samba - Feb 2006 - Samba Authentication of Local Linux Users

Hi,
    I'm trying to setup a samba server that will serve linux shares out 
to users accross the network.  I'd like authentication to be done 
locally, and I want it to authenticate against pam using the already 
existing local linux user accounts.  I am not authenticating domain 
users, or windows users, and I don't want to use smbpasswd.  Is there 
some way to force samba to authenticate against pam, and only pam?  My 
goal is to not add an administrative load whatsoever.  Currently, I have 
my samba server setup, and I can access a global share okay.  But 
anytime I try and access my user home directory from the localhost 
itself with the command smbclient after providing my password I get a 
"NT_STATUS_LOGON_FAILURE," without a single log entry.  I've read 
http://samba.org/samba/docs/man/Samba-HOWTO-Collection/pam.html which 
says right at the beginning that it works for winbind, which I'm not 
interested in.  I just want to authenticate to pam, like ftp, or ssh, or 
anyother service authenticates to pam.  My /etc/pam.d looks good, and 
any help is greatly appreciated, I've spent a few hours on this with no 
success, I've searched every which way, and I just can seem to get it 
figured out.  Thanks in advance!

Mike.

Michael Thrift wrote:
> I am not authenticating domain 
> users, or windows users, and I don't want to use smbpasswd.  Is there 
> some way to force samba to authenticate against pam, and only pam?  My 
> goal is to not add an administrative load whatsoever.
The last goal is not one you can achieve.

If you want to authenticate against PAM, you have to set "encrypt 
passwords = no".  Note, however, that the man page says:

   The use of plain text passwords is NOT advised as support
   for this feature is no longer maintained in Microsoft Win-
   dows products. If you want to use plain text passwords you
   must set this parameter to no.

Now, if you choose to set that option, you have to modify all of your 
clients, by importing the appropriate "PlainPassword.reg" file from
the
samba distribution.

So, basically, you have a choice between modifying how you manage and 
change passwords, so that you can support a secure login method for SMB, 
or changing the configuration of all of your windows clients 
considerably degrading security.