docs/htmldocs/pwencrypt.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   2 <HTML
   3 ><HEAD
   4 ><TITLE
   5 >LanMan and NT Password Encryption in Samba</TITLE
   6 ><META
   7 NAME="GENERATOR"
   8 CONTENT="Modular DocBook HTML Stylesheet Version 1.77"><LINK
   9 REL="HOME"
  10 TITLE="SAMBA Project Documentation"
  11 HREF="samba-howto-collection.html"><LINK
  12 REL="UP"
  13 TITLE="General installation"
  14 HREF="introduction.html"><LINK
  15 REL="PREVIOUS"
  16 TITLE="Quick Cross Subnet Browsing / Cross Workgroup Browsing guide"
  17 HREF="browsing-quick.html"><LINK
  18 REL="NEXT"
  19 TITLE="Type of installation"
  20 HREF="type.html"></HEAD
  21 ><BODY
  22 CLASS="CHAPTER"
  23 BGCOLOR="#FFFFFF"
  24 TEXT="#000000"
  25 LINK="#0000FF"
  26 VLINK="#840084"
  27 ALINK="#0000FF"
  28 ><DIV
  29 CLASS="NAVHEADER"
  30 ><TABLE
  31 SUMMARY="Header navigation table"
  32 WIDTH="100%"
  33 BORDER="0"
  34 CELLPADDING="0"
  35 CELLSPACING="0"
  36 ><TR
  37 ><TH
  38 COLSPAN="3"
  39 ALIGN="center"
  40 >SAMBA Project Documentation</TH
  41 ></TR
  42 ><TR
  43 ><TD
  44 WIDTH="10%"
  45 ALIGN="left"
  46 VALIGN="bottom"
  47 ><A
  48 HREF="browsing-quick.html"
  49 ACCESSKEY="P"
  50 >Prev</A
  51 ></TD
  52 ><TD
  53 WIDTH="80%"
  54 ALIGN="center"
  55 VALIGN="bottom"
  56 ></TD
  57 ><TD
  58 WIDTH="10%"
  59 ALIGN="right"
  60 VALIGN="bottom"
  61 ><A
  62 HREF="type.html"
  63 ACCESSKEY="N"
  64 >Next</A
  65 ></TD
  66 ></TR
  67 ></TABLE
  68 ><HR
  69 ALIGN="LEFT"
  70 WIDTH="100%"></DIV
  71 ><DIV
  72 CLASS="CHAPTER"
  73 ><H1
  74 ><A
  75 NAME="PWENCRYPT"
  76 ></A
  77 >Chapter 5. LanMan and NT Password Encryption in Samba</H1
  78 ><DIV
  79 CLASS="SECT1"
  80 ><H1
  81 CLASS="SECT1"
  82 ><A
  83 NAME="AEN473"
  84 ></A
  85 >5.1. Introduction</H1
  86 ><P
  87 >Newer windows clients send encrypted passwords over
  88         the wire, instead of plain text passwords. The newest clients
  89         will only send encrypted passwords and refuse to send plain text
  90         passwords, unless their registry is tweaked.</P
  91 ><P
  92 >These passwords can't be converted to unix style encrypted
  93         passwords. Because of that you can't use the standard unix
  94         user database, and you have to store the Lanman and NT hashes
  95         somewhere else. For more information, see the documentation
  96         about the <B
  97 CLASS="COMMAND"
  98 >passdb backend = </B
  99 > parameter.
 100         </P
 101 ></DIV
 102 ><DIV
 103 CLASS="SECT1"
 104 ><H1
 105 CLASS="SECT1"
 106 ><A
 107 NAME="AEN478"
 108 ></A
 109 >5.2. Important Notes About Security</H1
 110 ><P
 111 >The unix and SMB password encryption techniques seem similar
 112         on the surface. This similarity is, however, only skin deep. The unix
 113         scheme typically sends clear text passwords over the network when
 114         logging in. This is bad. The SMB encryption scheme never sends the
 115         cleartext password over the network but it does store the 16 byte
 116         hashed values on disk. This is also bad. Why? Because the 16 byte hashed
 117         values are a "password equivalent". You cannot derive the user's
 118         password from them, but they could potentially be used in a modified
 119         client to gain access to a server. This would require considerable
 120         technical knowledge on behalf of the attacker but is perfectly possible.
 121         You should thus treat the smbpasswd file as though it contained the
 122         cleartext passwords of all your users. Its contents must be kept
 123         secret, and the file should be protected accordingly.</P
 124 ><P
 125 >Ideally we would like a password scheme which neither requires
 126         plain text passwords on the net or on disk. Unfortunately this
 127         is not available as Samba is stuck with being compatible with
 128         other SMB systems (WinNT, WfWg, Win95 etc). </P
 129 ><DIV
 130 CLASS="WARNING"
 131 ><P
 132 ></P
 133 ><TABLE
 134 CLASS="WARNING"
 135 WIDTH="100%"
 136 BORDER="0"
 137 ><TR
 138 ><TD
 139 WIDTH="25"
 140 ALIGN="CENTER"
 141 VALIGN="TOP"
 142 ><IMG
 143 SRC="/docbook-dsssl/warning.gif"
 144 HSPACE="5"
 145 ALT="Warning"></TD
 146 ><TD
 147 ALIGN="LEFT"
 148 VALIGN="TOP"
 149 ><P
 150 >Note that Windows NT 4.0 Service pack 3 changed the
 151                 default for permissible authentication so that plaintext
 152                 passwords are <SPAN
 153 CLASS="emphasis"
 154 ><I
 155 CLASS="EMPHASIS"
 156 >never</I
 157 ></SPAN
 158 > sent over the wire.
 159                 The solution to this is either to switch to encrypted passwords
 160                 with Samba or edit the Windows NT registry to re-enable plaintext
 161                 passwords. See the document WinNT.txt for details on how to do
 162                 this.</P
 163 ><P
 164 >Other Microsoft operating systems which also exhibit
 165                 this behavior includes</P
 166 ><P
 167 ></P
 168 ><UL
 169 ><LI
 170 ><P
 171 >MS DOS Network client 3.0 with
 172                         the basic network redirector installed</P
 173 ></LI
 174 ><LI
 175 ><P
 176 >Windows 95 with the network redirector
 177                         update installed</P
 178 ></LI
 179 ><LI
 180 ><P
 181 >Windows 98 [se]</P
 182 ></LI
 183 ><LI
 184 ><P
 185 >Windows 2000</P
 186 ></LI
 187 ></UL
 188 ><P
 189 ><SPAN
 190 CLASS="emphasis"
 191 ><I
 192 CLASS="EMPHASIS"
 193 >Note :</I
 194 ></SPAN
 195 >All current release of
 196                 Microsoft SMB/CIFS clients support authentication via the
 197                 SMB Challenge/Response mechanism described here.  Enabling
 198                 clear text authentication does not disable the ability
 199                 of the client to participate in encrypted authentication.</P
 200 ></TD
 201 ></TR
 202 ></TABLE
 203 ></DIV
 204 ><DIV
 205 CLASS="SECT2"
 206 ><H2
 207 CLASS="SECT2"
 208 ><A
 209 NAME="AEN497"
 210 ></A
 211 >5.2.1. Advantages of SMB Encryption</H2
 212 ><P
 213 ></P
 214 ><UL
 215 ><LI
 216 ><P
 217 >plain text passwords are not passed across
 218                         the network. Someone using a network sniffer cannot just
 219                         record passwords going to the SMB server.</P
 220 ></LI
 221 ><LI
 222 ><P
 223 >WinNT doesn't like talking to a server
 224                         that isn't using SMB encrypted passwords. It will refuse
 225                         to browse the server if the server is also in user level
 226                         security mode. It will insist on prompting the user for the
 227                         password on each connection, which is very annoying. The
 228                         only things you can do to stop this is to use SMB encryption.
 229                         </P
 230 ></LI
 231 ></UL
 232 ></DIV
 233 ><DIV
 234 CLASS="SECT2"
 235 ><H2
 236 CLASS="SECT2"
 237 ><A
 238 NAME="AEN504"
 239 ></A
 240 >5.2.2. Advantages of non-encrypted passwords</H2
 241 ><P
 242 ></P
 243 ><UL
 244 ><LI
 245 ><P
 246 >plain text passwords are not kept
 247                         on disk. </P
 248 ></LI
 249 ><LI
 250 ><P
 251 >uses same password file as other unix
 252                         services such as login and ftp</P
 253 ></LI
 254 ><LI
 255 ><P
 256 >you are probably already using other
 257                         services (such as telnet and ftp) which send plain text
 258                         passwords over the net, so sending them for SMB isn't
 259                         such a big deal.</P
 260 ></LI
 261 ></UL
 262 ></DIV
 263 ></DIV
 264 ><DIV
 265 CLASS="SECT1"
 266 ><H1
 267 CLASS="SECT1"
 268 ><A
 269 NAME="AEN513"
 270 ></A
 271 >5.3. The smbpasswd Command</H1
 272 ><P
 273 >The smbpasswd command maintains the two 32 byte password fields
 274         in the smbpasswd file. If you wish to make it similar to the unix
 275         <B
 276 CLASS="COMMAND"
 277 >passwd</B
 278 > or <B
 279 CLASS="COMMAND"
 280 >yppasswd</B
 281 > programs,
 282         install it in <TT
 283 CLASS="FILENAME"
 284 >/usr/local/samba/bin/</TT
 285 > (or your
 286         main Samba binary directory).</P
 287 ><P
 288 ><B
 289 CLASS="COMMAND"
 290 >smbpasswd</B
 291 > now works in a client-server mode
 292         where it contacts the local smbd to change the user's password on its
 293         behalf. This has enormous benefits - as follows.</P
 294 ><P
 295 ><B
 296 CLASS="COMMAND"
 297 >smbpasswd</B
 298 > now has the capability
 299         to change passwords on Windows NT servers (this only works when
 300         the request is sent to the NT Primary Domain Controller if you
 301         are changing an NT Domain user's password).</P
 302 ><P
 303 >To run smbpasswd as a normal user just type :</P
 304 ><P
 305 ><TT
 306 CLASS="PROMPT"
 307 >$ </TT
 308 ><TT
 309 CLASS="USERINPUT"
 310 ><B
 311 >smbpasswd</B
 312 ></TT
 313 ></P
 314 ><P
 315 ><TT
 316 CLASS="PROMPT"
 317 >Old SMB password: </TT
 318 ><TT
 319 CLASS="USERINPUT"
 320 ><B
 321 >&lt;type old value here -
 322         or hit return if there was no old password&gt;</B
 323 ></TT
 324 ></P
 325 ><P
 326 ><TT
 327 CLASS="PROMPT"
 328 >New SMB Password: </TT
 329 ><TT
 330 CLASS="USERINPUT"
 331 ><B
 332 >&lt;type new value&gt;
 333         </B
 334 ></TT
 335 ></P
 336 ><P
 337 ><TT
 338 CLASS="PROMPT"
 339 >Repeat New SMB Password: </TT
 340 ><TT
 341 CLASS="USERINPUT"
 342 ><B
 343 >&lt;re-type new value
 344         </B
 345 ></TT
 346 ></P
 347 ><P
 348 >If the old value does not match the current value stored for
 349         that user, or the two new values do not match each other, then the
 350         password will not be changed.</P
 351 ><P
 352 >If invoked by an ordinary user it will only allow the user
 353         to change his or her own Samba password.</P
 354 ><P
 355 >If run by the root user smbpasswd may take an optional
 356         argument, specifying the user name whose SMB password you wish to
 357         change.  Note that when run as root smbpasswd does not prompt for
 358         or check the old password value, thus allowing root to set passwords
 359         for users who have forgotten their passwords.</P
 360 ><P
 361 ><B
 362 CLASS="COMMAND"
 363 >smbpasswd</B
 364 > is designed to work in the same way
 365         and be familiar to UNIX users who use the <B
 366 CLASS="COMMAND"
 367 >passwd</B
 368 > or
 369         <B
 370 CLASS="COMMAND"
 371 >yppasswd</B
 372 > commands.</P
 373 ><P
 374 >For more details on using <B
 375 CLASS="COMMAND"
 376 >smbpasswd</B
 377 > refer
 378         to the man page which will always be the definitive reference.</P
 379 ></DIV
 380 ></DIV
 381 ><DIV
 382 CLASS="NAVFOOTER"
 383 ><HR
 384 ALIGN="LEFT"
 385 WIDTH="100%"><TABLE
 386 SUMMARY="Footer navigation table"
 387 WIDTH="100%"
 388 BORDER="0"
 389 CELLPADDING="0"
 390 CELLSPACING="0"
 391 ><TR
 392 ><TD
 393 WIDTH="33%"
 394 ALIGN="left"
 395 VALIGN="top"
 396 ><A
 397 HREF="browsing-quick.html"
 398 ACCESSKEY="P"
 399 >Prev</A
 400 ></TD
 401 ><TD
 402 WIDTH="34%"
 403 ALIGN="center"
 404 VALIGN="top"
 405 ><A
 406 HREF="samba-howto-collection.html"
 407 ACCESSKEY="H"
 408 >Home</A
 409 ></TD
 410 ><TD
 411 WIDTH="33%"
 412 ALIGN="right"
 413 VALIGN="top"
 414 ><A
 415 HREF="type.html"
 416 ACCESSKEY="N"
 417 >Next</A
 418 ></TD
 419 ></TR
 420 ><TR
 421 ><TD
 422 WIDTH="33%"
 423 ALIGN="left"
 424 VALIGN="top"
 425 >Quick Cross Subnet Browsing / Cross Workgroup Browsing guide</TD
 426 ><TD
 427 WIDTH="34%"
 428 ALIGN="center"
 429 VALIGN="top"
 430 ><A
 431 HREF="introduction.html"
 432 ACCESSKEY="U"
 433 >Up</A
 434 ></TD
 435 ><TD
 436 WIDTH="33%"
 437 ALIGN="right"
 438 VALIGN="top"
 439 >Type of installation</TD
 440 ></TR
 441 ></TABLE
 442 ></DIV
 443 ></BODY
 444 ></HTML
 445 >