1mailto(samba@samba.org) 2 3manpage(smbpasswd htmlcommand((8)))(8)(23 Oct 1998)(Samba)(SAMBA) 4 5label(NAME) 6manpagename(smbpasswd)(change a users SMB password) 7 8label(SYNOPSIS) 9manpagesynopsis() 10 11bf(smbpasswd) [link(-a)(minusa)] [link(-x)(minusx)] [link(-d)(minusd)] [link(-e)(minuse)] [link(-D debug level)(minusD)] [link(-n)(minusn)] [link(-r remote_machine)(minusr)] [link(-R name resolve order)(minusR)] [link(-m)(minusm)] [link(-j DOMAIN)(minusj)] [link(-U username)(minusU)] [link(-h)(minush)] [link(-s)(minuss)] link(username)(username) 12 13label(DESCRIPTION) 14manpagedescription() 15 16This program is part of the bf(Samba) suite. 17 18The bf(smbpasswd) program has several different functions, depending 19on whether it is run by the em(root) user or not. When run as a normal 20user it allows the user to change the password used for their SMB 21sessions on any machines that store SMB passwords. 22 23By default (when run with no arguments) it will attempt to change the 24current users SMB password on the local machine. This is similar to 25the way the bf(passwd (1)) program works. bf(smbpasswd) differs from how 26the bf(passwd) program works however in that it is not em(setuid root) 27but works in a client-server mode and communicates with a locally 28running url(bf(smbd))(smbd.8.html). As a consequence in order for this 29to succeed the url(bf(smbd))(smbd.8.html) daemon must be running on 30the local machine. On a UNIX machine the encrypted SMB passwords are 31usually stored in the url(bf(smbpasswd (5)))(smbpasswd.5.html) file. 32 33When run by an ordinary user with no options. bf(smbpasswd) will 34prompt them for their old smb password and then ask them for their new 35password twice, to ensure that the new password was typed 36correctly. No passwords will be echoed on the screen whilst being 37typed. If you have a blank smb password (specified by the string "NO 38PASSWORD" in the url(bf(smbpasswd))(smbpasswd.5.html) file) then just 39press the <Enter> key when asked for your old password. 40 41bf(smbpasswd) can also be used by a normal user to change their SMB 42password on remote machines, such as Windows NT Primary Domain 43Controllers. See the link((bf(-r)))(minusr) and 44link(bf(-U))(minusU) options below. 45 46When run by root, bf(smbpasswd) allows new users to be added and 47deleted in the url(bf(smbpasswd))(smbpasswd.5.html) file, as well as 48allows changes to the attributes of the user in this file to be made. When 49run by root, bf(smbpasswd) accesses the local 50url(bf(smbpasswd))(smbpasswd.5.html) file directly, thus enabling 51changes to be made even if url(bf(smbd))(smbd.8.html) is not running. 52 53label(OPTIONS) 54manpageoptions() 55 56startdit() 57 58label(minusa) 59dit(bf(-a)) This option specifies that the username following should 60be added to the local url(bf(smbpasswd))(smbpasswd.5.html) file, with 61the new password typed (type <Enter> for the old password). This 62option is ignored if the username following already exists in the 63url(bf(smbpasswd))(smbpasswd.5.html) file and it is treated like a 64regular change password command. Note that the user to be added 65bf(must) already exist in the system password file (usually /etc/passwd) 66else the request to add the user will fail. 67 68This option is only available when running bf(smbpasswd) as 69root. 70 71label(minusx) 72dit(bf(-x)) This option specifies that the username following should 73be deleted from the local url(bf(smbpasswd))(smbpasswd.5.html) file. 74 75This option is only available when running bf(smbpasswd) as 76root. 77 78label(minusd) 79dit(bf(-d)) This option specifies that the username following should be 80em(disabled) in the local url(bf(smbpasswd))(smbpasswd.5.html) file. 81This is done by writing a em('D') flag into the account control space 82in the url(bf(smbpasswd))(smbpasswd.5.html) file. Once this is done 83all attempts to authenticate via SMB using this username will fail. 84 85If the url(bf(smbpasswd))(smbpasswd.5.html) file is in the 'old' 86format (pre-Samba 2.0 format) there is no space in the users password 87entry to write this information and so the user is disabled by writing 88'X' characters into the password space in the 89url(bf(smbpasswd))(smbpasswd.5.html) file. See url(bf(smbpasswd 90(5)))(smbpasswd.5.html) for details on the 'old' and new password file 91formats. 92 93This option is only available when running bf(smbpasswd) as root. 94 95label(minuse) 96dit(bf(-e)) This option specifies that the username following should be 97em(enabled) in the local url(bf(smbpasswd))(smbpasswd.5.html) file, 98if the account was previously disabled. If the account was not 99disabled this option has no effect. Once the account is enabled 100then the user will be able to authenticate via SMB once again. 101 102If the smbpasswd file is in the 'old' format then bf(smbpasswd) will 103prompt for a new password for this user, otherwise the account will be 104enabled by removing the em('D') flag from account control space in the 105url(bf(smbpasswd))(smbpasswd.5.html) file. See url(bf(smbpasswd 106(5)))(smbpasswd.5.html) for details on the 'old' and new password file 107formats. 108 109This option is only available when running bf(smbpasswd) as root. 110 111label(minusD) 112dit(bf(-D debuglevel)) debuglevel is an integer from 0 113to 10. The default value if this parameter is not specified is zero. 114 115The higher this value, the more detail will be logged to the log files 116about the activities of smbpasswd. At level 0, only critical errors 117and serious warnings will be logged. 118 119Levels above 1 will generate considerable amounts of log data, and 120should only be used when investigating a problem. Levels above 3 are 121designed for use only by developers and generate HUGE amounts of log 122data, most of which is extremely cryptic. 123 124label(minusn) 125dit(bf(-n)) This option specifies that the username following should 126have their password set to null (i.e. a blank password) in the local 127url(bf(smbpasswd))(smbpasswd.5.html) file. This is done by writing the 128string "NO PASSWORD" as the first part of the first password stored in 129the url(bf(smbpasswd))(smbpasswd.5.html) file. 130 131Note that to allow users to logon to a Samba server once the password 132has been set to "NO PASSWORD" in the 133url(bf(smbpasswd))(smbpasswd.5.html) file the administrator must set 134the following parameter in the [global] section of the 135url(bf(smb.conf))(smb.conf.5.html) file : 136 137url(null passwords = true)(smb.conf.5.html#nullpasswords) 138 139This option is only available when running bf(smbpasswd) as root. 140 141label(minusr) 142dit(bf(-r remote machine name)) This option allows a 143user to specify what machine they wish to change their password 144on. Without this parameter bf(smbpasswd) defaults to the local 145host. The em("remote machine name") is the NetBIOS name of the 146SMB/CIFS server to contact to attempt the password change. This name 147is resolved into an IP address using the standard name resolution 148mechanism in all programs of the url(bf(Samba))(samba.7.html) 149suite. See the link(bf(-R name resolve order))(minusR) parameter for details on changing this resolving 150mechanism. 151 152The username whose password is changed is that of the current UNIX 153logged on user. See the link(bf(-U username))(minusU) 154parameter for details on changing the password for a different 155username. 156 157Note that if changing a Windows NT Domain password the remote machine 158specified must be the Primary Domain Controller for the domain (Backup 159Domain Controllers only have a read-only copy of the user account 160database and will not allow the password change). 161 162em(Note) that Windows 95/98 do not have a real password database 163so it is not possible to change passwords specifying a Win95/98 164machine as remote machine target. 165 166label(minusR) 167dit(bf(-R name resolve order)) This option allows the user of 168smbclient to determine what name resolution services to use when 169looking up the NetBIOS name of the host being connected to. 170 171The options are :link("lmhosts")(lmhosts), link("host")(host), 172link("wins")(wins) and link("bcast")(bcast). They cause names to be 173resolved as follows : 174 175startit() 176 177label(lmhosts) 178it() bf(lmhosts) : Lookup an IP address in the Samba lmhosts file. 179 180label(host) 181it() bf(host) : Do a standard host name to IP address resolution, 182using the system /etc/hosts, NIS, or DNS lookups. This method of name 183resolution is operating system dependent. For instance on IRIX or 184Solaris, this may be controlled by the em(/etc/nsswitch.conf) file). 185 186label(wins) 187it() bf(wins) : Query a name with the IP address listed in the 188url(bf(wins server))(smb.conf.5.html#winsserver) parameter in the 189url(bf(smb.conf file))(smb.conf.5.html). If 190no WINS server has been specified this method will be ignored. 191 192label(bcast) 193it() bf(bcast) : Do a broadcast on each of the known local interfaces 194listed in the url(bf(interfaces))(smb.conf.5.html#interfaces) parameter 195in the smb.conf file. This is the least reliable of the name resolution 196methods as it depends on the target host being on a locally connected 197subnet. 198 199endit() 200 201If this parameter is not set then the name resolve order defined 202in the url(bf(smb.conf))(smb.conf.5.html) file parameter 203url(bf(name resolve order))(smb.conf.5.html#nameresolveorder) 204will be used. 205 206The default order is lmhosts, host, wins, bcast and without this 207parameter or any entry in the url(bf(smb.conf))(smb.conf.5.html) 208file the name resolution methods will be attempted in this order. 209 210label(minusm) 211dit(bf(-m)) This option tells bf(smbpasswd) that the account being 212changed is a em(MACHINE) account. Currently this is used when Samba is 213being used as an NT Primary Domain Controller. PDC support is not a 214supported feature in Samba2.0 but will become supported in a later 215release. If you wish to know more about using Samba as an NT PDC then 216please subscribe to the mailing list 217email(samba-ntdom@samba.org). 218 219This option is only available when running bf(smbpasswd) as root. 220 221label(minusj) 222dit(bf(-j DOMAIN)) This option is used to add a Samba server into a 223Windows NT Domain, as a Domain member capable of authenticating user 224accounts to any Domain Controller in the same way as a Windows NT 225Server. See the url(bf(security=domain))(smb.conf.5.html#security) 226option in the url(bf(smb.conf (5)))(smb.conf.5.html) man page. 227 228In order to be used in this way, the Administrator for the Windows 229NT Domain must have used the program em("Server Manager for Domains") 230to add the url(primary NetBIOS name)(smb.conf.5.html#netbiosname) of 231the Samba server as a member of the Domain. 232 233After this has been done, to join the Domain invoke bf(smbpasswd) with 234this parameter. bf(smbpasswd) will then look up the Primary Domain 235Controller for the Domain (found in the 236url(bf(smb.conf))(smb.conf.5.html) file in the parameter 237url(bf(password server))(smb.conf.5.html#passwordserver) and change 238the machine account password used to create the secure Domain 239communication. This password is then stored by bf(smbpasswd) in a 240file, read only by root, called tt(<Domain>.<Machine>.mac) where 241tt(<Domain>) is the name of the Domain we are joining and tt(<Machine>) 242is the primary NetBIOS name of the machine we are running on. 243 244Once this operation has been performed the 245url(bf(smb.conf))(smb.conf.5.html) file may be updated to set the 246url(bf(security=domain))(smb.conf.5.html#security) option and all 247future logins to the Samba server will be authenticated to the Windows 248NT PDC. 249 250Note that even though the authentication is being done to the PDC all 251users accessing the Samba server must still have a valid UNIX account 252on that machine. 253 254This option is only available when running bf(smbpasswd) as root. 255 256label(minusU) 257dit(bf(-U username)) This option may only be used in 258conjunction with the link(bf(-r))(minusr) 259option. When changing a password on a remote machine it allows the 260user to specify the user name on that machine whose password will be 261changed. It is present to allow users who have different user names on 262different systems to change these passwords. 263 264label(minush) 265dit(bf(-h)) This option prints the help string for bf(smbpasswd), 266selecting the correct one for running as root or as an ordinary user. 267 268label(minuss) 269dit(bf(-s)) This option causes bf(smbpasswd) to be silent (i.e. not 270issue prompts) and to read it's old and new passwords from standard 271input, rather than from tt(/dev/tty) (like the bf(passwd (1)) program 272does). This option is to aid people writing scripts to drive bf(smbpasswd) 273 274label(username) 275dit(bf(username)) This specifies the username for all of the em(root 276only) options to operate on. Only root can specify this parameter as 277only root has the permission needed to modify attributes directly 278in the local url(bf(smbpasswd))(smbpasswd.5.html) file. 279 280label(NOTES) 281manpagesection(NOTES) 282 283Since bf(smbpasswd) works in client-server mode communicating with a 284local url(bf(smbd))(smbd.8.html) for a non-root user then the bf(smbd) 285daemon must be running for this to work. A common problem is to add a 286restriction to the hosts that may access the bf(smbd) running on the 287local machine by specifying a url(bf("allow 288hosts"))(smb.conf.5.html#allowhosts) or url(bf("deny 289hosts"))(smb.conf.5.html#denyhosts) entry in the 290url(bf(smb.conf))(smb.conf.5.html) file and neglecting to allow 291em("localhost") access to the bf(smbd). 292 293In addition, the bf(smbpasswd) command is only useful if bf(Samba) has 294been set up to use encrypted passwords. See the file bf(ENCRYPTION.txt) 295in the docs directory for details on how to do this. 296 297label(VERSION) 298manpagesection(VERSION) 299 300This man page is correct for version 2.0 of the Samba suite. 301 302label(AUTHOR) 303manpageauthor() 304 305The original Samba software and related utilities were created by 306Andrew Tridgell email(samba@samba.org). Samba is now developed 307by the Samba Team as an Open Source project similar to the way the 308Linux kernel is developed. 309 310The original Samba man pages were written by Karl Auer. The man page 311sources were converted to YODL format (another excellent piece of Open 312Source software, available at 313url(bf(ftp://ftp.icce.rug.nl/pub/unix/))(ftp://ftp.icce.rug.nl/pub/unix/)) 314and updated for the Samba2.0 release by Jeremy Allison. 315email(samba@samba.org). 316 317See url(bf(samba (7)))(samba.7.html) to find out how to get a full 318list of contributors and details on how to submit bug reports, 319comments etc. 320