22.2.3. Encrypted Passwords

Encrypted passwords are enabled by default because it is more secure. If encrypted passwords are not used, plain text passwords are used, which can be intercepted by someone using a network packet sniffer. It is recommended that encrypted passwords be used.
The Microsoft SMB Protocol originally used plain text passwords. However, Windows NT 4.0 with Service Pack 3 or higher, Windows 98, Windows 2000, Windows ME, and Windows XP require encrypted Samba passwords. To use Samba between a Linux system and a system running one of these Windows operating systems, you can either edit your Windows registry to use plaintext passwords or configure Samba on your Linux system to use encrypted passwords. If you choose to modify your registry, you must do so for all of your Windows machines — this is risky and may cause further conflicts. It is recommended that you use encrypted passwords for better security.
To configure Samba to use encrypted passwords, follow these steps:
  1. Create a separate password file for Samba. To create one based on your existing /etc/passwd file, at a shell prompt, type the following command:
     cat /etc/passwd | mksmbpasswd.sh > /etc/samba/smbpasswd 
    If the system uses NIS, type the following command:
     ypcat passwd | mksmbpasswd.sh > /etc/samba/smbpasswd 
    The mksmbpasswd.sh script is installed in your /usr/bin directory with the samba package.
  2. Change the permissions of the Samba password file so that only root has read and write permissions:
    chmod 600 /etc/samba/smbpasswd
  3. The script does not copy user passwords to the new file, and a Samba user account is not active until a password is set for it. For higher security, it is recommended that the user's Samba password be different from the user's system password. To set each Samba user's password, use the following command (replace username with each user's username):
    smbpasswd username
  4. Encrypted passwords must be enabled. Since they are enabled by default, they do not have to be specifically enabled in the configuration file. However, they can not be disabled in the configuration file either. In the file /etc/samba/smb.conf, verify that the following line does not exist:
    encrypt passwords = no
    
    If it does exist but is commented out with a semi-colon (;) at the beginning of the line, then the line is ignored, and encrypted passwords are enabled. If this line exists but is not commented out, either remove it or comment it out.
    To specifically enable encrypted passwords in the configuration file, add the following lines to etc/samba/smb.conf:
    encrypt passwords = yes
    smb passwd file = /etc/samba/smbpasswd
    
  5. Make sure the smb service is started by typing the command service smb restart at a shell prompt.
  6. If you want the smb service to start automatically, use ntsysv, chkconfig, or the Services Configuration Tool to enable it at runtime. Refer to Chapter 19, Controlling Access to Services for details.
The pam_smbpass PAM module can be used to sync users' Samba passwords with their system passwords when the passwd command is used. If a user invokes the passwd command, the password he uses to log in to the Red Hat Enterprise Linux system as well as the password he must provide to connect to a Samba share are changed.
To enable this feature, add the following line to /etc/pam.d/system-auth below the pam_cracklib.so invocation:
password required /lib/security/pam_smbpass.so nullok use_authtok try_first_pass