docs/htmldocs/pwencrypt.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   2 <HTML
   3 ><HEAD
   4 ><TITLE
   5 >LanMan and NT Password Encryption in Samba</TITLE
   6 ><META
   7 NAME="GENERATOR"
   8 CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+
   9 "><LINK
  10 REL="HOME"
  11 TITLE="SAMBA Project Documentation"
  12 HREF="samba-howto-collection.html"><LINK
  13 REL="UP"
  14 TITLE="General installation"
  15 HREF="introduction.html"><LINK
  16 REL="PREVIOUS"
  17 TITLE="Quick Cross Subnet Browsing / Cross Workgroup Browsing guide"
  18 HREF="browsing-quick.html"><LINK
  19 REL="NEXT"
  20 TITLE="Type of installation"
  21 HREF="type.html"></HEAD
  22 ><BODY
  23 CLASS="CHAPTER"
  24 BGCOLOR="#FFFFFF"
  25 TEXT="#000000"
  26 LINK="#0000FF"
  27 VLINK="#840084"
  28 ALINK="#0000FF"
  29 ><DIV
  30 CLASS="NAVHEADER"
  31 ><TABLE
  32 SUMMARY="Header navigation table"
  33 WIDTH="100%"
  34 BORDER="0"
  35 CELLPADDING="0"
  36 CELLSPACING="0"
  37 ><TR
  38 ><TH
  39 COLSPAN="3"
  40 ALIGN="center"
  41 >SAMBA Project Documentation</TH
  42 ></TR
  43 ><TR
  44 ><TD
  45 WIDTH="10%"
  46 ALIGN="left"
  47 VALIGN="bottom"
  48 ><A
  49 HREF="browsing-quick.html"
  50 ACCESSKEY="P"
  51 >Prev</A
  52 ></TD
  53 ><TD
  54 WIDTH="80%"
  55 ALIGN="center"
  56 VALIGN="bottom"
  57 ></TD
  58 ><TD
  59 WIDTH="10%"
  60 ALIGN="right"
  61 VALIGN="bottom"
  62 ><A
  63 HREF="type.html"
  64 ACCESSKEY="N"
  65 >Next</A
  66 ></TD
  67 ></TR
  68 ></TABLE
  69 ><HR
  70 ALIGN="LEFT"
  71 WIDTH="100%"></DIV
  72 ><DIV
  73 CLASS="CHAPTER"
  74 ><H1
  75 ><A
  76 NAME="PWENCRYPT">Chapter 4. LanMan and NT Password Encryption in Samba</H1
  77 ><DIV
  78 CLASS="SECT1"
  79 ><H1
  80 CLASS="SECT1"
  81 ><A
  82 NAME="AEN457">4.1. Introduction</H1
  83 ><P
  84 >Newer windows clients send encrypted passwords over
  85         the wire, instead of plain text passwords. The newest clients
  86         will only send encrypted passwords and refuse to send plain text
  87         passwords, unless their registry is tweaked.</P
  88 ><P
  89 >These passwords can't be converted to unix style encrypted
  90         passwords. Because of that you can't use the standard unix
  91         user database, and you have to store the Lanman and NT hashes
  92         somewhere else. For more information, see the documentation
  93         about the <B
  94 CLASS="COMMAND"
  95 >passdb backend = </B
  96 > parameter.
  97         </P
  98 ></DIV
  99 ><DIV
 100 CLASS="SECT1"
 101 ><H1
 102 CLASS="SECT1"
 103 ><A
 104 NAME="AEN462">4.2. Important Notes About Security</H1
 105 ><P
 106 >The unix and SMB password encryption techniques seem similar
 107         on the surface. This similarity is, however, only skin deep. The unix
 108         scheme typically sends clear text passwords over the network when
 109         logging in. This is bad. The SMB encryption scheme never sends the
 110         cleartext password over the network but it does store the 16 byte
 111         hashed values on disk. This is also bad. Why? Because the 16 byte hashed
 112         values are a "password equivalent". You cannot derive the user's
 113         password from them, but they could potentially be used in a modified
 114         client to gain access to a server. This would require considerable
 115         technical knowledge on behalf of the attacker but is perfectly possible.
 116         You should thus treat the smbpasswd file as though it contained the
 117         cleartext passwords of all your users. Its contents must be kept
 118         secret, and the file should be protected accordingly.</P
 119 ><P
 120 >Ideally we would like a password scheme which neither requires
 121         plain text passwords on the net or on disk. Unfortunately this
 122         is not available as Samba is stuck with being compatible with
 123         other SMB systems (WinNT, WfWg, Win95 etc). </P
 124 ><DIV
 125 CLASS="WARNING"
 126 ><P
 127 ></P
 128 ><TABLE
 129 CLASS="WARNING"
 130 WIDTH="100%"
 131 BORDER="0"
 132 ><TR
 133 ><TD
 134 WIDTH="25"
 135 ALIGN="CENTER"
 136 VALIGN="TOP"
 137 ><IMG
 138 SRC="../images/warning.gif"
 139 HSPACE="5"
 140 ALT="Warning"></TD
 141 ><TD
 142 ALIGN="LEFT"
 143 VALIGN="TOP"
 144 ><P
 145 >Note that Windows NT 4.0 Service pack 3 changed the
 146                 default for permissible authentication so that plaintext
 147                 passwords are <SPAN
 148 CLASS="emphasis"
 149 ><I
 150 CLASS="EMPHASIS"
 151 >never</I
 152 ></SPAN
 153 > sent over the wire.
 154                 The solution to this is either to switch to encrypted passwords
 155                 with Samba or edit the Windows NT registry to re-enable plaintext
 156                 passwords. See the document WinNT.txt for details on how to do
 157                 this.</P
 158 ><P
 159 >Other Microsoft operating systems which also exhibit
 160                 this behavior includes</P
 161 ><P
 162 ></P
 163 ><UL
 164 ><LI
 165 ><P
 166 >MS DOS Network client 3.0 with
 167                         the basic network redirector installed</P
 168 ></LI
 169 ><LI
 170 ><P
 171 >Windows 95 with the network redirector
 172                         update installed</P
 173 ></LI
 174 ><LI
 175 ><P
 176 >Windows 98 [se]</P
 177 ></LI
 178 ><LI
 179 ><P
 180 >Windows 2000</P
 181 ></LI
 182 ></UL
 183 ><P
 184 ><SPAN
 185 CLASS="emphasis"
 186 ><I
 187 CLASS="EMPHASIS"
 188 >Note :</I
 189 ></SPAN
 190 >All current release of
 191                 Microsoft SMB/CIFS clients support authentication via the
 192                 SMB Challenge/Response mechanism described here.  Enabling
 193                 clear text authentication does not disable the ability
 194                 of the client to participate in encrypted authentication.</P
 195 ></TD
 196 ></TR
 197 ></TABLE
 198 ></DIV
 199 ><DIV
 200 CLASS="SECT2"
 201 ><H2
 202 CLASS="SECT2"
 203 ><A
 204 NAME="AEN481">4.2.1. Advantages of SMB Encryption</H2
 205 ><P
 206 ></P
 207 ><UL
 208 ><LI
 209 ><P
 210 >plain text passwords are not passed across
 211                         the network. Someone using a network sniffer cannot just
 212                         record passwords going to the SMB server.</P
 213 ></LI
 214 ><LI
 215 ><P
 216 >WinNT doesn't like talking to a server
 217                         that isn't using SMB encrypted passwords. It will refuse
 218                         to browse the server if the server is also in user level
 219                         security mode. It will insist on prompting the user for the
 220                         password on each connection, which is very annoying. The
 221                         only things you can do to stop this is to use SMB encryption.
 222                         </P
 223 ></LI
 224 ></UL
 225 ></DIV
 226 ><DIV
 227 CLASS="SECT2"
 228 ><H2
 229 CLASS="SECT2"
 230 ><A
 231 NAME="AEN488">4.2.2. Advantages of non-encrypted passwords</H2
 232 ><P
 233 ></P
 234 ><UL
 235 ><LI
 236 ><P
 237 >plain text passwords are not kept
 238                         on disk. </P
 239 ></LI
 240 ><LI
 241 ><P
 242 >uses same password file as other unix
 243                         services such as login and ftp</P
 244 ></LI
 245 ><LI
 246 ><P
 247 >you are probably already using other
 248                         services (such as telnet and ftp) which send plain text
 249                         passwords over the net, so sending them for SMB isn't
 250                         such a big deal.</P
 251 ></LI
 252 ></UL
 253 ></DIV
 254 ></DIV
 255 ><DIV
 256 CLASS="SECT1"
 257 ><H1
 258 CLASS="SECT1"
 259 ><A
 260 NAME="AEN497">4.3. The smbpasswd Command</H1
 261 ><P
 262 >The smbpasswd command maintains the two 32 byte password fields
 263         in the smbpasswd file. If you wish to make it similar to the unix
 264         <B
 265 CLASS="COMMAND"
 266 >passwd</B
 267 > or <B
 268 CLASS="COMMAND"
 269 >yppasswd</B
 270 > programs,
 271         install it in <TT
 272 CLASS="FILENAME"
 273 >/usr/local/samba/bin/</TT
 274 > (or your
 275         main Samba binary directory).</P
 276 ><P
 277 ><B
 278 CLASS="COMMAND"
 279 >smbpasswd</B
 280 > now works in a client-server mode
 281         where it contacts the local smbd to change the user's password on its
 282         behalf. This has enormous benefits - as follows.</P
 283 ><P
 284 ><B
 285 CLASS="COMMAND"
 286 >smbpasswd</B
 287 > now has the capability
 288         to change passwords on Windows NT servers (this only works when
 289         the request is sent to the NT Primary Domain Controller if you
 290         are changing an NT Domain user's password).</P
 291 ><P
 292 >To run smbpasswd as a normal user just type :</P
 293 ><P
 294 ><TT
 295 CLASS="PROMPT"
 296 >$ </TT
 297 ><TT
 298 CLASS="USERINPUT"
 299 ><B
 300 >smbpasswd</B
 301 ></TT
 302 ></P
 303 ><P
 304 ><TT
 305 CLASS="PROMPT"
 306 >Old SMB password: </TT
 307 ><TT
 308 CLASS="USERINPUT"
 309 ><B
 310 >&lt;type old value here -
 311         or hit return if there was no old password&gt;</B
 312 ></TT
 313 ></P
 314 ><P
 315 ><TT
 316 CLASS="PROMPT"
 317 >New SMB Password: </TT
 318 ><TT
 319 CLASS="USERINPUT"
 320 ><B
 321 >&lt;type new value&gt;
 322         </B
 323 ></TT
 324 ></P
 325 ><P
 326 ><TT
 327 CLASS="PROMPT"
 328 >Repeat New SMB Password: </TT
 329 ><TT
 330 CLASS="USERINPUT"
 331 ><B
 332 >&lt;re-type new value
 333         </B
 334 ></TT
 335 ></P
 336 ><P
 337 >If the old value does not match the current value stored for
 338         that user, or the two new values do not match each other, then the
 339         password will not be changed.</P
 340 ><P
 341 >If invoked by an ordinary user it will only allow the user
 342         to change his or her own Samba password.</P
 343 ><P
 344 >If run by the root user smbpasswd may take an optional
 345         argument, specifying the user name whose SMB password you wish to
 346         change.  Note that when run as root smbpasswd does not prompt for
 347         or check the old password value, thus allowing root to set passwords
 348         for users who have forgotten their passwords.</P
 349 ><P
 350 ><B
 351 CLASS="COMMAND"
 352 >smbpasswd</B
 353 > is designed to work in the same way
 354         and be familiar to UNIX users who use the <B
 355 CLASS="COMMAND"
 356 >passwd</B
 357 > or
 358         <B
 359 CLASS="COMMAND"
 360 >yppasswd</B
 361 > commands.</P
 362 ><P
 363 >For more details on using <B
 364 CLASS="COMMAND"
 365 >smbpasswd</B
 366 > refer
 367         to the man page which will always be the definitive reference.</P
 368 ></DIV
 369 ></DIV
 370 ><DIV
 371 CLASS="NAVFOOTER"
 372 ><HR
 373 ALIGN="LEFT"
 374 WIDTH="100%"><TABLE
 375 SUMMARY="Footer navigation table"
 376 WIDTH="100%"
 377 BORDER="0"
 378 CELLPADDING="0"
 379 CELLSPACING="0"
 380 ><TR
 381 ><TD
 382 WIDTH="33%"
 383 ALIGN="left"
 384 VALIGN="top"
 385 ><A
 386 HREF="browsing-quick.html"
 387 ACCESSKEY="P"
 388 >Prev</A
 389 ></TD
 390 ><TD
 391 WIDTH="34%"
 392 ALIGN="center"
 393 VALIGN="top"
 394 ><A
 395 HREF="samba-howto-collection.html"
 396 ACCESSKEY="H"
 397 >Home</A
 398 ></TD
 399 ><TD
 400 WIDTH="33%"
 401 ALIGN="right"
 402 VALIGN="top"
 403 ><A
 404 HREF="type.html"
 405 ACCESSKEY="N"
 406 >Next</A
 407 ></TD
 408 ></TR
 409 ><TR
 410 ><TD
 411 WIDTH="33%"
 412 ALIGN="left"
 413 VALIGN="top"
 414 >Quick Cross Subnet Browsing / Cross Workgroup Browsing guide</TD
 415 ><TD
 416 WIDTH="34%"
 417 ALIGN="center"
 418 VALIGN="top"
 419 ><A
 420 HREF="introduction.html"
 421 ACCESSKEY="U"
 422 >Up</A
 423 ></TD
 424 ><TD
 425 WIDTH="33%"
 426 ALIGN="right"
 427 VALIGN="top"
 428 >Type of installation</TD
 429 ></TR
 430 ></TABLE
 431 ></DIV
 432 ></BODY
 433 ></HTML
 434 >