What has to be done in order to make sure the Samba password is kept in sync when a user changes his Linux password?

Question

Options

• ASamba and Unix passwords can only be kept in sync when Samba uses the passwdsam
• B/usr/bin/passwd should be replaced by a symlink to /usr/bin/smbpasswd.
• CIn /etc/nsswitch.conf, the samba service should be added to passwd and shadow before the
• Dpam_smbpass.so should be added to the password type of the appropriate PAM
• EWinbindd must be running on the Linux server in order to replicate the password changes

• A
  3% (1)
• B
  13% (5)
• C
  3% (1)
• D
  74% (28)
• E
  8% (3)

Explanation

PAM (Pluggable Authentication Modules) is the correct mechanism because it intercepts system-level events - including password changes - and can trigger additional actions. Adding pam_smbpass.so to the password stack in the appropriate PAM config file (e.g., /etc/pam.d/common-password or /etc/pam.d/passwd) ensures that whenever a user runs passwd, PAM automatically updates the Samba password database (/etc/samba/smbpasswd or the TDB backend) in the same operation.

Why the distractors fail:

• A is false - password sync is not limited to a single Samba backend; PAM-based sync works independently of which passdb backend Samba uses.
• B is wrong - replacing passwd with a symlink to smbpasswd would break normal Linux password changes, since smbpasswd is not a drop-in replacement for passwd.
• C is wrong - nsswitch.conf controls name service lookups (where to find users/groups), not password change hooks; it has no role in syncing passwords.
• E is wrong - winbindd is for integrating with Windows/Active Directory domains, not for syncing local Linux passwords with a local Samba instance.

Memory tip: Think of PAM as a "pipeline" that runs on every login or password event - you're just plugging in an extra Samba step (pam_smbpass.so) to that pipeline so it runs alongside the normal Linux password update.

No community discussion yet for this question.