이 콘텐츠는 선택한 언어로 제공되지 않습니다.
22.2.3. Encrypted Passwords
Encrypted passwords are enabled by default because it is more secure. If encrypted passwords are not used, plain text passwords are used, which can be intercepted by someone using a network packet sniffer. It is recommended that encrypted passwords be used.
The Microsoft SMB Protocol originally used plain text passwords. However, Windows NT 4.0 with Service Pack 3 or higher, Windows 98, Windows 2000, Windows ME, and Windows XP require encrypted Samba passwords. To use Samba between a Linux system and a system running one of these Windows operating systems, you can either edit your Windows registry to use plaintext passwords or configure Samba on your Linux system to use encrypted passwords. If you choose to modify your registry, you must do so for all of your Windows machines — this is risky and may cause further conflicts. It is recommended that you use encrypted passwords for better security.
To configure Samba to use encrypted passwords, follow these steps:
- Create a separate password file for Samba. To create one based on your existing
/etc/passwdfile, at a shell prompt, type the following command:cat /etc/passwd | mksmbpasswd.sh > /etc/samba/smbpasswdIf the system uses NIS, type the following command:ypcat passwd | mksmbpasswd.sh > /etc/samba/smbpasswdThemksmbpasswd.shscript is installed in your/usr/bindirectory with thesambapackage. - Change the permissions of the Samba password file so that only root has read and write permissions:
chmod 600 /etc/samba/smbpasswd - The script does not copy user passwords to the new file, and a Samba user account is not active until a password is set for it. For higher security, it is recommended that the user's Samba password be different from the user's system password. To set each Samba user's password, use the following command (replace username with each user's username):
smbpasswd username - Encrypted passwords must be enabled. Since they are enabled by default, they do not have to be specifically enabled in the configuration file. However, they can not be disabled in the configuration file either. In the file
/etc/samba/smb.conf, verify that the following line does not exist:encrypt passwords = no
If it does exist but is commented out with a semi-colon (;) at the beginning of the line, then the line is ignored, and encrypted passwords are enabled. If this line exists but is not commented out, either remove it or comment it out.To specifically enable encrypted passwords in the configuration file, add the following lines toetc/samba/smb.conf:encrypt passwords = yes smb passwd file = /etc/samba/smbpasswd
- Make sure the
smbservice is started by typing the commandservice smb restartat a shell prompt. - If you want the
smbservice to start automatically, use ntsysv,chkconfig, or the Services Configuration Tool to enable it at runtime. Refer to Chapter 19, Controlling Access to Services for details.
The
pam_smbpass PAM module can be used to sync users' Samba passwords with their system passwords when the passwd command is used. If a user invokes the passwd command, the password he uses to log in to the Red Hat Enterprise Linux system as well as the password he must provide to connect to a Samba share are changed.
To enable this feature, add the following line to
/etc/pam.d/system-auth below the pam_cracklib.so invocation:
password required /lib/security/pam_smbpass.so nullok use_authtok try_first_pass
