smbpasswd - The Samba encrypted password file
SYNOPSIS
smbpasswd
DESCRIPTION
This tool is part of the Sambasuite.
smbpasswd is the Samba encrypted password file. It con
tains the username, Unix user id and the SMB hashed pass
words of the user, as well as account flag information and
the time the password was last changed. This file format
has been evolving with Samba and has had several different
formats in the past.
FILE FORMAT
The format of the smbpasswd file used by Samba 2.2 is very
similar to the familiar Unix passwd(5) file. It is an
ASCII file containing one line for each user. Each field
ithin each line is separated from the next by a colon. Any
entry beginning with '#' is ignored. The smbpasswd file
contains the following information for each user:
name This is the user name. It must be a name that
already exists in the standard UNIX passwd file.
uid This is the UNIX uid. It must match the uid field
for the same user entry in the standard UNIX passwd
file. If this does not match then Samba will
refuse to recognize this smbpasswd file entry as
being valid for a user.
Lanman Password Hash
This is the LANMAN hash of the user's password,
encoded as 32 hex digits. The LANMAN hash is cre
ated by DES encrypting a well known string with the
user's password as the DES key. This is the same
password used by Windows 95/98 machines. Note that
this password hash is regarded as weak as it is
vulnerable to dictionary attacks and if two users
choose the same password this entry will be identi
cal (i.e. the password is not "salted" as the UNIX
password is). If the user has a null password this
field will contain the characters "NO PASSWORD" as
the start of the hex string. If the hex string is
equal to 32 'X' characters then the user's account
is marked as disabled and the user will not be able
to log onto the Samba server.
WARNING !! Note that, due to the challenge-response
nature of the SMB/CIFS authentication protocol,
anyone with a knowledge of this password hash will
be able to impersonate the user on the network. For
equivalents and must NOT be made available to any
one but the root user. To protect these passwords
the smbpasswd file is placed in a directory with
read and traverse access only to the root user and
the smbpasswd file itself must be set to be
read/write only by root, with no other access.
NT Password Hash
This is the Windows NT hash of the user's password,
encoded as 32 hex digits. The Windows NT hash is
created by taking the user's password as repre
sented in 16-bit, little-endian UNICODE and then
applying the MD4 (internet rfc1321) hashing algo
rithm to it.
This password hash is considered more secure than
the LANMAN Password Hash as it preserves the case
of the password and uses a much higher quality
hashing algorithm. However, it is still the case
that if two users choose the same password this
entry will be identical (i.e. the password is not
"salted" as the UNIX password is).
WARNING !!. Note that, due to the challenge-
response nature of the SMB/CIFS authentication pro
tocol, anyone with a knowledge of this password
hash will be able to impersonate the user on the
network. For this reason these hashes are known as
plain text equivalents and must NOT be made avail
able to anyone but the root user. To protect these
passwords the smbpasswd file is placed in a direc
tory with read and traverse access only to the root
user and the smbpasswd file itself must be set to
be read/write only by root, with no other access.
Account Flags
This section contains flags that describe the
attributes of the users account. In the Samba 2.2
release this field is bracketed by '[' and ']'
characters and is always 13 characters in length
(including the '[' and ']' characters). The con
tents of this field may be any of the characters.
· U - This means this is a "User" account, i.e. an
ordinary user. Only User and Workstation Trust
accounts are currently supported in the smbpasswd
file.
· N - This means the account has no password (the
passwords in the fields LANMAN Password Hash and
NT Password Hash are ignored). Note that this
will only allow users to log on with no password
if the null passwords parameter is set in the
· D - This means the account is disabled and no
SMB/CIFS logins will be allowed for this user.
· W - This means this account is a "Workstation
Trust" account. This kind of account is used in
the Samba PDC code stream to allow Windows NT
Workstations and Servers to join a Domain hosted
by a Samba PDC.
Other flags may be added as the code is extended in
future. The rest of this field space is filled in with
spaces.
Last Change Time
This field consists of the time the account was
last modified. It consists of the characters 'LCT-'
(standing for "Last Change Time") followed by a
numeric encoding of the UNIX time in seconds since
the epoch (1970) that the last change was made.
All other colon separated fields are ignored at this time.
VERSION
This man page is correct for version 2.2 of the Samba
suite.
SEE ALSO
smbpasswd(8), samba(7), and the Internet RFC1321 for
details on the MD4 algorithm.
AUTHOR
The original Samba software and related utilities were
created by Andrew Tridgell. Samba is now developed by the
Samba Team as an Open Source project similar to the way
the Linux kernel is developed.
The original Samba man pages were written by Karl Auer.
The man page sources were converted to YODL format
(another excellent piece of Open Source software, avail
able at ftp://ftp.icce.rug.nl/pub/unix/
<URL:ftp://ftp.icce.rug.nl/pub/unix/>) and updated for the
Samba 2.0 release by Jeremy Allison. The conversion to
DocBook for Samba 2.2 was done by Gerald Carter
Man(1) output converted with
man2html