Smbpasswd file

This password hash is considered more secure than the LANMAN Password Hash as it preserves the case of the password and uses a much higher quality hashing algorithm. However, it is still the case that if two users choose the same password this entry will be identical i. This section contains flags that describe the attributes of the users account. This field is bracketed by '[' and ']' characters and is always 13 characters in length including the '[' and ']' characters.

The contents of this field may be any of the following characters:. U - This means this is a "User" account, i. Note that this will only allow users to log on with no password if the null passwords parameter is set in the smb. W - This means this account is a "Workstation Trust" account.

Other flags may be added as the code is extended in future. The rest of this field space is filled in with spaces. For further information regarding the flags that are supported please refer to the man page for the pdbedit command.

Re: Samba passwords file Post by fernandoch » Thu May 15, am Well, not in my case: [root localhost samba] smbpasswd -a fer New SMB password: Retype new SMB password: [root localhost samba] [root localhost samba] ls -lrt total 52 -rw-r--r-- 1 root root 20 Nov 10 lmhosts -rw 1 root root May 13 secrets.

Re: Samba passwords file Post by markkuk » Thu May 15, am The tdbsam backend is used by default, and the password info is stored in the passdb. Re: Samba passwords file Post by fernandoch » Thu May 15, am Ok, thank you, that makes sense. New installations should use either tdbsam or ldapsam. Re: Samba passwords file Post by arrfab » Mon May 19, pm yes, tdbsam has always be better than smbpasswd file You can use the smbpasswd program with the -a option to automatically add any user that currently has a standard Unix system account on the server.

This is actually a simple awk script that parses a system password file and extracts the username and UID of each entry you wish to add to the SMB password file. It then adds default fields for the remainder of the user's entry, which can be updated using the smbpasswd program later. In order to use this program, you will probably need to edit the first line of the file to correctly point to awk on your system.

In the event that the neither of those options work for you, you can create a default entry by hand in the smbpasswd file. The entry should be entirely on one line.

Each field should be colon-separated and should look similar to the following:. This consists of the username and the UID as specified in the system password file, followed by two sets of exactly 32 X characters, followed by the account flags and last change time as it appears above. After you've added this entry, you must use the smbpasswd program to change the password for the user. If you need to change the encrypted password in the smbpasswd file, you can also use the smbpasswd program.

Note that this program shares the same name as the encrypted password file itself, so be sure not to accidentally confuse the password file with the password-changing program. The smbpasswd program is almost identical to the passwd program that is used to change Unix account passwords. The program simply asks you to enter your old password unless you're the root user , and duplicate entries of your new password.

No password characters are shown on the screen. You can look at the smbpasswd file after this command completes to verify that both the LAN Manager and the NT hashes of the passwords have been stored in their respective positions.

Once users have encrypted password entries in the database, they should be able to connect to shares using encrypted passwords! Having a regular password and an encrypted version of the same password can be troublesome when you need to change both of them.

Luckily, Samba affords you a limited ability to keep your passwords synchronized. Samba has a pair of configuration options that can be used to automatically update a user's regular Unix password when the encrypted password is changed on the system.

The feature can be activated by specifying the unix password sync global configuration option:. With this option enabled, Samba will attempt to change the user's regular password as root when the encrypted version is changed with smbpasswd.

However, there are two other options that have to be set correctly in order for this to work. The easier of the two is passwd program. This option simply specifies the Unix command used to change a user's standard system password. With some Unix systems, this is sufficient and you do not need to change anything.

In addition, you may want to change this to another program or script at some point in the future. For example, let's assume that you want to use a script called changepass to change a user's password.

So the example becomes:. Note that this program will be called as the root user when the unix password sync option is set to yes. This is because Samba does not necessarily have the plaintext old password of the user. The harder option to configure is passwd chat.

The passwd chat option works like a Unix chat script. It specifies a series of strings to send as well as responses to expect from the program specified by the passwd program option. For example, this is what the default passwd chat looks like. The delimiters are the spaces between each groupings of characters:.

The first grouping represents a response expected from the password-changing program. Once instructed to, Samba will wait indefinitely for such a match. Is Samba does not receive the expected response, the password will fail. The second grouping indicates what Samba should send back once the data in the first grouping has been matched. So, in effect, this will "type" the old password into the standard input of the password changing program, and then "press" Enter.

Following that is another response grouping, followed by data that will be sent back to the password changing program. The script continues until the final pattern is matched. You can help match the response strings sent from the password program with the characters listed in Table 6. In addition, you can use the characters listed in Table 6.

Allows you to include matching strings that contain spaces. Asterisks are still considered wildcards even inside of quotes, and you can represent a null response with empty quotes.

For example, you may want to change your password chat to the following entry. This will handle scenarios in which you do not have to enter the old password. In addition, this will also handle the new all tokens updated successfully string that Red Hat Linux sends:. Again, the default chat should be sufficient for many Unix systems. If it isn't, you can use the passwd chat debug global option to set up a new chat script for the password change program.

The passwd chat debug option logs everything during a password chat. This option is a simple boolean, as shown below:. Also, make sure to protect your log files with strict file permissions and to delete them as soon as you've grabbed the information you need, because they contain the passwords in plaintext.

The operating system on which Samba is running may have strict requirements for valid passwords in order to make them more impervious to dictionary attacks and the like. Users should be made aware of these restrictions when changing their passwords. Earlier we said that password synchronization is limited. This is because there is no reverse synchronization of the encrypted smbpasswd file when a standard Unix password is updated by a user. There are various strategies to get around this, including NIS and freely available implementations of the pluggable authentication modules PAM standard, but none of them really solve all the problems yet.

In the future, when Windows emerges, we will see more compliance with the Lightweight Directory Access Protocol LDAP , which promises to make password synchronization a thing of the past.

The options in Table 6. If yes , Samba updates the standard Unix password database when a user changes his or her encrypted password. Sends debug logs of the password-change process to the log files with a level of Sets the number of capital letter permutations to attempt when matching a client's password.