What is pam_smb?

Features (stable version):

• Authenticates Linux users against SMB servers in user mode(95, NT, samba etc). Will not authenticate against share level systems.
• Compiles on Redhat Linux 4.2 and greater and any Linux with PAM support. Also compiles under Solaris 2.6.
• Developement version from CVS works on HP/UX 11 and FreeBSD 3.1
• Supports NT/Lanman encrypted passwords.
• Any service which uses PAM can authenticate against NT.
• Can setup to ignore lack of a local password entry when something else provides the users information such as RADIUS.

• Caching support.
• Username mapping support of Unix usernames to different NT usernames.

How to I get pam_smb?

Stable version

Developement version

How do I install it?

1. Untar the distribution and cd into the pam_smb directory.

2.  Run configure
   ./configure
   
   If you want to place the pamsmbd somewhere other than /usr/local/sbin
   ./configure --sbindir=/usr/sbin
   If you want to disable encrypted passwords you can run 
   ./configure --disable-encrypt-pass
   Developement Version only: 
   If you want to disable the daemon support you can use 
   ./configure --disable-use-daemon
   (this option produces the old style module that only reads the simple
   config file and does no extra features).
   

3. make
   Stable Version:
   You can copy the pam_smb_auth.so file to either /lib/security under Linux
   or /usr/lib/security under Solaris.
   Developement Version only: 
   make install
   This will install
   pam_smb_auth.so in /lib/security
   and 
   pamsmbd in usually /usr/local/sbin/pamsmbd
   

How do I Configure it?

1. pam.conf and /etc/pam.d configuration + command line parameters.
2. pam_smb configuration file.

   And for the developement version you also need to look at:

3. ntmap.db username mapping database
4. starting pamsmbd at boot time.

1) pam.conf, /etc/pam.d and command line options

The first thing that needs to be done is the pam module needs to be inserted into the pam system configuration files so that it is used for the services the administrator wishes. This procedure is slightly different under Linux and Solaris.

#%PAM-1.0
auth       required     /lib/security/pam_securetty.so
auth       required     /lib/security/pam_smb_auth.so
auth       required     /lib/security/pam_nologin.so
account    required     /lib/security/pam_pwdb.so
password   required     /lib/security/pam_cracklib.so
password   required     /lib/security/pam_pwdb.so shadow nullok use_authtok
session    required     /lib/security/pam_pwdb.so

For Solaris: You need to change the /etc/pam.conf other line to

other   auth required   /usr/lib/security/pam_smb_auth.so.1

	1. debug - This switches on syslog debugging of the module.
	2. use_first_pass - This is a standard PAM Module command line option.
	*********** N.B. Danger lurks here somewhere *****************
	3. nolocal - This allows authentication of a username/password
			pair which are not in the local password file.
		 Do not switch this on unless you know what you are at.
	**************************************************************

2) pam_smb.conf configuration file

The configuration file is stored in /etc/pam_smb.conf and it consists of three lines the first containing the NT DOMAIN to be logged on at and the second and third are the primary and secondary servers to use. Note these do not have to be NT server machines simply machines which can authenticate in the domain.

e.g. Here is my local copy: where I have server INTEL41 and INTEL42 and the domain is the UNDERGRADUATE domain :

UNDERGRADUATE
INTEL41
INTEL42

N.B. Ensure that the domain servers you are trying to authenticate against have valid DNS entries, or have entries in your /etc/hosts file.

3) ntmap.db username mapping database.

4) Starting pamsmbd at boot-time.

Where did pam_smb come from?

Andrew Morgan (morgan@transmeta.com) -- the Linux PAM project person, and writer of the pam_unix_auth.c module.

Richard Sharpe (sharpe@ns.aus.com) -- the author of smblib which I have used a lot of directly.

Christopher Burke (c.burke@mindware.com.au) -- the author of smb-NT-valid from which I took the validation routine.

The encryption routine is taken straight from samba and is copyright Andrew Tridgell (author of samba).

The username mapping code was written by Andrew Speer(aspeer@isolutions.com.au) for the original module only pam_smb, and I have tried to re-use as it for the client-server.

The caching idea came from David Jordan (david.jordan@webbins.co.uk), he wrote code to make this work under the original pam_smb, I have taken his ideas on board.

Thanks to Ville Warsta (vwarsta@stybba.ntc.nokia.com) for suppling the patches for HP/UX and FreeBSD 3.1.

Thanks to mirko.dziadzka@systor.com for finding guest login bug with NT.

Is there any known bugs in pam_smb?

Latest Information on the Development Version

Contact Information