SAMBA Project Documentation
Prev		Next

Chapter 16. Passdb MySQL plugin

16.1. Building

To build the plugin, run make bin/pdb_mysql.so -in the source/ directory of samba distribution.

Next, copy pdb_mysql.so to any location you want. I -strongly recommend installing it in $PREFIX/lib or /usr/lib/samba/

16.2. Configuring

This plugin lacks some good documentation, but here is some short info:

Add a the following to the passdb backend variable in your smb.conf: -

passdb backend = [other-plugins] plugin:/location/to/pdb_mysql.so:identifier [other-plugins]

The identifier can be any string you like, as long as it doesn't collide with -the identifiers of other plugins or other instances of pdb_mysql. If you -specify multiple pdb_mysql.so entries in 'passdb backend', you also need to -use different identifiers!

Additional options can be given thru the smb.conf file in the [global] section.

identifier:mysql host                     - host name, defaults to 'localhost'
-identifier:mysql password
-identifier:mysql user                     - defaults to 'samba'
-identifier:mysql database                 - defaults to 'samba'
-identifier:mysql port                     - defaults to 3306
-identifier:table                          - Name of the table containing users

WARNING: since the password for the mysql user is stored in the -smb.conf file, you should make the the smb.conf file -readable only to the user that runs samba. This is considered a security -bug and will be fixed soon.

Names of the columns in this table(I've added column types those columns should have first):

identifier:logon time column             - int(9)
-identifier:logoff time column            - int(9)
-identifier:kickoff time column           - int(9)
-identifier:pass last set time column     - int(9)
-identifier:pass can change time column   - int(9)
-identifier:pass must change time column  - int(9)
-identifier:username column               - varchar(255) - unix username
-identifier:domain column                 - varchar(255) - NT domain user is part of
-identifier:nt username column            - varchar(255) - NT username
-identifier:fullname column            - varchar(255) - Full name of user
-identifier:home dir column               - varchar(255) - Unix homedir path
-identifier:dir drive column              - varchar(2) - Directory drive path (eg: 'H:')
-identifier:logon script column           - varchar(255) - Batch file to run on client side when logging on
-identifier:profile path column           - varchar(255) - Path of profile
-identifier:acct desc column              - varchar(255) - Some ASCII NT user data
-identifier:workstations column           - varchar(255) - Workstations user can logon to (or NULL for all)
-identifier:unknown string column         - varchar(255) - unknown string
-identifier:munged dial column            - varchar(255) - ?
-identifier:uid column                    - int(9) - Unix user ID (uid)
-identifier:gid column                    - int(9) - Unix user group (gid)
-identifier:user sid column               - varchar(255) - NT user SID
-identifier:group sid column              - varchar(255) - NT group ID
-identifier:lanman pass column            - varchar(255) - encrypted lanman password
-identifier:nt pass column                - varchar(255) - encrypted nt passwd
-identifier:plain pass column             - varchar(255) - plaintext password
-identifier:acct control column           - int(9) - nt user data
-identifier:unknown 3 column              - int(9) - unknown
-identifier:logon divs column             - int(9) - ?
-identifier:hours len column              - int(9) - ?
-identifier:unknown 5 column              - int(9) - unknown
-identifier:unknown 6 column              - int(9) - unknown

Eventually, you can put a colon (:) after the name of each column, which -should specify the column to update when updating the table. You can also -specify nothing behind the colon - then the data from the field will not be -updated.

16.3. Using plaintext passwords or encrypted password

I strongly discourage the use of plaintext passwords, however, you can use them:

If you would like to use plaintext passwords, set 'identifier:lanman pass column' and 'identifier:nt pass column' to 'NULL' (without the quotes) and 'identifier:plain pass column' to the name of the column containing the plaintext passwords.

If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default.

16.4. Getting non-column data from the table

It is possible to have not all data in the database and making some 'constant'.

For example, you can set 'identifier:fullname column' to : -CONCAT(First_name,' ',Sur_name)

Or, set 'identifier:workstations column' to : -NULL

See the MySQL documentation for more language constructs.

Prev	Home	Next
Unified Logons between Windows NT and UNIX using Winbind	Up	Passdb XML plugin