Re: smbk5pwd does not properly update sambaNTPassword and sambaLMPassword

[Buchan Milne <bgmilne@staff.telkomsa.net>]

On Wednesday, 30 September 2009 17:33:39 Scott Classen wrote:
> Hello
>
> I am running openldap 2.4.18 (BDB 4.8.24). Both of which I compiled
> from source.
> I compiled smbk5pwd with support ONLY for samba. I am using the samba
> that is distributed with CentOS 5.3 (3.0.33)

I use this module in my personal setup, and the last time I changed my 
password I have 2.4.17 installed, and my samba password works (and I am quite 
sure I didn't set it manually).

/me upgrades to 2.4.18 ...

On 2.4.18 (built from the same SRPM as the packages at 
http://staff.telkomsa.net/packages/rhel5/openldap/), it works for me:

[bgmilne@tiger ~]$ passwd
Changing password for user bgmilne.
Changing password for bgmilne.
Enter current password:
Enter login(LDAP) password:
New UNIX password:
Retype new UNIX password:
LDAP password information changed for bgmilne
passwd: all authentication tokens updated successfully.
[bgmilne@tiger ~]$ ldapwhoami -x -D 
uid=bgmilne,ou=People,dc=ranger,dc=dnsalias,dc=com -W
Enter LDAP Password:
dn:uid=bgmilne,ou=People,dc=ranger,dc=dnsalias,dc=com
[bgmilne@tiger ~]$ smbclient //localhost/bgmilne
Enter bgmilne's password:
Domain=[RANGER] OS=[Unix] Server=[Samba 3.4.1]
smb: \> 

> openldap does not crash or complain when it launches so I assume that:
>
> moduleload      /usr/local/libexec/smbk5pwd.la
>
> is at least loading up the module correctly.
>
> I have a user with the sambaSamAccount objectclass.
>
> I have configured PAM to change the LDAP userPassword when invoked
> from the command line with /usr/bin/passwd

What is pam_password set to in /etc/ldap.conf ?

Have you tried this by changing the password with ldappasswd instead (which we 
know will do an ldap password change exop, which pam_ldap should do only if 
pam_password is set to 'exop'.

> The userPassword hash gets successfully updated and the values of the
> sambaNTPassword and sambaLMPassword hashes are changed, but I am
> unable to authenticate as a samba user against these hashes... and
> they look sorta weird:
>
> 010000000000000090c9c94100000000
>
> when I would expect them to look more "complicated" like:
>
> 552902031BEDE9EFAAD3B435B51404EE
>
> Does this smell of a smbk5pwd bug/problem/misconfiguration or a samba/
> PAM one?

Could be a combination, this is only going to work if pam_password is set to 
exop, if smbk5pwd gets a password hash, it shouldn't be setting any other 
hashes.

Regards,
Buchan