docs/manpages-3/pdbedit.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="pdbedit.8">
   4
   5 <refmeta>
   6         <refentrytitle>pdbedit</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8 </refmeta>
   9
  10
  11 <refnamediv>
  12         <refname>pdbedit</refname>
  13         <refpurpose>manage the SAM database (Database of Samba Users)</refpurpose>
  14 </refnamediv>
  15
  16 <refsynopsisdiv>
  17         <cmdsynopsis>
  18                 <command>pdbedit</command>
  19                 <arg choice="opt">-L</arg>
  20                 <arg choice="opt">-v</arg>
  21                 <arg choice="opt">-w</arg>
  22                 <arg choice="opt">-u username</arg>
  23                 <arg choice="opt">-f fullname</arg>
  24                 <arg choice="opt">-h homedir</arg>
  25                 <arg choice="opt">-D drive</arg>
  26                 <arg choice="opt">-S script</arg>
  27                 <arg choice="opt">-p profile</arg>
  28                 <arg choice="opt">-a</arg>
  29                 <arg choice="opt">-m</arg>
  30                 <arg choice="opt">-r</arg>
  31                 <arg choice="opt">-x</arg>
  32                 <arg choice="opt">-i passdb-backend</arg>
  33                 <arg choice="opt">-e passdb-backend</arg>
  34                 <arg choice="opt">-b passdb-backend</arg>
  35                 <arg choice="opt">-g</arg>
  36                 <arg choice="opt">-d debuglevel</arg>
  37                 <arg choice="opt">-s configfile</arg>
  38                 <arg choice="opt">-P account-policy</arg>
  39                 <arg choice="opt">-C value</arg>
  40                 <arg choice="opt">-c account-control</arg>
  41         </cmdsynopsis>
  42 </refsynopsisdiv>
  43
  44 <refsect1>
  45         <title>DESCRIPTION</title>
  46
  47         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
  48         <manvolnum>7</manvolnum></citerefentry> suite.</para>
  49
  50         <para>The pdbedit program is used to manage the users accounts
  51         stored in the sam database and can only be run by root.</para>
  52
  53         <para>The pdbedit tool uses the passdb modular interface and is
  54         independent from the kind of users database used (currently there
  55         are smbpasswd, ldap, nis+ and tdb based and more can be added
  56         without changing the tool).</para>
  57
  58         <para>There are five main ways to use pdbedit: adding a user account,
  59         removing a user account, modifing a user account, listing user
  60         accounts, importing users accounts.</para>
  61 </refsect1>
  62
  63 <refsect1>
  64         <title>OPTIONS</title>
  65         <variablelist>
  66                 <varlistentry>
  67                 <term>-L</term>
  68                 <listitem><para>This option lists all the user accounts
  69                 present in the users database.
  70                 This option prints a list of user/uid pairs separated by
  71                 the ':' character.</para>
  72                 <para>Example: <command>pdbedit -L</command></para>
  73                 <para><screen>
  74 sorce:500:Simo Sorce
  75 samba:45:Test User
  76 </screen></para>
  77                 </listitem>
  78                 </varlistentry>
  79
  80
  81
  82                 <varlistentry>
  83                 <term>-v</term>
  84                 <listitem><para>This option enables the verbose listing format.
  85                 It causes pdbedit to list the users in the database, printing
  86                 out the account fields in a descriptive format.</para>
  87
  88                 <para>Example: <command>pdbedit -L -v</command></para>
  89                 <para><screen>
  90 ---------------
  91 username:       sorce
  92 user ID/Group:  500/500
  93 user RID/GRID:  2000/2001
  94 Full Name:      Simo Sorce
  95 Home Directory: \\BERSERKER\sorce
  96 HomeDir Drive:  H:
  97 Logon Script:   \\BERSERKER\netlogon\sorce.bat
  98 Profile Path:   \\BERSERKER\profile
  99 ---------------
 100 username:       samba
 101 user ID/Group:  45/45
 102 user RID/GRID:  1090/1091
 103 Full Name:      Test User
 104 Home Directory: \\BERSERKER\samba
 105 HomeDir Drive:
 106 Logon Script:
 107 Profile Path:   \\BERSERKER\profile
 108 </screen></para>
 109                 </listitem>
 110                 </varlistentry>
 111
 112
 113
 114                 <varlistentry>
 115                 <term>-w</term>
 116                 <listitem><para>This option sets the "smbpasswd" listing format.
 117                 It will make pdbedit list the users in the database, printing
 118                 out the account fields in a format compatible with the
 119                 <filename>smbpasswd</filename> file format. (see the
 120                 <citerefentry><refentrytitle>smbpasswd</refentrytitle>
 121                 <manvolnum>5</manvolnum></citerefentry> for details)</para>
 122
 123                 <para>Example: <command>pdbedit -L -w</command></para>
 124                 <screen>
 125 sorce:500:508818B733CE64BEAAD3B435B51404EE:D2A2418EFC466A8A0F6B1DBB5C3DB80C:[UX         ]:LCT-00000000:
 126 samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX         ]:LCT-3BFA1E8D:
 127 </screen>
 128                 </listitem>
 129                 </varlistentry>
 130
 131
 132                 <varlistentry>
 133                 <term>-u username</term>
 134                 <listitem><para>This option specifies the username to be
 135                 used for the operation requested (listing, adding, removing).
 136                 It is <emphasis>required</emphasis> in add, remove and modify
 137                 operations and <emphasis>optional</emphasis> in list
 138                 operations.</para>
 139                 </listitem>
 140                 </varlistentry>
 141
 142                 <varlistentry>
 143                 <term>-f fullname</term>
 144                 <listitem><para>This option can be used while adding or
 145                 modifing a user account. It will specify the user's full
 146                 name. </para>
 147
 148                 <para>Example: <command>-f "Simo Sorce"</command></para>
 149                 </listitem>
 150                 </varlistentry>
 151
 152                 <varlistentry>
 153                 <term>-h homedir</term>
 154                 <listitem><para>This option can be used while adding or
 155                 modifing a user account. It will specify the user's home
 156                 directory network path.</para>
 157
 158                 <para>Example: <command>-h "\\\\BERSERKER\\sorce"</command>
 159                 </para>
 160                 </listitem>
 161                 </varlistentry>
 162
 163                 <varlistentry>
 164                 <term>-D drive</term>
 165                 <listitem><para>This option can be used while adding or
 166                 modifing a user account. It will specify the windows drive
 167                 letter to be used to map the home directory.</para>
 168
 169                 <para>Example: <command>-d "H:"</command>
 170                 </para>
 171                 </listitem>
 172                 </varlistentry>
 173
 174
 175                 <varlistentry>
 176                 <term>-S script</term>
 177                 <listitem><para>This option can be used while adding or
 178                 modifing a user account. It will specify the user's logon
 179                 script path.</para>
 180
 181                 <para>Example: <command>-S "\\\\BERSERKER\\netlogon\\sorce.bat"</command>
 182                 </para>
 183                 </listitem>
 184                 </varlistentry>
 185
 186
 187                 <varlistentry>
 188                 <term>-p profile</term>
 189                 <listitem><para>This option can be used while adding or
 190                 modifing a user account. It will specify the user's profile
 191                 directory.</para>
 192
 193                 <para>Example: <command>-p "\\\\BERSERKER\\netlogon"</command>
 194                 </para>
 195                 </listitem>
 196                 </varlistentry>
 197
 198                 <varlistentry>
 199                 <term>-G SID|rid</term>
 200                 <listitem><para>
 201                 This option can be used while adding or modifying a user account. It
 202                 will specify the users' new primary group SID (Security Identifier) or
 203                 rid. </para>
 204
 205                 <para>Example: <command>-G S-1-5-21-2447931902-1787058256-3961074038-1201</command></para>
 206                 </listitem>
 207                 </varlistentry>
 208
 209                 <varlistentry>
 210                 <term>-U SID|rid</term>
 211                 <listitem><para>
 212                 This option can be used while adding or modifying a user account. It
 213                 will specify the users' new SID (Security Identifier) or
 214                 rid. </para>
 215
 216                 <para>Example: <command>-U S-1-5-21-2447931902-1787058256-3961074038-5004</command></para>
 217                 </listitem>
 218                 </varlistentry>
 219
 220                 <varlistentry>
 221                 <term>-c account-control</term>
 222                 <listitem><para>This option can be used while adding or modifying a user
 223                                 account. It will specify the users' account control property. Possible flags are listed below.
 224         </para>
 225
 226         <para>
 227                 <itemizedlist>
 228                         <listitem><para>N: No password required</para></listitem>
 229                         <listitem><para>D: Account disabled</para></listitem>
 230                         <listitem><para>H: Home directory required</para></listitem>
 231                         <listitem><para>T: Temporary duplicate of other account</para></listitem>
 232                         <listitem><para>U: Regular user account</para></listitem>
 233                         <listitem><para>M: MNS logon user account</para></listitem>
 234                         <listitem><para>W: Workstation Trust Account</para></listitem>
 235                         <listitem><para>S: Server Trust Account</para></listitem>
 236                         <listitem><para>L: Automatic Locking</para></listitem>
 237                         <listitem><para>X: Password does not expire</para></listitem>
 238                         <listitem><para>I: Domain Trust Account</para></listitem>
 239                 </itemizedlist>
 240         </para>
 241
 242                 <para>Example: <command>-c "[X          ]"</command></para>
 243                 </listitem>
 244                 </varlistentry>
 245
 246                 <varlistentry>
 247                 <term>-a</term>
 248                 <listitem><para>This option is used to add a user into the
 249                 database. This command needs a user name specified with
 250                 the -u switch. When adding a new user, pdbedit will also
 251                 ask for the password to be used.</para>
 252
 253                 <para>Example: <command>pdbedit -a -u sorce</command>
 254 <programlisting>new password:
 255 retype new password
 256 </programlisting>
 257 </para>
 258
 259                 <note><para>pdbedit does not call the unix password syncronisation
 260                                 script if <smbconfoption name="unix password sync"/>
 261                                 has been set. It only updates the data in the Samba
 262                                 user database.
 263                         </para>
 264
 265                         <para>If you wish to add a user and synchronise the password
 266                                 that immediately, use <command>smbpasswd</command>'s <option>-a</option> option.
 267                         </para>
 268                 </note>
 269                 </listitem>
 270                 </varlistentry>
 271
 272                 <varlistentry>
 273                 <term>-r</term>
 274                 <listitem><para>This option is used to modify an existing user
 275                 in the database. This command needs a user name specified with the -u
 276                 switch. Other options can be specified to modify the properties of
 277                 the specified user. This flag is kept for backwards compatibility, but
 278                 it is no longer necessary to specify it.
 279                 </para></listitem>
 280                 </varlistentry>
 281
 282                 <varlistentry>
 283                 <term>-m</term>
 284                 <listitem><para>This option may only be used in conjunction
 285                 with the <parameter>-a</parameter> option. It will make
 286                 pdbedit to add a machine trust account instead of a user
 287                 account (-u username will provide the machine name).</para>
 288
 289                 <para>Example: <command>pdbedit -a -m -u w2k-wks</command>
 290                 </para>
 291                 </listitem>
 292                 </varlistentry>
 293
 294
 295                 <varlistentry>
 296                 <term>-x</term>
 297                 <listitem><para>This option causes pdbedit to delete an account
 298                 from the database. It needs a username specified with the
 299                 -u switch.</para>
 300
 301                 <para>Example: <command>pdbedit -x -u bob</command></para>
 302                 </listitem>
 303                 </varlistentry>
 304
 305
 306                 <varlistentry>
 307                 <term>-i passdb-backend</term>
 308                 <listitem><para>Use a different passdb backend to retrieve users
 309                 than the one specified in smb.conf. Can be used to import data into
 310                 your local user database.</para>
 311
 312                 <para>This option will ease migration from one passdb backend to
 313                 another.</para>
 314
 315                 <para>Example: <command>pdbedit -i smbpasswd:/etc/smbpasswd.old
 316                 </command></para>
 317                 </listitem>
 318                 </varlistentry>
 319
 320                 <varlistentry>
 321                 <term>-e passdb-backend</term>
 322                 <listitem><para>Exports all currently available users to the
 323                 specified password database backend.</para>
 324
 325                 <para>This option will ease migration from one passdb backend to
 326                 another and will ease backing up.</para>
 327
 328                 <para>Example: <command>pdbedit -e smbpasswd:/root/samba-users.backup</command></para>
 329                 </listitem>
 330                 </varlistentry>
 331
 332                 <varlistentry>
 333                 <term>-g</term>
 334                 <listitem><para>If you specify <parameter>-g</parameter>,
 335                 then <parameter>-i in-backend -e out-backend</parameter>
 336                 applies to the group mapping instead of the user database.</para>
 337
 338                 <para>This option will ease migration from one passdb backend to
 339                 another and will ease backing up.</para>
 340
 341                 </listitem>
 342                 </varlistentry>
 343
 344                 <varlistentry>
 345                 <term>-b passdb-backend</term>
 346                 <listitem><para>Use a different default passdb backend. </para>
 347
 348                 <para>Example: <command>pdbedit -b xml:/root/pdb-backup.xml -l</command></para>
 349                 </listitem>
 350                 </varlistentry>
 351
 352                 <varlistentry>
 353                 <term>-P account-policy</term>
 354                 <listitem><para>Display an account policy</para>
 355                 <para>Valid policies are: minimum password age, reset count minutes, disconnect time,
 356                 user must logon to change password, password history, lockout duration, min password length,
 357                 maximum password age and bad lockout attempt.</para>
 358
 359                 <para>Example: <command>pdbedit -P "bad lockout attempt"</command></para>
 360 <para><programlisting>
 361 account policy value for bad lockout attempt is 0
 362 </programlisting></para>
 363
 364                 </listitem>
 365                 </varlistentry>
 366
 367
 368                 <varlistentry>
 369                 <term>-C account-policy-value</term>
 370                 <listitem><para>Sets an account policy to a specified value.
 371                 This option may only be used in conjunction
 372                 with the <parameter>-P</parameter> option.
 373                 </para>
 374
 375                 <para>Example: <command>pdbedit -P "bad lockout attempt" -C 3</command></para>
 376 <para><programlisting>
 377 account policy value for bad lockout attempt was 0
 378 account policy value for bad lockout attempt is now 3
 379 </programlisting></para>
 380                 </listitem>
 381                 </varlistentry>
 382
 383                 &stdarg.help;
 384                 &popt.common.samba;
 385
 386         </variablelist>
 387 </refsect1>
 388
 389
 390 <refsect1>
 391         <title>NOTES</title>
 392
 393         <para>This command may be used only by root.</para>
 394 </refsect1>
 395
 396
 397 <refsect1>
 398         <title>VERSION</title>
 399
 400         <para>This man page is correct for version 3.0 of
 401         the Samba suite.</para>
 402 </refsect1>
 403
 404 <refsect1>
 405         <title>SEE ALSO</title>
 406         <para><citerefentry><refentrytitle>smbpasswd</refentrytitle>
 407         <manvolnum>5</manvolnum></citerefentry>, <citerefentry><refentrytitle>samba</refentrytitle>
 408         <manvolnum>7</manvolnum></citerefentry></para>
 409 </refsect1>
 410
 411 <refsect1>
 412         <title>AUTHOR</title>
 413
 414         <para>The original Samba software and related utilities
 415         were created by Andrew Tridgell. Samba is now developed
 416         by the Samba Team as an Open Source project similar
 417         to the way the Linux kernel is developed.</para>
 418
 419         <para>The pdbedit manpage was written by Simo Sorce and Jelmer Vernooij.</para>
 420
 421 </refsect1>
 422
 423 </refentry>