1 .TH "smbpasswd" "8" "23 Oct 1998" "Samba" "SAMBA"
4 smbpasswd \- change a users SMB password
8 \fBsmbpasswd\fP [-a] [-d] [-e] [-D debug level] [-n] [-r remote_machine] [-R name resolve order] [-m] [-j DOMAIN] [-U username] [-h] [-s] username
12 This program is part of the \fBSamba\fP suite\&.
14 The \fBsmbpasswd\fP program has several different functions, depending
15 on whether it is run by the \fIroot\fP user or not\&. When run as a normal
16 user it allows the user to change the password used for their SMB
17 sessions on any machines that store SMB passwords\&.
19 By default (when run with no arguments) it will attempt to change the
20 current users SMB password on the local machine\&. This is similar to
21 the way the \fBpasswd (1)\fP program works\&. \fBsmbpasswd\fP differs from
22 the \fBpasswd\fP program works however in that it is not \fIsetuid root\fP
23 but works in a client-server mode and communicates with a locally
24 running \fBsmbd\fP\&. As a consequence in order for this
25 to succeed the \fBsmbd\fP daemon must be running on
26 the local machine\&. On a UNIX machine the encrypted SMB passwords are
27 usually stored in the \fBsmbpasswd (5)\fP file\&.
29 When run by an ordinary user with no options\&. \fBsmbpasswd\fP will
30 prompt them for their old smb password and then ask them for their new
31 password twice, to ensure that the new password was typed
32 correctly\&. No passwords will be echoed on the screen whilst being
33 typed\&. If you have a blank smb password (specified by the string "NO
34 PASSWORD" in the \fBsmbpasswd\fP file) then just
35 press the <Enter> key when asked for your old password\&.
37 \fBsmbpasswd\fP also can be used by a normal user to change their SMB
38 password on remote machines, such as Windows NT Primary Domain
39 Controllers\&. See the (\fB-r\fP) and
40 \fB-U\fP options below\&.
42 When run by root, \fBsmbpasswd\fP allows new users to be added and
43 deleted in the \fBsmbpasswd\fP file, as well as
44 changes to the attributes of the user in this file to be made\&. When
45 run by root, \fBsmbpasswd\fP accesses the local
46 \fBsmbpasswd\fP file directly, thus enabling
47 changes to be made even if \fBsmbd\fP is not running\&.
53 This option specifies that the username following should
54 be added to the local \fBsmbpasswd\fP file, with
55 the new password typed (type <Enter> for the old password)\&. This
56 option is ignored if the username following already exists in the
57 \fBsmbpasswd\fP file and it is treated like a
58 regular change password command\&. Note that the user to be added \&.B
59 must already exist in the system password file (usually /etc/passwd)
60 else the request to add the user will fail\&.
62 This option is only available when running \fBsmbpasswd\fP as
66 This option specifies that the username following should be
67 \fIdisabled\fP in the local \fBsmbpasswd\fP file\&.
68 This is done by writing a \fI\'D\'\fP flag into the account control space
69 in the \fBsmbpasswd\fP file\&. Once this is done
70 all attempts to authenticate via SMB using this username will fail\&.
72 If the \fBsmbpasswd\fP file is in the \'old\'
73 format (pre-Samba 2\&.0 format) there is no space in the users password
74 entry to write this information and so the user is disabled by writing
75 \'X\' characters into the password space in the
76 \fBsmbpasswd\fP file\&. See \fBsmbpasswd
77 (5)\fP for details on the \'old\' and new password file
80 This option is only available when running \fBsmbpasswd\fP as root\&.
83 This option specifies that the username following should be
84 \fIenabled\fP in the local \fBsmbpasswd\fP file,
85 if the account was previously disabled\&. If the account was not
86 disabled this option has no effect\&. Once the account is enabled
87 then the user will be able to authenticate via SMB once again\&.
89 If the smbpasswd file is in the \'old\' format then \fBsmbpasswd\fP will
90 prompt for a new password for this user, otherwise the account will be
91 enabled by removing the \fI\'D\'\fP flag from account control space in the
92 \fBsmbpasswd\fP file\&. See \fBsmbpasswd
93 (5)\fP for details on the \'old\' and new password file
96 This option is only available when running \fBsmbpasswd\fP as root\&.
98 .IP "\fB-D debuglevel\fP"
99 debuglevel is an integer from 0
100 to 10\&. The default value if this parameter is not specified is zero\&.
102 The higher this value, the more detail will be logged to the log files
103 about the activities of smbpasswd\&. At level 0, only critical errors
104 and serious warnings will be logged\&.
106 Levels above 1 will generate considerable amounts of log data, and
107 should only be used when investigating a problem\&. Levels above 3 are
108 designed for use only by developers and generate HUGE amounts of log
109 data, most of which is extremely cryptic\&.
112 This option specifies that the username following should
113 have their password set to null (i\&.e\&. a blank password) in the local
114 \fBsmbpasswd\fP file\&. This is done by writing the
115 string "NO PASSWORD" as the first part of the first password stored in
116 the \fBsmbpasswd\fP file\&.
118 Note that to allow users to logon to a Samba server once the password
119 has been set to "NO PASSWORD" in the
120 \fBsmbpasswd\fP file the administrator must set
121 the following parameter in the [global] section of the
122 \fBsmb\&.conf\fP file :
124 null passwords = true
126 This option is only available when running \fBsmbpasswd\fP as root\&.
128 .IP "\fB-r remote machine name\fP"
130 user to specify what machine they wish to change their password
131 on\&. Without this parameter \fBsmbpasswd\fP defaults to the local
132 host\&. The \fI"remote machine name"\fP is the NetBIOS name of the
133 SMB/CIFS server to contact to attempt the password change\&. This name
134 is resolved into an IP address using the standard name resolution
135 mechanism in all programs of the \fBSamba\fP
136 suite\&. See the \fB-R name resolve order\fP parameter for details on changing this resolving
139 The username whose password is changed is that of the current UNIX
140 logged on user\&. See the \fB-U username\fP
141 parameter for details on changing the password for a different
144 Note that if changing a Windows NT Domain password the remote machine
145 specified must be the Primary Domain Controller for the domain (Backup
146 Domain Controllers only have a read-only copy of the user account
147 database and will not allow the password change)\&.
149 .IP "\fB-R name resolve order\fP"
150 This option allows the user of
151 smbclient to determine what name resolution services to use when
152 looking up the NetBIOS name of the host being connected to\&.
154 The options are :"lmhosts", "host",
155 "wins" and "bcast"\&. They cause names to be
156 resolved as follows :
160 \fBlmhosts\fP : Lookup an IP address in the Samba lmhosts file\&.
163 \fBhost\fP : Do a standard host name to IP address resolution,
164 using the system /etc/hosts, NIS, or DNS lookups\&. This method of name
165 resolution is operating system depended for instance on IRIX or
166 Solaris this may be controlled by the \fI/etc/nsswitch\&.conf\fP file)\&.
169 \fBwins\fP : Query a name with the IP address listed in the \fBwins
170 server\fP parameter in the smb\&.conf file\&. If
171 no WINS server has been specified this method will be ignored\&.
174 \fBbcast\fP : Do a broadcast on each of the known local interfaces
175 listed in the \fBinterfaces\fP parameter
176 in the smb\&.conf file\&. This is the least reliable of the name resolution
177 methods as it depends on the target host being on a locally connected
181 If this parameter is not set then the name resolver order defined
182 in the \fBsmb\&.conf\fP file parameter
183 \fBname resolve order\fP
186 The default order is lmhosts, host, wins, bcast and without this
187 parameter or any entry in the \fBsmb\&.conf\fP
188 file the name resolution methods will be attempted in this order\&.
191 This option tells \fBsmbpasswd\fP that the account being
192 changed is a \fIMACHINE\fP account\&. Currently this is used when Samba is
193 being used as an NT Primary Domain Controller\&. PDC support is not a
194 supported feature in Samba2\&.0 but will become supported in a later
195 release\&. If you wish to know more about using Samba as an NT PDC then
196 please subscribe to the mailing list
197 \fIsamba-ntdom@samba\&.anu\&.edu\&.au\fP\&.
199 This option is only available when running \fBsmbpasswd\fP as root\&.
201 .IP "\fB-j DOMAIN\fP"
202 This option is used to add a Samba server into a
203 Windows NT Domain, as a Domain member capable of authenticating user
204 accounts to any Domain Controller in the same way as a Windows NT
205 Server\&. See the \fBsecurity=domain\fP
206 option in the \fBsmb\&.conf (5)\fP man page\&.
208 In order to be used in this way, the Administrator for the Windows
209 NT Domain must have used the program \fI"Server Manager for Domains"\fP
210 to add the primary NetBIOS name of
211 the Samba server as a member of the Domain\&.
213 After this has been done, to join the Domain invoke \fBsmbpasswd\fP with
214 this parameter\&. \fBsmbpasswd\fP will then look up the Primary Domain
215 Controller for the Domain (found in the
216 \fBsmb\&.conf\fP file in the parameter
217 \fBpassword server\fP and change
218 the machine account password used to create the secure Domain
219 communication\&. This password is then stored by \fBsmbpasswd\fP in a
220 file, read only by root, called \f(CW<Domain>\&.<Machine>\&.mac\fP where
221 \f(CW<Domain>\fP is the name of the Domain we are joining and tt<Machine>
222 is the primary NetBIOS name of the machine we are running on\&.
224 Once this operation has been performed the
225 \fBsmb\&.conf\fP file may be updated to set the
226 \fBsecurity=domain\fP option and all
227 future logins to the Samba server will be authenticated to the Windows
230 Note that even though the authentication is being done to the PDC all
231 users accessing the Samba server must still have a valid UNIX account
234 This option is only available when running \fBsmbpasswd\fP as root\&.
236 .IP "\fB-U username\fP"
237 This option may only be used in
238 conjunction with the \fB-r\fP
239 option\&. When changing a password on a remote machine it allows the
240 user to specify the user name on that machine whose password will be
241 changed\&. It is present to allow users who have different user names on
242 different systems to change these passwords\&.
245 This option prints the help string for \fBsmbpasswd\fP,
246 selecting the correct one for running as root or as an ordinary user\&.
249 This option causes \fBsmbpasswd\fP to be silent (ie\&. not
250 issue prompts) and to read it\'s old and new passwords from standard
251 input, rather than from \f(CW/dev/tty\fP (like the \fBpasswd (1)\fP program
252 does)\&. This option is to aid people writing scripts to drive \fBsmbpasswd\fP
254 dir(\fBusername\fP) This specifies the username for all of the \fIroot
255 only\fP options to operate on\&. Only root can specify this parameter as
256 only root has the permission needed to modify attributes directly
257 in the local \fBsmbpasswd\fP file\&.
261 As \fBsmbpasswd\fP works in client-server mode communicating with a
262 local \fBsmbd\fP for a non-root user then the \fBsmbd\fP
263 daemon must be running for this to work\&. A common problem is to add a
264 restriction to the hosts that may access the \fBsmbd\fP running on the
265 local machine by specifying a \fB"allow
266 hosts"\fP or \fB"deny
267 hosts"\fP entry in the
268 \fBsmb\&.conf\fP file and neglecting to allow
269 \fI"localhost"\fP access to the \fBsmbd\fP\&.
271 In addition, the \fBsmbpasswd\fP command is only useful if \fBSamba\fP has
272 been set up to use encrypted passwords\&. See the file \fBENCRYPTION\&.txt\fP
273 in the docs directory for details on how to do this\&.
277 This man page is correct for version 2\&.0 of the Samba suite\&.
281 The original Samba software and related utilities were created by
282 Andrew Tridgell \fIsamba-bugs@samba\&.anu\&.edu\&.au\fP\&. Samba is now developed
283 by the Samba Team as an Open Source project similar to the way the
284 Linux kernel is developed\&.
286 The original Samba man pages were written by Karl Auer\&. The man page
287 sources were converted to YODL format (another excellent piece of Open
288 Source software, available at
289 \fBftp://ftp\&.icce\&.rug\&.nl/pub/unix/\fP)
290 and updated for the Samba2\&.0 release by Jeremy Allison\&.
291 \fIsamba-bugs@samba\&.anu\&.edu\&.au\fP\&.
293 See \fBsamba (7)\fP to find out how to get a full
294 list of contributors and details on how to submit bug reports,