文章分类

smbpasswd - samba加密口令文件

创建：2005-10-27 16:19:01
作者：Unlinux
来自: http://www.Unlinux.com

smbpasswd - samba加密口令文件

smbpasswd - The Samba encrypted password file

smbpasswd - samba加密口令文件

SYNOPSIS

概述

smbpasswd is the Samba encrypted password file.

smbpasswd是samba的加密口令文件。

DESCRIPTION

描述

This file is part of the Samba suite.

此文件是samba套件的一部分。

smbpasswd is the Samba encrypted password file. It contains the username,
Unix user id and the SMB hashed passwords of the user, as well as account
flag information and the time the password was last changed. This file format
has been evolving with Samba and has had several different formats in the
past.

smbpasswd是samba的加密口令文件。文件中包含了用户名，UNIX用户ID和SMB用户口令(经
过hash散列算法处理过)，还有账号标志信息及上次更改口令时间。samba已经改进了文件
格式并和以前的格式有些不同之处。

FILE FORMAT

文件格式

The format of the smbpasswd file used by Samba 2.0 is very similar to the
familiar Unix passwd (5) file. It is an ASCII file containing one line for
each user. Each field within each line is separated from the next by a colon.
Any entry beginning with # is ignored. The smbpasswd file contains the
following information for each user:

samba 2.0使用的smbpasswd文件格式非常简单，而且和UNIX的passwd (5)文件非常类似。
它是个ASCII文件，其中每行内容对应一个用户。每个字段用冒号分隔。任何以#号开始的
行将被忽略。对于每个用户在smbpasswd文件中都包含以下的信息：

name
has been evolving with Samba and has had several different formats in the
past.

smbpasswd是samba的加密口令文件。文件中包含了用户名，UNIX用户ID和SMB用户口令(经
过hash散列算法处理过)，还有账号标志信息及上次更改口令时间。samba已经改进了文件
格式并和以前的格式有些不同之处。

FILE FORMAT

文件格式

The format of the smbpasswd file used by Samba 2.0 is very similar to the
familiar Unix passwd (5) file. It is an ASCII file containing one line for
each user. Each field within each line is separated from the next by a colon.
Any entry beginning with # is ignored. The smbpasswd file contains the
following information for each user:

samba 2.0使用的smbpasswd文件格式非常简单，而且和UNIX的passwd (5)文件非常类似。
它是个ASCII文件，其中每行内容对应一个用户。每个字段用冒号分隔。任何以#号开始的
行将被忽略。对于每个用户在smbpasswd文件中都包含以下的信息：

name

This is the user name. It must be a name that already exists in the standard
UNIX passwd file.

用户名，必须是标准UNIX口令文件中已经存在的用户名。

uid

This is the UNIX uid. It must match the uid field for the same user entry in
the standard UNIX passwd file. If this does not match then Samba will refuse
to recognize this smbpasswd file entry as being valid for a user.

UNIX的用户标识。必须匹配标准UNIX口令文件中相应用户的UID字段。如果不匹配samba会
拒绝确认合法用户的整个描述项。

Lanman Password Hash

Lanman的口令散列表

This is the LANMAN hash of the users password, encoded as 32 hex digits. The
LANMAN hash is created by DES encrypting a well known string with the users
password as the DES key. This is the same password used by Windows 95/98
other access.

警告！！注意到由于要使用SMB/CIFS验证协议来实现请求-响应特性，所以任何了解口令
散列表信息的人都可以伪装成网络中的其他用户。为此，这些口令散列表信息都相当于只
是“明文”一样，所以root以外的任何用户都不应该获得这些数据，为了保护这些口令，
smbpasswd文件被存放到只有root用户可以读取和访问的目录中，而smbpasswd文件本身也
被设成只有root用户可以读/写，而其它人无法访问。

NT Password Hash

NT的口令散列表

This is the Windows NT hash of the users password, encoded as 32 hex digits.
The Windows NT hash is created by taking the users password as represented in
16-bit, little-endian UNICODE and then applying the MD4 (internet rfc1321)
hashing algorithm to it.

指定NT的用户口令散列表，也是32位的十六进制编码。NT的散列表用16位的用户口令，
little-endian UNICODE编码建立，然后用MD4算法产生对应的散列表。

This password hash is considered more secure than the Lanman Password Hash as
it preserves the case of the password and uses a much higher quality hashing
algorithm. However, it is still the case that if two users choose the same
password this entry will be identical (i.e. the password is not "salted" as
the UNIX password is).

这种口令散列表比Lanman Password Hash考虑更多的安全性，所以它用更高质量的散列算
法来维护口令和用户信息。但是它仍然存在当两个用户使用相同口令时口令项相同的问题
(例如没有UNIX口令那样“加工”过)。

WARNING !!. Note that, due to the challenge-response nature of the SMB/CIFS
authentication protocol, anyone with a knowledge of this password hash will
be able to impersonate the user on the network. For this reason these hashes
are known as "plain text equivalent" and must NOT be made available to anyone
but the root user. To protect these passwords the smbpasswd file is placed in
a directory with read and traverse access only to the root user and the
smbpasswd file itself must be set to be read/write only by root, with no
other access.

警告！！注意到由于要使用SMB/CIFS验证协议来实现请求-响应特性，所以任何了解口令
散列表信息的人都可以伪装成网络中的其他用户。为此，这些口令散列表信息都相当于只
是“明文”一样，所以root以外的任何用户都不应该获得这些数据，为了保护这些口令，
smbpasswd文件被存放到只有root用户可以读取和访问的目录中，而smbpasswd文件本身也
被设成只有root用户可以读/写，而其它人无法访问。

Account Flags

账号标志

This section contains flags that describe the attributes of the users
account. In the Samba2.0 release this field is bracketed by '[' and ']'
characters and is always 13 characters in length (including the '[' and ']'
characters). The contents of this field may be any of the characters.

账号标志部分描述了用户账号的属性。在samba 2.0中这个字段是用‘[’和‘]’字符围
封。而其总长度是13个字符(包含‘[’和‘]’字符)。这部分内容可以是任何字符。

'U' This means this is a "User" account, i.e. an ordinary user. Only User and
Workstation Trust accounts are currently supported in the smbpasswd file.

‘U’说明这是一个“用户” 账号，比如原始用户。在smbpasswd文件中只支持用户和工
作站信任账号。

'N' This means the account has no password (the passwords in the fields
Lanman Password Hash and NT Password Hash are ignored). Note that this will
only allow users to log on with no password if the null passwords parameter
is set in the smb.conf (5) config file.

‘N’说明这个账号没有口令(Lanman Password Hash和NT Password Hash会忽略这一字段
中的口令内容)。注意如果在smb.conf (5)配置文件中设定了null passwords，那么只允
许用户不带口令进行登录。

'D' This means the account is disabled and no SMB/CIFS logins will be allowed
for this user.

‘D’说明此账号被禁止了，此用户无法登录SMB/CIFS。

'W' This means this account is a "Workstation Trust" account. This kind of
account is used in the Samba PDC code stream to allow Windows NT Workstations
and Servers to join a Domain hosted by a Samba PDC.

‘W’说明此账号是个“工作站” 信任账号。这类账号被用在把samba作为PDC时允许NT工
作站和服务器加入到域中的情况下。

Other flags may be added as the code is extended in future. The rest of this
field space is filled in with spaces.

其它标志作为将来功能扩展所用。这个标志字段余下的空间用空格填充。

Last Change Time

最后改变时间

This field consists of the time the account was last modified. It consists of
the characters LCT- (standing for "Last Change Time") followed by a numeric
encoding of the UNIX time in seconds since the epoch (1970) that the last
change was made.

这个字段由账号最后修改的时间组成。它以字符LCT(标准含义是“Last Change Time”)
后跟UNIX以秒计的时间编码数字(从公元1970年开始计)。

Following fields

其余字段

All other colon separated fields are ignored at this time.

所有其余用冒号分隔的字段现在都将被忽略。

NOTES

注意

In previous versions of Samba (notably the 1.9.18 series) this file did not
contain the Account Flags or Last Change Time fields. The Samba 2.0 code will
read and write these older password files but will not be able to modify the
old entries to add the new fields. New entries added with smbpasswd (8) will
contain the new fields in the added accounts however. Thus an older smbpasswd
file used with Samba 2.0 may end up with some accounts containing the new
fields and some not.

在早期的版本中(特别是1.9.18系列)，这个文件并不包含任何用户账号标志Account
Flags和最后更改时间Last Change Time这两个字段。samba 2.0的代码可以读/写这些较
老的口令文件，但却不能修改老的项目也不能添加新的字段。用smbpasswd (8)新添加的
项目会在加新账号时包含新的字段。因此samba 2.0在使用较老的文件时最终可能出现有
些用户账号带有新字段而有些没有的情况。

In order to convert from an old-style smbpasswd file to a new style, run the
script convert_smbpasswd, installed in the Samba bin/ directory (the same
place that the smbd and nmbd binaries are installed) as follows:

为了把旧格式的smbpasswd文件转换成新格式，用以下的格式运行samba可执行程序目录中
的convert_smbpasswd脚本(与smbd和nmbd位于同样的目录下)：

cat old_smbpasswd_file | convert_smbpasswd > new_smbpasswd_file

The convert_smbpasswd script reads from stdin and writes to stdout so as not
to overwrite any files by accident.

这个脚本从标准输入输出中进行读写操作，所以不会意外地覆盖任何文件。

Once this script has been run, check the contents of the new smbpasswd file
to ensure that it has not been damaged by the conversion script (which uses
awk), and then replace the <old smbpasswd file> with the <new smbpasswd
file>.

一旦运行过这个脚本，检查新的smbpasswd文件内容，确保没有被转换脚本(使用了awk)所
破坏，然后用新的smbpasswd替换老的文件。
VERSION

版本

This man page is correct for version 2.0 of the Samba suite.

此手册页是针对samba套件版本2.0的。

SEE ALSO

参见

smbpasswd (8), samba (7), and the Internet RFC1321 for details on the MD4
algorithm.

smbpasswd (8), samba (7), 和Internet RFC1321中对MD4算法的描述。

AUTHOR

作者

The original Samba software and related utilities were created by Andrew
Tridgell samba-bugs@samba.org. Samba is now developed by the Samba Team as an
Open Source project similar to the way the Linux kernel is developed.

samba软件和相关工具最初由Andrew Tridgell samba-bugs@samba.org创建。samba现在由
开发组作为类似Linux内核开发采用的开放源代码计划方式来发展。

The original Samba man pages were written by Karl Auer. The man page sources
were converted to YODL format (another excellent piece of Open Source
software, available at ftp://ftp.icce.rug.nl/pub/unix/) and updated for the

Samba2.0 release by Jeremy Allison. samba-bugs@samba.org.

samba手册页最初由Karl Auer撰写。它的源码已被转换成YODL(一种极好的开放源代码软
件，可以在ftp://ftp.icce.rug.nl/pub/unix/处获得)格式并已由Jeremy Allison更新到
samba2.0版本。

See samba (7) to find out how to get a full list of contributors and details
on how to submit bug reports, comments etc.

请参见samba (7)查找如何获得一份完整的维护者列表以及如何提交错误报告及注解等等
The original Samba man pages were written by Karl Auer. The man page sources
were converted to YODL format (another excellent piece of Open Source
software, available at ftp://ftp.icce.rug.nl/pub/unix/) and updated for the

Samba2.0 release by Jeremy Allison. samba-bugs@samba.org.

samba手册页最初由Karl Auer撰写。它的源码已被转换成YODL(一种极好的开放源代码软
件，可以在ftp://ftp.icce.rug.nl/pub/unix/处获得)格式并已由Jeremy Allison更新到
samba2.0版本。
转载自：http://www.unlinux.com/doc/samba/20051027/3605.html

【评论】【加入收藏夹】【大中小】【打印】【关闭】
* 请尊重我们的劳动，转载请注明出自UnLinux.Com及作者名 *

※ 相关链接
无相关信息

文章分类

热门文章

最新文章

smbpasswd - samba加密口令文件