ldapv3.pdf 7947KB Apr 17 2013 11:30:42 AM - mirror omadata

Samba Security
The ntpassword and lmpassword attributes should be treated as clear
text equivalents of the user's password. The method used to encrypt the
password and produce these strings is easily reversed.
Only administrators should have access to these values and they should
only be transferred over a network with additional encryption (SSL,
TLS, VPN, etc...)
The safest solutions is to apply the following ACL directive:
access to attrs=lmPassword,ntPassword
by 'cn=samba,ou=SystemAccounts,dc=Whitemice,dc=Org' write
by self write
by * auth