search for: smbkrb5pwd

...dated. Alas, if I get it right, Samba 4 acting as a AD DC uses it's own internal LDAP server and also a default Heimdal implementation of Kerberos, also included in Samba. Thus, the password (or it's hash) doesn't get stored in the LDAP directory (correct me if I'm wrong). I found smbkrb5pwd which is an OpenLDAP (slapd) overlay to change LDAP, Samba and MIT Kerberos passwords at the same time. (Then the password hash would end in the directory, where I could synchronized from). But I guess I can't use it for Samba's internal LDAP server. I've also investigated on how and w...

...D DC uses it's own internal > > LDAP server and also a default Heimdal implementation of Kerberos, also > > included in Samba. Thus, the password (or it's hash) doesn't get stored > in > > the LDAP directory (correct me if I'm wrong). > > > > I found smbkrb5pwd which is an OpenLDAP (slapd) overlay to change LDAP, > > Samba and MIT > > Kerberos passwords at the same time. (Then the password hash would end in > > the directory, where I could synchronized from). But I guess I can't use > it > > for Samba's internal LDAP ser...

...swords stay in sync. I can also configure client > machines to use kerberos passwords, although the kerberos passwords currently > do not sync with the LDAP unix and samba passwords. Same here. Plus I got kerberos passwords in sync with others using http://labs.opinsys.com/blog/2010/05/05/smbkrb5pwd-password-syncing-for-openldap-mit-kerberos-and-samba/ > > > As far as I can tell, Samba 4 does not support MIT kerberos. At this point, I > am serious considering migrating my domain controllers to Windows 2008/2012 > while keeping Samba for the file servers. Either way, I hav...

...right, Samba 4 acting as a AD DC uses it's own internal > LDAP server and also a default Heimdal implementation of Kerberos, also > included in Samba. Thus, the password (or it's hash) doesn't get stored in > the LDAP directory (correct me if I'm wrong). > > I found smbkrb5pwd which is an OpenLDAP (slapd) overlay to change LDAP, > Samba and MIT > Kerberos passwords at the same time. (Then the password hash would end in > the directory, where I could synchronized from). But I guess I can't use it > for Samba's internal LDAP server. > > I've...

...t right, Samba 4 acting as a AD DC uses it's own internal > LDAP server and also a default Heimdal implementation of Kerberos, also > included in Samba. Thus, the password (or it's hash) doesn't get stored in > the LDAP directory (correct me if I'm wrong). > > I found smbkrb5pwd which is an OpenLDAP (slapd) overlay to change LDAP, > Samba and MIT > Kerberos passwords at the same time. (Then the password hash would end in > the directory, where I could synchronized from). But I guess I can't use it > for Samba's internal LDAP server. > > I've a...

...> LDAP server and also a default Heimdal implementation of Kerberos, also > > > included in Samba. Thus, the password (or it's hash) doesn't get stored > > > > in > > > the LDAP directory (correct me if I'm wrong). > > > > > > I found smbkrb5pwd which is an OpenLDAP (slapd) overlay to change LDAP, > > > Samba and MIT > > > Kerberos passwords at the same time. (Then the password hash would end in > > > the directory, where I could synchronized from). But I guess I can't use > > > > it > > &g...

...imdal implementation of Kerberos, > also > > > > included in Samba. Thus, the password (or it's hash) doesn't get > stored > > > > > > in > > > > the LDAP directory (correct me if I'm wrong). > > > > > > > > I found smbkrb5pwd which is an OpenLDAP (slapd) overlay to change > LDAP, > > > > Samba and MIT > > > > Kerberos passwords at the same time. (Then the password hash would > end in > > > > the directory, where I could synchronized from). But I guess I can't > use > &...

> Is it possible for windows clients to authenticate against kerberos and > receive tickets from a Samba3 PDC, when kerberos server is MIT kerberos > running on a Linux server, not a Windows AD server? > > https://help.ubuntu.com/community/Samba/Kerberos > Suggests that this may be possible and I can succesfully authenticate with > smbclient -k. But windows users do not