Configuring Samba with LDAP authentication (on Centos/RHEL 7)

I already had a working 389 Directory Server with users, groups, DNS (PowerDNS) and DHCP entries in our company. During a time I’ve already configured most of the services (jabber, SSH, Intranet, SMTP and IMAP) to work with LDAP and allow users to authenticate with a single password to all services. Samba was the last service left to be configured this way.

While searching for a documentation I found out the official Samba documentation describing the process of configuring samba with LDAP is pretty brief and actually it took me couple of days to get the things configured. I also had to solve a few issues myself for which I couldn’t find a reasonable solution on Internet. Considering a lack of documentation describing the configuration of Samba with LDAP authentication I’d be curious how many people are actually using this. Few documentations I’ve found rather described the installation and configuration of LDAP server from scratch and populating LDAP with Samba data structure. This didn’t work for me as my LDAP was already loaded with structured data and I just wanted to configure Samba the way it’d use the current data from LDAP without the need to create a new structure within.

Here I am sharing my experience of configuring Samba authentication with LDAP on Centos 7 which is actually very straightforward once you what needs to be done.

Prerequisites:

• working LDAP server (I’m using 389 DS) with the following data structure:
  • ou=users,dc=company,dc=com containing users (each user entry consists of objectclass=inetOrgPerson,person,organizationalPrsion,posixAccount,shadowAccount,top)
  • ou=groups,dc=company,dc=com containing groups (we’re using objectclass posixGroup with objectclass groupofuniquenames)
• Centos 7 configured to work with LDAP users and groups (sssd configuration)
• Access to LDAP data for cn=manager (it’s better to use a specific LDAP role for Samba account with limited access. Manager role is used just for simplicity and once you Samba working this can be changed to anything else)

Process of Samba configuration to authenticate users with LDAP passwords:

• Install samba-4.6.2-12.el7 and smbldap-tools
• Configure Samba in /etc/samba/smb.conf:

 

• run command net getlocalsid to get the unique SID (Security IDentifier) for Samba
• configure acces to LDAP for smbldap-tools scripts in /etc/smbldap-tools/smbldap_bind.conf and also main configuration in /etc/smbldap-tools/smbldap.conf:

 

• You can try to run smbldap-userlist and smbldap-grouplist which should get you the list of users and groups from LDAP. The smbldap- commands are part of smbldap-tools package which comes with collection of scripts to add, modify and delete users and groups and to change Unix and Samba passwords. These scripts can (but doesn’t have to) be used to manage groups and users in your LDAP database.
• It’s also necessary to set the password for ‘ldap admin dn’  which is done by this command: smbpasswd -W. Samba stores the password to its DB file and uses it to access the LDAP data.
• RECOMENNDED for configuration on on empty LDAP database:
  If smbldap-tools package is configured correctly you should be able to run smbldap-populate which tries to create a necessary entries for Samba within LDAP. Once the data structure
• RECOMMENDED if you already have your users and groups in LDAP:
  If you don’t want to mess you LDAP up with plenty of unnecessary entries which would be created by smbldap-populate command you can run smbldap-populate -e output.dif and investigate the output dif to check out what’s supposed to be created.
  • I’ve found out smbldap-populate would create plenty of unnecesary entries for computers, groups and users. These are only changes needed to make Samba work with LDAP authentication:
    • run smbpasswd -a <username already in LDAP> – this command should add an additional LDAP objectClass sambaSAMAccount for a user. It also adds other attributes used by Samba to user account. You can check whether the account is visible for samba by “pdbedit -L“
    • if you run smbldap-populate -e output.dif and edit the output file you can see there should be sambaDomain object class created without the suffix path in LDAP. This object is important for Samba but it is also created automatically once Samba is started (systemctl start smb).
    • no changes are needed for groups. I didn’t need to add additional sambaGroupMapping objectClass. Once the user is part of the group and Centos 7 knows about it (e.g. id <user> lists the user in the group myusers) valid users = @myusers parameter in smb.conf works as expected and allows mapping the network drive for users in group myusers.

Posted in Fileserver, Server administration