22.2.3. Encrypted Passwords
22.2.3. Encrypted Passwords Encrypted passwords are enabled by default because it is more secure. If encrypted passwords are not used, plain text passwords are used, which can be intercepted by someone using a network packet sniffer. It is recommended that encrypted passwords be used. The Microsoft SMB Protocol originally used plain text passwords. However, Windows NT 4.0 with Service Pack 3 or higher, Windows 98, Windows 2000, Windows ME, and Windows XP require encrypted Samba passwords. To use Samba between a Linux system and a system running one of these Windows operating systems, you can either edit your Windows registry to use plaintext passwords or configure Samba on your Linux system to use encrypted passwords. If you choose to modify your registry, you must do so for all of your Windows machines - this is risky and may cause further conflicts. It is recommended that you use encrypted passwords for better security. To configure Samba to use encrypted passwords, follow these steps: Create a separate password file for Samba. To create one based on your existing /etc/passwd file, at a shell prompt, type the following command: If the system uses NIS, type the following command: The mksmbpasswd.sh script is installed in your /usr/bin directory with the samba package. Change the permissions of the Samba password file so that only root has read and write permissions: The script does not copy user passwords to the new file, and a Samba user account is not active until a password is set for it. For higher security, it is recommended that the user's Samba password be different from the user's system password. To set each Samba user's password, use the following command (replace username with each user's username): Encrypted passwords must be enabled. Since they are enabled by default, they do not have to be specifically enabled in the configuration file. However, they can not be disabled in the configuration file either. In the file /etc/samba/smb.conf , verify that the following line does not exist: If it does exist but is commented out with a semi-colon ( ; ) at the beginning of the line, then the line is ignored, and encrypted passwords are enabled. If this line exists but is not commented out, either remove it or comment it out. To specifically enable encrypted passwords in the configuration file, add the following lines to etc/samba/smb.conf : Make sure the smb service is started by typing the command service smb restart at a shell prompt. If you want the smb service to start automatically, use ntsysv , chkconfig , or the Services Configuration Tool to enable it at runtime. Refer to Chapter 19, Controlling Access to Services for details. The pam_smbpass PAM module can be used to sync users' Samba passwords with their system passwords when the passwd command is used. If a user invokes the passwd command, the password he uses to log in to the Red Hat Enterprise Linux system as well as the password he must provide to connect to a Samba share are changed. To enable this feature, add the following line to /etc/pam.d/system-auth below the pam_cracklib.so invocation:
cat /etc/passwd | mksmbpasswd.sh > /etc/samba/smbpasswd ypcat passwd | mksmbpasswd.sh > /etc/samba/smbpasswd chmod 600 /etc/samba/smbpasswd smbpasswd username encrypt passwords = no encrypt passwords = yes smb passwd file = /etc/samba/smbpasswd password required /lib/security/pam_smbpass.so nullok use_authtok try_first_pass