1 | <?xml version="1.0" encoding="iso-8859-1"?>
|
---|
2 | <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
---|
3 | <refentry id="smbpasswd.8">
|
---|
4 |
|
---|
5 | <refmeta>
|
---|
6 | <refentrytitle>smbpasswd</refentrytitle>
|
---|
7 | <manvolnum>8</manvolnum>
|
---|
8 | <refmiscinfo class="source">Samba</refmiscinfo>
|
---|
9 | <refmiscinfo class="manual">System Administration tools</refmiscinfo>
|
---|
10 | <refmiscinfo class="version">3.6</refmiscinfo>
|
---|
11 | </refmeta>
|
---|
12 |
|
---|
13 |
|
---|
14 | <refnamediv>
|
---|
15 | <refname>smbpasswd</refname>
|
---|
16 | <refpurpose>change a user's SMB password</refpurpose>
|
---|
17 | </refnamediv>
|
---|
18 |
|
---|
19 | <refsynopsisdiv>
|
---|
20 | <cmdsynopsis>
|
---|
21 | <command>smbpasswd</command>
|
---|
22 | <arg choice="opt">-a</arg>
|
---|
23 | <arg choice="opt">-c <config file></arg>
|
---|
24 | <arg choice="opt">-x</arg>
|
---|
25 | <arg choice="opt">-d</arg>
|
---|
26 | <arg choice="opt">-e</arg>
|
---|
27 | <arg choice="opt">-D debuglevel</arg>
|
---|
28 | <arg choice="opt">-n</arg>
|
---|
29 | <arg choice="opt">-r <remote machine></arg>
|
---|
30 | <arg choice="opt">-R <name resolve order></arg>
|
---|
31 | <arg choice="opt">-m</arg>
|
---|
32 | <arg choice="opt">-U username[%password]</arg>
|
---|
33 | <arg choice="opt">-h</arg>
|
---|
34 | <arg choice="opt">-s</arg>
|
---|
35 | <arg choice="opt">-w pass</arg>
|
---|
36 | <arg choice="opt">-W</arg>
|
---|
37 | <arg choice="opt">-i</arg>
|
---|
38 | <arg choice="opt">-L</arg>
|
---|
39 | <arg choice="opt">username</arg>
|
---|
40 | </cmdsynopsis>
|
---|
41 | </refsynopsisdiv>
|
---|
42 |
|
---|
43 | <refsect1>
|
---|
44 | <title>DESCRIPTION</title>
|
---|
45 |
|
---|
46 | <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
|
---|
47 | <manvolnum>7</manvolnum></citerefentry> suite.</para>
|
---|
48 |
|
---|
49 | <para>The smbpasswd program has several different
|
---|
50 | functions, depending on whether it is run by the <emphasis>root</emphasis> user
|
---|
51 | or not. When run as a normal user it allows the user to change
|
---|
52 | the password used for their SMB sessions on any machines that store
|
---|
53 | SMB passwords. </para>
|
---|
54 |
|
---|
55 | <para>By default (when run with no arguments) it will attempt to
|
---|
56 | change the current user's SMB password on the local machine. This is
|
---|
57 | similar to the way the <command>passwd(1)</command> program works. <command>
|
---|
58 | smbpasswd</command> differs from how the passwd program works
|
---|
59 | however in that it is not <emphasis>setuid root</emphasis> but works in
|
---|
60 | a client-server mode and communicates with a
|
---|
61 | locally running <citerefentry><refentrytitle>smbd</refentrytitle>
|
---|
62 | <manvolnum>8</manvolnum></citerefentry>. As a consequence in order for this to
|
---|
63 | succeed the smbd daemon must be running on the local machine. On a
|
---|
64 | UNIX machine the encrypted SMB passwords are usually stored in
|
---|
65 | the <citerefentry><refentrytitle>smbpasswd</refentrytitle>
|
---|
66 | <manvolnum>5</manvolnum></citerefentry> file. </para>
|
---|
67 |
|
---|
68 | <para>When run by an ordinary user with no options, smbpasswd
|
---|
69 | will prompt them for their old SMB password and then ask them
|
---|
70 | for their new password twice, to ensure that the new password
|
---|
71 | was typed correctly. No passwords will be echoed on the screen
|
---|
72 | whilst being typed. If you have a blank SMB password (specified by
|
---|
73 | the string "NO PASSWORD" in the smbpasswd file) then just press
|
---|
74 | the <Enter> key when asked for your old password. </para>
|
---|
75 |
|
---|
76 | <para>smbpasswd can also be used by a normal user to change their
|
---|
77 | SMB password on remote machines, such as Windows NT Primary Domain
|
---|
78 | Controllers. See the (<parameter>-r</parameter>) and <parameter>-U</parameter> options
|
---|
79 | below. </para>
|
---|
80 |
|
---|
81 | <para>When run by root, smbpasswd allows new users to be added
|
---|
82 | and deleted in the smbpasswd file, as well as allows changes to
|
---|
83 | the attributes of the user in this file to be made. When run by root, <command>
|
---|
84 | smbpasswd</command> accesses the local smbpasswd file
|
---|
85 | directly, thus enabling changes to be made even if smbd is not
|
---|
86 | running. </para>
|
---|
87 | </refsect1>
|
---|
88 |
|
---|
89 | <refsect1>
|
---|
90 | <title>OPTIONS</title>
|
---|
91 | <variablelist>
|
---|
92 | <varlistentry>
|
---|
93 | <term>-a</term>
|
---|
94 | <listitem><para>
|
---|
95 | This option specifies that the username following should be added to the local smbpasswd file, with the new
|
---|
96 | password typed (type <Enter> for the old password). This option is ignored if the username following
|
---|
97 | already exists in the smbpasswd file and it is treated like a regular change password command. Note that the
|
---|
98 | default passdb backends require the user to already exist in the system password file (usually
|
---|
99 | <filename>/etc/passwd</filename>), else the request to add the user will fail.
|
---|
100 | </para>
|
---|
101 |
|
---|
102 | <para>This option is only available when running smbpasswd
|
---|
103 | as root. </para></listitem>
|
---|
104 | </varlistentry>
|
---|
105 |
|
---|
106 |
|
---|
107 | <varlistentry>
|
---|
108 | <term>-c</term>
|
---|
109 | <listitem><para>
|
---|
110 | This option can be used to specify the path and file name of the &smb.conf; configuration file when it
|
---|
111 | is important to use other than the default file and / or location.
|
---|
112 | </para></listitem>
|
---|
113 | </varlistentry>
|
---|
114 |
|
---|
115 |
|
---|
116 | <varlistentry>
|
---|
117 | <term>-x</term>
|
---|
118 | <listitem><para>
|
---|
119 | This option specifies that the username following should be deleted from the local smbpasswd file.
|
---|
120 | </para>
|
---|
121 |
|
---|
122 | <para>
|
---|
123 | This option is only available when running smbpasswd as root.
|
---|
124 | </para></listitem>
|
---|
125 | </varlistentry>
|
---|
126 |
|
---|
127 |
|
---|
128 |
|
---|
129 | <varlistentry>
|
---|
130 | <term>-d</term>
|
---|
131 | <listitem><para>This option specifies that the username following
|
---|
132 | should be <constant>disabled</constant> in the local smbpasswd
|
---|
133 | file. This is done by writing a <constant>'D'</constant> flag
|
---|
134 | into the account control space in the smbpasswd file. Once this
|
---|
135 | is done all attempts to authenticate via SMB using this username
|
---|
136 | will fail. </para>
|
---|
137 |
|
---|
138 | <para>If the smbpasswd file is in the 'old' format (pre-Samba 2.0
|
---|
139 | format) there is no space in the user's password entry to write
|
---|
140 | this information and the command will FAIL. See <citerefentry><refentrytitle>smbpasswd</refentrytitle>
|
---|
141 | <manvolnum>5</manvolnum></citerefentry> for details on the 'old' and new password file formats.
|
---|
142 | </para>
|
---|
143 |
|
---|
144 | <para>This option is only available when running smbpasswd as
|
---|
145 | root.</para></listitem>
|
---|
146 | </varlistentry>
|
---|
147 |
|
---|
148 |
|
---|
149 | <varlistentry>
|
---|
150 | <term>-e</term>
|
---|
151 | <listitem><para>This option specifies that the username following
|
---|
152 | should be <constant>enabled</constant> in the local smbpasswd file,
|
---|
153 | if the account was previously disabled. If the account was not
|
---|
154 | disabled this option has no effect. Once the account is enabled then
|
---|
155 | the user will be able to authenticate via SMB once again. </para>
|
---|
156 |
|
---|
157 | <para>If the smbpasswd file is in the 'old' format, then <command>
|
---|
158 | smbpasswd</command> will FAIL to enable the account.
|
---|
159 | See <citerefentry><refentrytitle>smbpasswd</refentrytitle>
|
---|
160 | <manvolnum>5</manvolnum></citerefentry> for
|
---|
161 | details on the 'old' and new password file formats. </para>
|
---|
162 |
|
---|
163 | <para>This option is only available when running smbpasswd as root.
|
---|
164 | </para></listitem>
|
---|
165 | </varlistentry>
|
---|
166 |
|
---|
167 |
|
---|
168 |
|
---|
169 | <varlistentry>
|
---|
170 | <term>-D debuglevel</term>
|
---|
171 | <listitem><para><replaceable>debuglevel</replaceable> is an integer
|
---|
172 | from 0 to 10. The default value if this parameter is not specified
|
---|
173 | is zero. </para>
|
---|
174 |
|
---|
175 | <para>The higher this value, the more detail will be logged to the
|
---|
176 | log files about the activities of smbpasswd. At level 0, only
|
---|
177 | critical errors and serious warnings will be logged. </para>
|
---|
178 |
|
---|
179 | <para>Levels above 1 will generate considerable amounts of log
|
---|
180 | data, and should only be used when investigating a problem. Levels
|
---|
181 | above 3 are designed for use only by developers and generate
|
---|
182 | HUGE amounts of log data, most of which is extremely cryptic.
|
---|
183 | </para></listitem>
|
---|
184 | </varlistentry>
|
---|
185 |
|
---|
186 |
|
---|
187 |
|
---|
188 | <varlistentry>
|
---|
189 | <term>-n</term>
|
---|
190 | <listitem><para>This option specifies that the username following
|
---|
191 | should have their password set to null (i.e. a blank password) in
|
---|
192 | the local smbpasswd file. This is done by writing the string "NO
|
---|
193 | PASSWORD" as the first part of the first password stored in the
|
---|
194 | smbpasswd file. </para>
|
---|
195 |
|
---|
196 | <para>Note that to allow users to logon to a Samba server once
|
---|
197 | the password has been set to "NO PASSWORD" in the smbpasswd
|
---|
198 | file the administrator must set the following parameter in the [global]
|
---|
199 | section of the <filename>smb.conf</filename> file : </para>
|
---|
200 |
|
---|
201 | <para><command>null passwords = yes</command></para>
|
---|
202 |
|
---|
203 | <para>This option is only available when running smbpasswd as
|
---|
204 | root.</para></listitem>
|
---|
205 | </varlistentry>
|
---|
206 |
|
---|
207 |
|
---|
208 |
|
---|
209 | <varlistentry>
|
---|
210 | <term>-r remote machine name</term>
|
---|
211 | <listitem><para>This option allows a user to specify what machine
|
---|
212 | they wish to change their password on. Without this parameter
|
---|
213 | smbpasswd defaults to the local host. The <replaceable>remote
|
---|
214 | machine name</replaceable> is the NetBIOS name of the SMB/CIFS
|
---|
215 | server to contact to attempt the password change. This name is
|
---|
216 | resolved into an IP address using the standard name resolution
|
---|
217 | mechanism in all programs of the Samba suite. See the <parameter>-R
|
---|
218 | name resolve order</parameter> parameter for details on changing
|
---|
219 | this resolving mechanism. </para>
|
---|
220 |
|
---|
221 | <para>The username whose password is changed is that of the
|
---|
222 | current UNIX logged on user. See the <parameter>-U username</parameter>
|
---|
223 | parameter for details on changing the password for a different
|
---|
224 | username. </para>
|
---|
225 |
|
---|
226 | <para>Note that if changing a Windows NT Domain password the
|
---|
227 | remote machine specified must be the Primary Domain Controller for
|
---|
228 | the domain (Backup Domain Controllers only have a read-only
|
---|
229 | copy of the user account database and will not allow the password
|
---|
230 | change).</para>
|
---|
231 |
|
---|
232 | <para><emphasis>Note</emphasis> that Windows 95/98 do not have
|
---|
233 | a real password database so it is not possible to change passwords
|
---|
234 | specifying a Win95/98 machine as remote machine target. </para>
|
---|
235 | </listitem>
|
---|
236 | </varlistentry>
|
---|
237 |
|
---|
238 |
|
---|
239 | <varlistentry>
|
---|
240 | <term>-R name resolve order</term>
|
---|
241 | <listitem><para>This option allows the user of smbpasswd to determine
|
---|
242 | what name resolution services to use when looking up the NetBIOS
|
---|
243 | name of the host being connected to. </para>
|
---|
244 |
|
---|
245 | <para>The options are :"lmhosts", "host", "wins" and "bcast". They
|
---|
246 | cause names to be resolved as follows: </para>
|
---|
247 | <itemizedlist>
|
---|
248 | <listitem><para><constant>lmhosts</constant>: Lookup an IP
|
---|
249 | address in the Samba lmhosts file. If the line in lmhosts has
|
---|
250 | no name type attached to the NetBIOS name (see the <citerefentry><refentrytitle>lmhosts</refentrytitle>
|
---|
251 | <manvolnum>5</manvolnum></citerefentry> for details) then
|
---|
252 | any name type matches for lookup.</para></listitem>
|
---|
253 |
|
---|
254 | <listitem><para><constant>host</constant>: Do a standard host
|
---|
255 | name to IP address resolution, using the system <filename>/etc/hosts
|
---|
256 | </filename>, NIS, or DNS lookups. This method of name resolution
|
---|
257 | is operating system depended for instance on IRIX or Solaris this
|
---|
258 | may be controlled by the <filename>/etc/nsswitch.conf</filename>
|
---|
259 | file). Note that this method is only used if the NetBIOS name
|
---|
260 | type being queried is the 0x20 (server) name type, otherwise
|
---|
261 | it is ignored.</para></listitem>
|
---|
262 |
|
---|
263 | <listitem><para><constant>wins</constant>: Query a name with
|
---|
264 | the IP address listed in the <parameter>wins server</parameter>
|
---|
265 | parameter. If no WINS server has been specified this method
|
---|
266 | will be ignored.</para></listitem>
|
---|
267 |
|
---|
268 | <listitem><para><constant>bcast</constant>: Do a broadcast on
|
---|
269 | each of the known local interfaces listed in the
|
---|
270 | <parameter>interfaces</parameter> parameter. This is the least
|
---|
271 | reliable of the name resolution methods as it depends on the
|
---|
272 | target host being on a locally connected subnet.</para></listitem>
|
---|
273 | </itemizedlist>
|
---|
274 |
|
---|
275 | <para>The default order is <command>lmhosts, host, wins, bcast</command>
|
---|
276 | and without this parameter or any entry in the <citerefentry><refentrytitle>smb.conf</refentrytitle>
|
---|
277 | <manvolnum>5</manvolnum></citerefentry> file the name resolution methods will
|
---|
278 | be attempted in this order. </para></listitem>
|
---|
279 | </varlistentry>
|
---|
280 |
|
---|
281 |
|
---|
282 | <varlistentry>
|
---|
283 | <term>-m</term>
|
---|
284 | <listitem><para>This option tells smbpasswd that the account
|
---|
285 | being changed is a MACHINE account. Currently this is used
|
---|
286 | when Samba is being used as an NT Primary Domain Controller.</para>
|
---|
287 |
|
---|
288 | <para>This option is only available when running smbpasswd as root.
|
---|
289 | </para></listitem>
|
---|
290 | </varlistentry>
|
---|
291 |
|
---|
292 |
|
---|
293 | <varlistentry>
|
---|
294 | <term>-U username</term>
|
---|
295 | <listitem><para>This option may only be used in conjunction
|
---|
296 | with the <parameter>-r</parameter> option. When changing
|
---|
297 | a password on a remote machine it allows the user to specify
|
---|
298 | the user name on that machine whose password will be changed. It
|
---|
299 | is present to allow users who have different user names on
|
---|
300 | different systems to change these passwords. </para></listitem>
|
---|
301 | </varlistentry>
|
---|
302 |
|
---|
303 |
|
---|
304 | <varlistentry>
|
---|
305 | <term>-h</term>
|
---|
306 | <listitem><para>This option prints the help string for <command>
|
---|
307 | smbpasswd</command>, selecting the correct one for running as root
|
---|
308 | or as an ordinary user. </para></listitem>
|
---|
309 | </varlistentry>
|
---|
310 |
|
---|
311 |
|
---|
312 | <varlistentry>
|
---|
313 | <term>-s</term>
|
---|
314 | <listitem><para>This option causes smbpasswd to be silent (i.e.
|
---|
315 | not issue prompts) and to read its old and new passwords from
|
---|
316 | standard input, rather than from <filename>/dev/tty</filename>
|
---|
317 | (like the <command>passwd(1)</command> program does). This option
|
---|
318 | is to aid people writing scripts to drive smbpasswd</para>
|
---|
319 | </listitem>
|
---|
320 | </varlistentry>
|
---|
321 |
|
---|
322 |
|
---|
323 | <varlistentry>
|
---|
324 | <term>-w password</term>
|
---|
325 | <listitem><para>This parameter is only available if Samba
|
---|
326 | has been compiled with LDAP support. The <parameter>-w</parameter>
|
---|
327 | switch is used to specify the password to be used with the
|
---|
328 | <smbconfoption name="ldap admin dn"/>. Note that the password is stored in
|
---|
329 | the <filename>secrets.tdb</filename> and is keyed off
|
---|
330 | of the admin's DN. This means that if the value of <parameter>ldap
|
---|
331 | admin dn</parameter> ever changes, the password will need to be
|
---|
332 | manually updated as well.
|
---|
333 | </para>
|
---|
334 | </listitem>
|
---|
335 | </varlistentry>
|
---|
336 |
|
---|
337 | <varlistentry>
|
---|
338 | <term>-W</term>
|
---|
339 | <listitem><para><command>NOTE: </command> This option is same as "-w"
|
---|
340 | except that the password should be entered using stdin.
|
---|
341 | </para>
|
---|
342 | <para>This parameter is only available if Samba
|
---|
343 | has been compiled with LDAP support. The <parameter>-W</parameter>
|
---|
344 | switch is used to specify the password to be used with the
|
---|
345 | <smbconfoption name="ldap admin dn"/>. Note that the password is stored in
|
---|
346 | the <filename>secrets.tdb</filename> and is keyed off
|
---|
347 | of the admin's DN. This means that if the value of <parameter>ldap
|
---|
348 | admin dn</parameter> ever changes, the password will need to be
|
---|
349 | manually updated as well.
|
---|
350 | </para>
|
---|
351 | </listitem>
|
---|
352 | </varlistentry>
|
---|
353 |
|
---|
354 |
|
---|
355 | <varlistentry>
|
---|
356 | <term>-i</term>
|
---|
357 | <listitem><para>This option tells smbpasswd that the account
|
---|
358 | being changed is an interdomain trust account. Currently this is used
|
---|
359 | when Samba is being used as an NT Primary Domain Controller.
|
---|
360 | The account contains the info about another trusted domain.</para>
|
---|
361 |
|
---|
362 | <para>This option is only available when running smbpasswd as root.
|
---|
363 | </para></listitem>
|
---|
364 | </varlistentry>
|
---|
365 |
|
---|
366 | <varlistentry>
|
---|
367 | <term>-L</term>
|
---|
368 | <listitem><para>Run in local mode.</para></listitem>
|
---|
369 | </varlistentry>
|
---|
370 |
|
---|
371 | <varlistentry>
|
---|
372 | <term>username</term>
|
---|
373 | <listitem><para>This specifies the username for all of the
|
---|
374 | <emphasis>root only</emphasis> options to operate on. Only root
|
---|
375 | can specify this parameter as only root has the permission needed
|
---|
376 | to modify attributes directly in the local smbpasswd file.
|
---|
377 | </para></listitem>
|
---|
378 | </varlistentry>
|
---|
379 | </variablelist>
|
---|
380 | </refsect1>
|
---|
381 |
|
---|
382 |
|
---|
383 | <refsect1>
|
---|
384 | <title>NOTES</title>
|
---|
385 |
|
---|
386 | <para>Since <command>smbpasswd</command> works in client-server
|
---|
387 | mode communicating with a local smbd for a non-root user then
|
---|
388 | the smbd daemon must be running for this to work. A common problem
|
---|
389 | is to add a restriction to the hosts that may access the <command>
|
---|
390 | smbd</command> running on the local machine by specifying either <parameter>allow
|
---|
391 | hosts</parameter> or <parameter>deny hosts</parameter> entry in
|
---|
392 | the <citerefentry><refentrytitle>smb.conf</refentrytitle>
|
---|
393 | <manvolnum>5</manvolnum></citerefentry> file and neglecting to
|
---|
394 | allow "localhost" access to the smbd. </para>
|
---|
395 |
|
---|
396 | <para>In addition, the smbpasswd command is only useful if Samba
|
---|
397 | has been set up to use encrypted passwords. </para>
|
---|
398 | </refsect1>
|
---|
399 |
|
---|
400 |
|
---|
401 | <refsect1>
|
---|
402 | <title>VERSION</title>
|
---|
403 |
|
---|
404 | <para>This man page is correct for version 3 of the Samba suite.</para>
|
---|
405 | </refsect1>
|
---|
406 |
|
---|
407 | <refsect1>
|
---|
408 | <title>SEE ALSO</title>
|
---|
409 | <para><citerefentry><refentrytitle>smbpasswd</refentrytitle>
|
---|
410 | <manvolnum>5</manvolnum></citerefentry>, <citerefentry><refentrytitle>Samba</refentrytitle>
|
---|
411 | <manvolnum>7</manvolnum></citerefentry>.</para>
|
---|
412 | </refsect1>
|
---|
413 |
|
---|
414 | <refsect1>
|
---|
415 | <title>AUTHOR</title>
|
---|
416 |
|
---|
417 | <para>The original Samba software and related utilities
|
---|
418 | were created by Andrew Tridgell. Samba is now developed
|
---|
419 | by the Samba Team as an Open Source project similar
|
---|
420 | to the way the Linux kernel is developed.</para>
|
---|
421 |
|
---|
422 | <para>The original Samba man pages were written by Karl Auer.
|
---|
423 | The man page sources were converted to YODL format (another
|
---|
424 | excellent piece of Open Source software, available at <ulink url="ftp://ftp.icce.rug.nl/pub/unix/">
|
---|
425 | ftp://ftp.icce.rug.nl/pub/unix/</ulink>) and updated for the Samba 2.0
|
---|
426 | release by Jeremy Allison. The conversion to DocBook for
|
---|
427 | Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2
|
---|
428 | for Samba 3.0 was done by Alexander Bokovoy.</para>
|
---|
429 | </refsect1>
|
---|
430 |
|
---|
431 | </refentry>
|
---|