samba - Apr 2005 - Unified authentication

Greetings.  Apologies if this has been asked before.  I've gone 
through Google and the archives to no avail.

      I am seeking to implement a unified authentication mechanism for a 
small(Less than 50 users) setup.  I've been trying to wrap my head 
around PAM and SAMBA.  It almost seems like it can be done, but I can't 
quite convince myself.

      Most of my users are Windows types.  I want to provide domain 
authentication for these users.  Using the same auth DB, I want to be 
able to authenticate some users to a VPN server using RADIUS.  All with 
teh same user/password combo.

      I've seen glimmers and hints in various doc I've read that it can 
be done.  Maybe using PAM to force radius to use the smbpass.so module?

      Another thought I had was to use MySQL as the backend.  But then, 
I'm not sure that the passwords would be compatible.  They're both 
one-way hashs using different algorithms, right?

      I could use LDAP, but it seems like overkill.  So is MySQL, 
really, but I can use the server for other tasks later.

      Any thoughts?

Chris...

If by unified authentication you mean just domain logons and vpn logons,
and by vpn logons you mean IPSEC/L2TP, then yes it can be done.
This site has lots of info on setting up the ipsec/l2tp end:
http://www.jacco2.dds.nl/networking/freeswan-l2tp.html
>      Most of my users are Windows types.  I want to provide domain
> authentication for these users.  Using the same auth DB, I want to be
> able to authenticate some users to a VPN server using RADIUS.  All with
> teh same user/password combo.
Do you have to use radius?

We use samba as a dc with an ldapsam, freeradius using ldap auth(looking
up sambaNTPassword), openswan using x509, l2tpd and ppp. ppp uses a
radius plugin. Authentication is done using MSCHAPV2.
We have about 700 users, so ldap and radius are good choices. We also
have some wireless access points that use radius to authenticate
clients. For 50 users, yes it is probably overkill and a pita to set up.

Pam probably won't work unless you use plain text authentication.(PAP)
That means configuring all you vpn clients to use it.
Although it sounds insecure, there will already be an ipsec encryption
layer established that the plain text passwords travel across.
Try explaining that to your users.
However, if you use winbindd or radius looking up to ldap all your
client configurations will take the default parameters and all you need
to give them is the name of your vpn server.

For 50 users you can probably get away with
openswan/x509->l2tpd->ppp/winbind->samba

Rob