dn = cn=admin,dc=bakmeel
    ldap suffix = dc=bakmeel
    ldap group suffix = ou=groups
    ldap user suffix = ou=users
    ldap machine suffix = ou=computers
    ldap idmap suffix = ou=users
    ldap filter = (&(uid=%u)(objectclass=sambaSamAccount))

    add user script = /usr/local/sbin/smbldap-useradd -m "%u"
    ldap delete dn = yes
    #delete user script = /usr/local/sbin/smbldap-userdel "%u"
    add machine script = /usr/local/sbin/smbldap-useradd -w "%u"
    add group script = /usr/local/sbin/smbldap-groupadd -p "%g"
    #delete group script = /usr/local/sbin/smbldap-groupdel "%g"
    add user to group script = /usr/local/sbin/smbldap-groupmod -m "%u" "%g"
    delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g"
    set primary group script = /usr/local/sbin/smbldap-usermod -g "%g" "%u"

# Logon
    logon path = c:\Documents and Settings\%u.bakmeel
    logon drive = H:
    logon home = \\bakmeel\%u
    logon script = logon.bat

# Printer
    printer admin = @"Print Operators"
    printcap = cups
    printing = cups

# Other
    root = Administrator pieter
    hide files = /Thumbs.db/.DS_Store/

[netlogon]
    path = /netlogon
    comment = Netlogon
    read only = yes
    create mask = 0666
    directory mask = 0777
    write list = @administrators, root
    
[homes]
    comment = User home directories
    create mask = 0600
    directory mask = 0700
    writable = yes
    hide dot files = yes    

[data]
    comment = Data partition
    path = /data
    create mask = 0666
    directory mask = 0777
    read only = yes
    write list = @administrators, root
    guest ok = yes

Als ik middels
code:
1

smbpasswd -a alok
een gebruiker 'alok' probeer toe te voegen krijg ik weer deze melding
code:
1
2
3
4
5
6
7
8
9

spisvr03:/etc/samba# smbpasswd -a alok
New SMB password:
Retype new SMB password:
ldapsam_modify_entry: LDAP Password could not be changed for user alok: Internal (implementation specific) error
        entry modify failed
ldapsam_add_sam_account: failed to modify/add user with uid = alok (dn = uid=alok,ou=users,dc=bakmeel)
Failed to add entry for user alok.
Failed to modify password entry for user alok
spisvr03:/etc/samba#

Kijk ik vervolgens in de DB, dan staat alok er dus wel gewoon in inclusief het ge'encrypte wachtwoord!
Als ik vervolgens vanaf een Windows 2000 machine als gebruiker 'alok' met bijbehorend wachtwoord probeer een share op de server te benaderen..werkt het gewoon!! Hoe kan dit :?
Pagina: 1
Reageer

Apple iPhone 17 LG OLED evo G5 Google Pixel 10 Samsung Galaxy S25 Star Wars: Outlaws Nintendo Switch 2 Apple AirPods Pro (2e generatie) Sony PlayStation 5 Pro

Tweakers is onderdeel van DPG Media B.V.
Alle rechten voorbehouden - Auteursrecht © 1998 - 2026 • Hosting door TrueFullstaq