Tech Stuff - smb.conf parameters

This page describes - with examples - the LDAP specific parameters required by Samba3.x. We may or may not add to them over time.

ldap admin dn

This parameter defines the DN (Distinguished Name) of an entry which can read, modify and delete every attribute used by Samba. The format is:

ldap admin dn = NAME
# NAME may be an RDN relative to the ldap suffix 
ldap admin dn = cn=sob
# or a full DN (NB quoted string)
ldap admin dn = "cn=sob,ou=admins,dc=example,dc=com"

There are two strategies to defining this entry:

1. Use the rootdn entry for the LDAP DIT. Since this has full access to all entries and all attributes it satisfies the requirement of Samba. But if Samba goes berserk then interesting things could happen to your DIT.
2. Define a unique user entry which provides access to the required fields only. The bad news is this requires a access to clause to limit the scope of the entry. This is the most secure method.

The password for the admin entry entry is not stored in smb.conf but rather is supplied to Samba by using the following command:

smbpasswd -w password

ldap delete dn

ldap filter

ldap group suffix

ldap idmap suffix

ldap machine suffix

ldap ss

ldap suffix

ldap user suffix

passdb backend

---

Problems, comments, suggestions, corrections (including broken links) or something to add? Please take the time from a busy life to 'mail us' (at top of screen), the webmaster (below) or info-support at zytrax. You will have a warm inner glow for the rest of the day.