mirror of
https://github.com/samba-team/samba.git
synced 2024-12-28 07:21:54 +03:00
8d7c96a4e2
- Fix db2latex (it depended on the $Id$ tags) - Fix CUPS-Printing syntax - Update instructions in docbook.txt
164 lines
15 KiB
HTML
164 lines
15 KiB
HTML
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>smbpasswd</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"><a name="smbpasswd.8"></a><div class="titlepage"><div></div><div></div></div><div class="refnamediv"><h2>Name</h2><p>smbpasswd — change a user's SMB password</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><tt class="command">smbpasswd</tt> [-a] [-x] [-d] [-e] [-D debuglevel] [-n] [-r <remote machine>] [-R <name resolve order>] [-m] [-U username[%password]] [-h] [-s] [-w pass] [-i] [-L] [username]</p></div></div><div class="refsect1" lang="en"><h2>DESCRIPTION</h2><p>This tool is part of the <a href="Samba.7.html"><span class="citerefentry"><span class="refentrytitle">Samba</span>(7)</span></a> suite.</p><p>The smbpasswd program has several different
|
|
functions, depending on whether it is run by the <span class="emphasis"><em>root</em></span> user
|
|
or not. When run as a normal user it allows the user to change
|
|
the password used for their SMB sessions on any machines that store
|
|
SMB passwords. </p><p>By default (when run with no arguments) it will attempt to
|
|
change the current user's SMB password on the local machine. This is
|
|
similar to the way the <b class="command">passwd(1)</b> program works. <b class="command">
|
|
smbpasswd</b> differs from how the passwd program works
|
|
however in that it is not <span class="emphasis"><em>setuid root</em></span> but works in
|
|
a client-server mode and communicates with a
|
|
locally running <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>. As a consequence in order for this to
|
|
succeed the smbd daemon must be running on the local machine. On a
|
|
UNIX machine the encrypted SMB passwords are usually stored in
|
|
the <a href="smbpasswd.5.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(5)</span></a> file. </p><p>When run by an ordinary user with no options, smbpasswd
|
|
will prompt them for their old SMB password and then ask them
|
|
for their new password twice, to ensure that the new password
|
|
was typed correctly. No passwords will be echoed on the screen
|
|
whilst being typed. If you have a blank SMB password (specified by
|
|
the string "NO PASSWORD" in the smbpasswd file) then just press
|
|
the <Enter> key when asked for your old password. </p><p>smbpasswd can also be used by a normal user to change their
|
|
SMB password on remote machines, such as Windows NT Primary Domain
|
|
Controllers. See the (<i class="parameter"><tt>-r</tt></i>) and <i class="parameter"><tt>-U</tt></i> options
|
|
below. </p><p>When run by root, smbpasswd allows new users to be added
|
|
and deleted in the smbpasswd file, as well as allows changes to
|
|
the attributes of the user in this file to be made. When run by root, <b class="command">
|
|
smbpasswd</b> accesses the local smbpasswd file
|
|
directly, thus enabling changes to be made even if smbd is not
|
|
running. </p></div><div class="refsect1" lang="en"><h2>OPTIONS</h2><div class="variablelist"><dl><dt><span class="term">-a</span></dt><dd><p>This option specifies that the username
|
|
following should be added to the local smbpasswd file, with the
|
|
new password typed (type <Enter> for the old password). This
|
|
option is ignored if the username following already exists in
|
|
the smbpasswd file and it is treated like a regular change
|
|
password command. Note that the default passdb backends require
|
|
the user to already exist in the system password file (usually
|
|
<tt class="filename">/etc/passwd</tt>), else the request to add the
|
|
user will fail. </p><p>This option is only available when running smbpasswd
|
|
as root. </p></dd><dt><span class="term">-x</span></dt><dd><p>This option specifies that the username
|
|
following should be deleted from the local smbpasswd file.
|
|
</p><p>This option is only available when running smbpasswd as
|
|
root.</p></dd><dt><span class="term">-d</span></dt><dd><p>This option specifies that the username following
|
|
should be <tt class="constant">disabled</tt> in the local smbpasswd
|
|
file. This is done by writing a <tt class="constant">'D'</tt> flag
|
|
into the account control space in the smbpasswd file. Once this
|
|
is done all attempts to authenticate via SMB using this username
|
|
will fail. </p><p>If the smbpasswd file is in the 'old' format (pre-Samba 2.0
|
|
format) there is no space in the user's password entry to write
|
|
this information and the command will FAIL. See <a href="smbpasswd.5.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(5)</span></a> for details on the 'old' and new password file formats.
|
|
</p><p>This option is only available when running smbpasswd as
|
|
root.</p></dd><dt><span class="term">-e</span></dt><dd><p>This option specifies that the username following
|
|
should be <tt class="constant">enabled</tt> in the local smbpasswd file,
|
|
if the account was previously disabled. If the account was not
|
|
disabled this option has no effect. Once the account is enabled then
|
|
the user will be able to authenticate via SMB once again. </p><p>If the smbpasswd file is in the 'old' format, then <b class="command">
|
|
smbpasswd</b> will FAIL to enable the account.
|
|
See <a href="smbpasswd.5.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(5)</span></a> for
|
|
details on the 'old' and new password file formats. </p><p>This option is only available when running smbpasswd as root.
|
|
</p></dd><dt><span class="term">-D debuglevel</span></dt><dd><p><i class="replaceable"><tt>debuglevel</tt></i> is an integer
|
|
from 0 to 10. The default value if this parameter is not specified
|
|
is zero. </p><p>The higher this value, the more detail will be logged to the
|
|
log files about the activities of smbpasswd. At level 0, only
|
|
critical errors and serious warnings will be logged. </p><p>Levels above 1 will generate considerable amounts of log
|
|
data, and should only be used when investigating a problem. Levels
|
|
above 3 are designed for use only by developers and generate
|
|
HUGE amounts of log data, most of which is extremely cryptic.
|
|
</p></dd><dt><span class="term">-n</span></dt><dd><p>This option specifies that the username following
|
|
should have their password set to null (i.e. a blank password) in
|
|
the local smbpasswd file. This is done by writing the string "NO
|
|
PASSWORD" as the first part of the first password stored in the
|
|
smbpasswd file. </p><p>Note that to allow users to logon to a Samba server once
|
|
the password has been set to "NO PASSWORD" in the smbpasswd
|
|
file the administrator must set the following parameter in the [global]
|
|
section of the <tt class="filename">smb.conf</tt> file : </p><p><b class="command">null passwords = yes</b></p><p>This option is only available when running smbpasswd as
|
|
root.</p></dd><dt><span class="term">-r remote machine name</span></dt><dd><p>This option allows a user to specify what machine
|
|
they wish to change their password on. Without this parameter
|
|
smbpasswd defaults to the local host. The <i class="replaceable"><tt>remote
|
|
machine name</tt></i> is the NetBIOS name of the SMB/CIFS
|
|
server to contact to attempt the password change. This name is
|
|
resolved into an IP address using the standard name resolution
|
|
mechanism in all programs of the Samba suite. See the <i class="parameter"><tt>-R
|
|
name resolve order</tt></i> parameter for details on changing
|
|
this resolving mechanism. </p><p>The username whose password is changed is that of the
|
|
current UNIX logged on user. See the <i class="parameter"><tt>-U username</tt></i>
|
|
parameter for details on changing the password for a different
|
|
username. </p><p>Note that if changing a Windows NT Domain password the
|
|
remote machine specified must be the Primary Domain Controller for
|
|
the domain (Backup Domain Controllers only have a read-only
|
|
copy of the user account database and will not allow the password
|
|
change).</p><p><span class="emphasis"><em>Note</em></span> that Windows 95/98 do not have
|
|
a real password database so it is not possible to change passwords
|
|
specifying a Win95/98 machine as remote machine target. </p></dd><dt><span class="term">-R name resolve order</span></dt><dd><p>This option allows the user of smbpasswd to determine
|
|
what name resolution services to use when looking up the NetBIOS
|
|
name of the host being connected to. </p><p>The options are :"lmhosts", "host", "wins" and "bcast". They
|
|
cause names to be resolved as follows: </p><div class="itemizedlist"><ul type="disc"><li><p><tt class="constant">lmhosts</tt>: Lookup an IP
|
|
address in the Samba lmhosts file. If the line in lmhosts has
|
|
no name type attached to the NetBIOS name (see the <a href="lmhosts.5.html"><span class="citerefentry"><span class="refentrytitle">lmhosts</span>(5)</span></a> for details) then
|
|
any name type matches for lookup.</p></li><li><p><tt class="constant">host</tt>: Do a standard host
|
|
name to IP address resolution, using the system <tt class="filename">/etc/hosts
|
|
</tt>, NIS, or DNS lookups. This method of name resolution
|
|
is operating system depended for instance on IRIX or Solaris this
|
|
may be controlled by the <tt class="filename">/etc/nsswitch.conf</tt>
|
|
file). Note that this method is only used if the NetBIOS name
|
|
type being queried is the 0x20 (server) name type, otherwise
|
|
it is ignored.</p></li><li><p><tt class="constant">wins</tt>: Query a name with
|
|
the IP address listed in the <i class="parameter"><tt>wins server</tt></i>
|
|
parameter. If no WINS server has been specified this method
|
|
will be ignored.</p></li><li><p><tt class="constant">bcast</tt>: Do a broadcast on
|
|
each of the known local interfaces listed in the
|
|
<i class="parameter"><tt>interfaces</tt></i> parameter. This is the least
|
|
reliable of the name resolution methods as it depends on the
|
|
target host being on a locally connected subnet.</p></li></ul></div><p>The default order is <b class="command">lmhosts, host, wins, bcast</b>
|
|
and without this parameter or any entry in the <a href="smb.conf.5.html"><span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span></a> file the name resolution methods will
|
|
be attempted in this order. </p></dd><dt><span class="term">-m</span></dt><dd><p>This option tells smbpasswd that the account
|
|
being changed is a MACHINE account. Currently this is used
|
|
when Samba is being used as an NT Primary Domain Controller.</p><p>This option is only available when running smbpasswd as root.
|
|
</p></dd><dt><span class="term">-U username</span></dt><dd><p>This option may only be used in conjunction
|
|
with the <i class="parameter"><tt>-r</tt></i> option. When changing
|
|
a password on a remote machine it allows the user to specify
|
|
the user name on that machine whose password will be changed. It
|
|
is present to allow users who have different user names on
|
|
different systems to change these passwords. </p></dd><dt><span class="term">-h</span></dt><dd><p>This option prints the help string for <b class="command">
|
|
smbpasswd</b>, selecting the correct one for running as root
|
|
or as an ordinary user. </p></dd><dt><span class="term">-s</span></dt><dd><p>This option causes smbpasswd to be silent (i.e.
|
|
not issue prompts) and to read its old and new passwords from
|
|
standard input, rather than from <tt class="filename">/dev/tty</tt>
|
|
(like the <b class="command">passwd(1)</b> program does). This option
|
|
is to aid people writing scripts to drive smbpasswd</p></dd><dt><span class="term">-w password</span></dt><dd><p>This parameter is only available if Samba
|
|
has been configured to use the experimental
|
|
<b class="command">--with-ldapsam</b> option. The <i class="parameter"><tt>-w</tt></i>
|
|
switch is used to specify the password to be used with the
|
|
<a href="smb.conf.5.html#LDAPADMINDN" target="_top"><i class="parameter"><tt>ldap admin
|
|
dn</tt></i></a>. Note that the password is stored in
|
|
the <tt class="filename">secrets.tdb</tt> and is keyed off
|
|
of the admin's DN. This means that if the value of <i class="parameter"><tt>ldap
|
|
admin dn</tt></i> ever changes, the password will need to be
|
|
manually updated as well.
|
|
</p></dd><dt><span class="term">-i</span></dt><dd><p>This option tells smbpasswd that the account
|
|
being changed is an interdomain trust account. Currently this is used
|
|
when Samba is being used as an NT Primary Domain Controller.
|
|
The account contains the info about another trusted domain.</p><p>This option is only available when running smbpasswd as root.
|
|
</p></dd><dt><span class="term">-L</span></dt><dd><p>Run in local mode.</p></dd><dt><span class="term">username</span></dt><dd><p>This specifies the username for all of the
|
|
<span class="emphasis"><em>root only</em></span> options to operate on. Only root
|
|
can specify this parameter as only root has the permission needed
|
|
to modify attributes directly in the local smbpasswd file.
|
|
</p></dd></dl></div></div><div class="refsect1" lang="en"><h2>NOTES</h2><p>Since <b class="command">smbpasswd</b> works in client-server
|
|
mode communicating with a local smbd for a non-root user then
|
|
the smbd daemon must be running for this to work. A common problem
|
|
is to add a restriction to the hosts that may access the <b class="command">
|
|
smbd</b> running on the local machine by specifying either <i class="parameter"><tt>allow
|
|
hosts</tt></i> or <i class="parameter"><tt>deny hosts</tt></i> entry in
|
|
the <a href="smb.conf.5.html"><span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span></a> file and neglecting to
|
|
allow "localhost" access to the smbd. </p><p>In addition, the smbpasswd command is only useful if Samba
|
|
has been set up to use encrypted passwords. See the document <a href="pwencrypt.html" target="_top">
|
|
"LanMan and NT Password Encryption in Samba"</a> in the docs directory for details
|
|
on how to do this. </p></div><div class="refsect1" lang="en"><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba suite.</p></div><div class="refsect1" lang="en"><h2>SEE ALSO</h2><p><a href="smbpasswd.5.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(5)</span></a>, <a href="Samba.7.html"><span class="citerefentry"><span class="refentrytitle">Samba</span>(7)</span></a>.</p></div><div class="refsect1" lang="en"><h2>AUTHOR</h2><p>The original Samba software and related utilities
|
|
were created by Andrew Tridgell. Samba is now developed
|
|
by the Samba Team as an Open Source project similar
|
|
to the way the Linux kernel is developed.</p><p>The original Samba man pages were written by Karl Auer.
|
|
The man page sources were converted to YODL format (another
|
|
excellent piece of Open Source software, available at <a href="ftp://ftp.icce.rug.nl/pub/unix/" target="_top">
|
|
ftp://ftp.icce.rug.nl/pub/unix/</a>) and updated for the Samba 2.0
|
|
release by Jeremy Allison. The conversion to DocBook for
|
|
Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2
|
|
for Samba 3.0 was done by Alexander Bokovoy.</p></div></div></body></html>
|