To configure Samba to use encrypted passwords, follow these steps:
1. Create a separate password file for Samba. To create one based on your existing /etc/passwd file, at a shell prompt, type the following command:
cat /etc/passwd | mksmbpasswd.sh > /etc/samba/smbpasswd |
2. If the system uses
ypcat passwd | mksmbpasswd.sh > /etc/samba/smbpasswd |
3. The mksmbpasswd.sh script is installed in your /usr/bin directory with the samba package.
4. Change the permissions of the Samba password file so that only root has read and write permissions:
chmod 600 /etc/samba/smbpasswd |
5. The script does not copy user passwords to the new file, and a Samba user account is not active until a password is set for it. For higher security, it is recommended that the user's Samba password be different from the user's system password. To set each Samba user's password, use the following command (replace username with each user's username):
smbpasswd username |
6. Encrypted passwords must be enabled. Since they are enabled by default, they do not have to be specifically enabled in the configuration file. However, they can not be disabled in the configuration file either. In the file /etc/samba/smb.conf, verify that the following line does not exist:
encrypt passwords = no |
7. If it does exist but is commented out with a semi-colon (;) at the beginning of the line, then the line is ignored, and encrypted passwords are enabled. If this line exists but is not commented out, either remove it or comment it out.
8. To specifically enable encrypted passwords in the configuration file, add the following lines to etc/samba/smb.conf:
encrypt passwords = yessmb passwd file = /etc/samba/smbpasswd |
9. Make sure the smb service is started by typing the command service smb restart at a shell prompt.
