docs/manpages/pdbedit.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   3
   4 <!ENTITY % globalentities SYSTEM '../entities/global.entities'> %globalentities;
   5 ]>
   6 <refentry id="pdbedit.8">
   7
   8 <refmeta>
   9         <refentrytitle>pdbedit</refentrytitle>
  10         <manvolnum>8</manvolnum>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>pdbedit</refname>
  16         <refpurpose>manage the SAM database</refpurpose>
  17 </refnamediv>
  18
  19 <refsynopsisdiv>
  20         <cmdsynopsis>
  21                 <command>pdbedit</command>
  22                 <arg choice="opt">-L</arg>
  23                 <arg choice="opt">-v</arg>
  24                 <arg choice="opt">-w</arg>
  25                 <arg choice="opt">-u username</arg>
  26                 <arg choice="opt">-f fullname</arg>
  27                 <arg choice="opt">-h homedir</arg>
  28                 <arg choice="opt">-D drive</arg>
  29                 <arg choice="opt">-S script</arg>
  30                 <arg choice="opt">-p profile</arg>
  31                 <arg choice="opt">-a</arg>
  32                 <arg choice="opt">-m</arg>
  33                 <arg choice="opt">-r</arg>
  34                 <arg choice="opt">-x</arg>
  35                 <arg choice="opt">-i passdb-backend</arg>
  36                 <arg choice="opt">-e passdb-backend</arg>
  37                 <arg choice="opt">-b passdb-backend</arg>
  38                 <arg choice="opt">-g</arg>
  39                 <arg choice="opt">-d debuglevel</arg>
  40                 <arg choice="opt">-s configfile</arg>
  41                 <arg choice="opt">-P account-policy</arg>
  42                 <arg choice="opt">-C value</arg>
  43                 <arg choice="opt">-c account-control</arg>
  44         </cmdsynopsis>
  45 </refsynopsisdiv>
  46
  47 <refsect1>
  48         <title>DESCRIPTION</title>
  49
  50         <para>This tool is part of the <citerefentry><refentrytitle>Samba</refentrytitle>
  51         <manvolnum>7</manvolnum></citerefentry> suite.</para>
  52
  53         <para>The pdbedit program is used to manage the users accounts
  54         stored in the sam database and can only be run by root.</para>
  55
  56         <para>The pdbedit tool uses the passdb modular interface and is
  57         independent from the kind of users database used (currently there
  58         are smbpasswd, ldap, nis+ and tdb based and more can be added
  59         without changing the tool).</para>
  60
  61         <para>There are five main ways to use pdbedit: adding a user account,
  62         removing a user account, modifing a user account, listing user
  63         accounts, importing users accounts.</para>
  64 </refsect1>
  65
  66 <refsect1>
  67         <title>OPTIONS</title>
  68         <variablelist>
  69                 <varlistentry>
  70                 <term>-L</term>
  71                 <listitem><para>This option lists all the user accounts
  72                 present in the users database.
  73                 This option prints a list of user/uid pairs separated by
  74                 the ':' character.</para>
  75                 <para>Example: <command>pdbedit -L</command></para>
  76                 <para><screen>
  77 sorce:500:Simo Sorce
  78 samba:45:Test User
  79 </screen></para>
  80                 </listitem>
  81                 </varlistentry>
  82
  83
  84
  85                 <varlistentry>
  86                 <term>-v</term>
  87                 <listitem><para>This option enables the verbose listing format.
  88                 It causes pdbedit to list the users in the database, printing
  89                 out the account fields in a descriptive format.</para>
  90
  91                 <para>Example: <command>pdbedit -L -v</command></para>
  92                 <para><screen>
  93 ---------------
  94 username:       sorce
  95 user ID/Group:  500/500
  96 user RID/GRID:  2000/2001
  97 Full Name:      Simo Sorce
  98 Home Directory: \\BERSERKER\sorce
  99 HomeDir Drive:  H:
 100 Logon Script:   \\BERSERKER\netlogon\sorce.bat
 101 Profile Path:   \\BERSERKER\profile
 102 ---------------
 103 username:       samba
 104 user ID/Group:  45/45
 105 user RID/GRID:  1090/1091
 106 Full Name:      Test User
 107 Home Directory: \\BERSERKER\samba
 108 HomeDir Drive:
 109 Logon Script:
 110 Profile Path:   \\BERSERKER\profile
 111 </screen></para>
 112                 </listitem>
 113                 </varlistentry>
 114
 115
 116
 117                 <varlistentry>
 118                 <term>-w</term>
 119                 <listitem><para>This option sets the "smbpasswd" listing format.
 120                 It will make pdbedit list the users in the database, printing
 121                 out the account fields in a format compatible with the
 122                 <filename>smbpasswd</filename> file format. (see the
 123                 <citerefentry><refentrytitle>smbpasswd</refentrytitle>
 124                 <manvolnum>5</manvolnum></citerefentry> for details)</para>
 125
 126                 <para>Example: <command>pdbedit -L -w</command></para>
 127                 <screen>
 128 sorce:500:508818B733CE64BEAAD3B435B51404EE:D2A2418EFC466A8A0F6B1DBB5C3DB80C:[UX         ]:LCT-00000000:
 129 samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX         ]:LCT-3BFA1E8D:
 130 </screen>
 131                 </listitem>
 132                 </varlistentry>
 133
 134
 135                 <varlistentry>
 136                 <term>-u username</term>
 137                 <listitem><para>This option specifies the username to be
 138                 used for the operation requested (listing, adding, removing).
 139                 It is <emphasis>required</emphasis> in add, remove and modify
 140                 operations and <emphasis>optional</emphasis> in list
 141                 operations.</para>
 142                 </listitem>
 143                 </varlistentry>
 144
 145                 <varlistentry>
 146                 <term>-f fullname</term>
 147                 <listitem><para>This option can be used while adding or
 148                 modifing a user account. It will specify the user's full
 149                 name. </para>
 150
 151                 <para>Example: <command>-f "Simo Sorce"</command></para>
 152                 </listitem>
 153                 </varlistentry>
 154
 155                 <varlistentry>
 156                 <term>-h homedir</term>
 157                 <listitem><para>This option can be used while adding or
 158                 modifing a user account. It will specify the user's home
 159                 directory network path.</para>
 160
 161                 <para>Example: <command>-h "\\\\BERSERKER\\sorce"</command>
 162                 </para>
 163                 </listitem>
 164                 </varlistentry>
 165
 166                 <varlistentry>
 167                 <term>-D drive</term>
 168                 <listitem><para>This option can be used while adding or
 169                 modifing a user account. It will specify the windows drive
 170                 letter to be used to map the home directory.</para>
 171
 172                 <para>Example: <command>-d "H:"</command>
 173                 </para>
 174                 </listitem>
 175                 </varlistentry>
 176
 177
 178                 <varlistentry>
 179                 <term>-S script</term>
 180                 <listitem><para>This option can be used while adding or
 181                 modifing a user account. It will specify the user's logon
 182                 script path.</para>
 183
 184                 <para>Example: <command>-s "\\\\BERSERKER\\netlogon\\sorce.bat"</command>
 185                 </para>
 186                 </listitem>
 187                 </varlistentry>
 188
 189
 190                 <varlistentry>
 191                 <term>-p profile</term>
 192                 <listitem><para>This option can be used while adding or
 193                 modifing a user account. It will specify the user's profile
 194                 directory.</para>
 195
 196                 <para>Example: <command>-p "\\\\BERSERKER\\netlogon"</command>
 197                 </para>
 198                 </listitem>
 199                 </varlistentry>
 200
 201                 <varlistentry>
 202                 <term>-G SID|rid</term>
 203                 <listitem><para>
 204                 This option can be used while adding or modifying a user account. It
 205                 will specify the users' new primary group SID (Security Identifier) or
 206                 rid. </para>
 207
 208                 <para>Example: <command>-G S-1-5-21-2447931902-1787058256-3961074038-1201</command></para>
 209                 </listitem>
 210                 </varlistentry>
 211
 212                 <varlistentry>
 213                 <term>-U SID|rid</term>
 214                 <listitem><para>
 215                 This option can be used while adding or modifying a user account. It
 216                 will specify the users' new SID (Security Identifier) or
 217                 rid. </para>
 218
 219                 <para>Example: <command>-U S-1-5-21-2447931902-1787058256-3961074038-5004</command></para>
 220                 </listitem>
 221                 </varlistentry>
 222
 223                 <varlistentry>
 224                 <term>-c account-control</term>
 225                 <listitem><para>This option can be used while adding or modifying a user
 226                                 account. It will specify the users' account control property. Possible flags are listed below.
 227         </para>
 228
 229         <para>
 230                 <itemizedlist>
 231                         <listitem><para>N: No password required</para></listitem>
 232                         <listitem><para>D: Account disabled</para></listitem>
 233                         <listitem><para>H: Home directory required</para></listitem>
 234                         <listitem><para>T: Temporary duplicate of other account</para></listitem>
 235                         <listitem><para>U: Regular user account</para></listitem>
 236                         <listitem><para>M: MNS logon user account</para></listitem>
 237                         <listitem><para>W: Workstation Trust Account</para></listitem>
 238                         <listitem><para>S: Server Trust Account</para></listitem>
 239                         <listitem><para>L: Automatic Locking</para></listitem>
 240                         <listitem><para>X: Password does not expire</para></listitem>
 241                         <listitem><para>I: Domain Trust Account</para></listitem>
 242                 </itemizedlist>
 243         </para>
 244
 245                 <para>Example: <command>-c "[X          ]"</command></para>
 246                 </listitem>
 247                 </varlistentry>
 248
 249                 <varlistentry>
 250                 <term>-a</term>
 251                 <listitem><para>This option is used to add a user into the
 252                 database. This command needs a user name specified with
 253                 the -u switch. When adding a new user, pdbedit will also
 254                 ask for the password to be used.</para>
 255
 256                 <para>Example: <command>pdbedit -a -u sorce</command>
 257 <programlisting>new password:
 258 retype new password
 259 </programlisting>
 260 </para>
 261
 262                 <note><para>pdbedit does not call the unix password syncronisation
 263                                 script if <smbconfoption><name>unix password sync</name></smbconfoption>
 264                                 has been set. It only updates the data in the Samba
 265                                 user database.
 266                         </para>
 267
 268                         <para>If you wish to add a user and synchronise the password
 269                                 that immediately, use <command>smbpasswd</command>'s <option>-a</option> option.
 270                         </para>
 271                 </note>
 272                 </listitem>
 273                 </varlistentry>
 274
 275                 <varlistentry>
 276                 <term>-r</term>
 277                 <listitem><para>This option is used to modify an existing user
 278                 in the database. This command needs a user name specified with the -u
 279                 switch. Other options can be specified to modify the properties of
 280                 the specified user. This flag is kept for backwards compatibility, but
 281                 it is no longer necessary to specify it.
 282                 </para></listitem>
 283                 </varlistentry>
 284
 285                 <varlistentry>
 286                 <term>-m</term>
 287                 <listitem><para>This option may only be used in conjunction
 288                 with the <parameter>-a</parameter> option. It will make
 289                 pdbedit to add a machine trust account instead of a user
 290                 account (-u username will provide the machine name).</para>
 291
 292                 <para>Example: <command>pdbedit -a -m -u w2k-wks</command>
 293                 </para>
 294                 </listitem>
 295                 </varlistentry>
 296
 297
 298                 <varlistentry>
 299                 <term>-x</term>
 300                 <listitem><para>This option causes pdbedit to delete an account
 301                 from the database. It needs a username specified with the
 302                 -u switch.</para>
 303
 304                 <para>Example: <command>pdbedit -x -u bob</command></para>
 305                 </listitem>
 306                 </varlistentry>
 307
 308
 309                 <varlistentry>
 310                 <term>-i passdb-backend</term>
 311                 <listitem><para>Use a different passdb backend to retrieve users
 312                 than the one specified in smb.conf. Can be used to import data into
 313                 your local user database.</para>
 314
 315                 <para>This option will ease migration from one passdb backend to
 316                 another.</para>
 317
 318                 <para>Example: <command>pdbedit -i smbpasswd:/etc/smbpasswd.old
 319                 </command></para>
 320                 </listitem>
 321                 </varlistentry>
 322
 323                 <varlistentry>
 324                 <term>-e passdb-backend</term>
 325                 <listitem><para>Exports all currently available users to the
 326                 specified password database backend.</para>
 327
 328                 <para>This option will ease migration from one passdb backend to
 329                 another and will ease backing up.</para>
 330
 331                 <para>Example: <command>pdbedit -e smbpasswd:/root/samba-users.backup</command></para>
 332                 </listitem>
 333                 </varlistentry>
 334
 335                 <varlistentry>
 336                 <term>-g</term>
 337                 <listitem><para>If you specify <parameter>-g</parameter>,
 338                 then <parameter>-i in-backend -e out-backend</parameter>
 339                 applies to the group mapping instead of the user database.</para>
 340
 341                 <para>This option will ease migration from one passdb backend to
 342                 another and will ease backing up.</para>
 343
 344                 </listitem>
 345                 </varlistentry>
 346
 347                 <varlistentry>
 348                 <term>-b passdb-backend</term>
 349                 <listitem><para>Use a different default passdb backend. </para>
 350
 351                 <para>Example: <command>pdbedit -b xml:/root/pdb-backup.xml -l</command></para>
 352                 </listitem>
 353                 </varlistentry>
 354
 355                 <varlistentry>
 356                 <term>-P account-policy</term>
 357                 <listitem><para>Display an account policy</para>
 358                 <para>Valid policies are: minimum password age, reset count minutes, disconnect time,
 359                 user must logon to change password, password history, lockout duration, min password length,
 360                 maximum password age and bad lockout attempt.</para>
 361
 362                 <para>Example: <command>pdbedit -P "bad lockout attempt"</command></para>
 363 <para><programlisting>
 364 account policy value for bad lockout attempt is 0
 365 </programlisting></para>
 366
 367                 </listitem>
 368                 </varlistentry>
 369
 370
 371                 <varlistentry>
 372                 <term>-C account-policy-value</term>
 373                 <listitem><para>Sets an account policy to a specified value.
 374                 This option may only be used in conjunction
 375                 with the <parameter>-P</parameter> option.
 376                 </para>
 377
 378                 <para>Example: <command>pdbedit -P "bad lockout attempt" -C 3</command></para>
 379 <para><programlisting>
 380 account policy value for bad lockout attempt was 0
 381 account policy value for bad lockout attempt is now 3
 382 </programlisting></para>
 383                 </listitem>
 384                 </varlistentry>
 385
 386                 &stdarg.help;
 387                 &popt.common.samba;
 388
 389         </variablelist>
 390 </refsect1>
 391
 392
 393 <refsect1>
 394         <title>NOTES</title>
 395
 396         <para>This command may be used only by root.</para>
 397 </refsect1>
 398
 399
 400 <refsect1>
 401         <title>VERSION</title>
 402
 403         <para>This man page is correct for version 3.0 of
 404         the Samba suite.</para>
 405 </refsect1>
 406
 407 <refsect1>
 408         <title>SEE ALSO</title>
 409         <para><citerefentry><refentrytitle>smbpasswd</refentrytitle>
 410         <manvolnum>5</manvolnum></citerefentry>, <citerefentry><refentrytitle>samba</refentrytitle>
 411         <manvolnum>7</manvolnum></citerefentry></para>
 412 </refsect1>
 413
 414 <refsect1>
 415         <title>AUTHOR</title>
 416
 417         <para>The original Samba software and related utilities
 418         were created by Andrew Tridgell. Samba is now developed
 419         by the Samba Team as an Open Source project similar
 420         to the way the Linux kernel is developed.</para>
 421
 422         <para>The pdbedit manpage was written by Simo Sorce and Jelmer Vernooij.</para>
 423
 424 </refsect1>
 425
 426 </refentry>