精华区文章阅读

发信人: tcpip (高级草包), 信区: Linux
标  题: smbpasswd (8)
发信站: 紫丁香 (Fri May  5 20:10:37 2000) WWW-POST

------------------------------------------------------------------------------
--

smbpasswd (8)

Samba

23 Oct 1998

NAME

名称

smbpasswd - change a users SMB password

smbpasswd - 改变用户的SMB口令

SYNOPSIS

语法

smbpasswd [-a] [-d] [-e] [-D debug level] [-n] [-r remote_machine] [-R name
resolve order] [-m] [-j DOMAIN] [-U username] [-h] [-s] username

DESCRIPTION

描述

This program is part of the Samba suite.

此程序是samba套件的一部分。

The smbpasswd program has several different functions, depending on whether
it is run by the root user or not. When run as a normal user it allows the
user to change the password used for their SMB sessions on any machines that
store SMB passwords.

smbpasswd程序有几个不太一样的功能，这取决于它被root账号还是其它账号来使用。当
普通用户运行它时，用户可以通过SMB会话在任何保存SMB口令的机器上改变他们的口令。

By default (when run with no arguments) it will attempt to change the current
users SMB password on the local machine. This is similar to the way the
passwd (1) program works. smbpasswd differs from how the passwd program works
however in that it is not setuid root but works in a client-server mode and
communicates with a locally running smbd. As a consequence in order for this
to succeed the smbd daemon must be running on the local machine. On a UNIX
machine the encrypted SMB passwords are usually stored in the smbpasswd (5)
file.

默认情况下(不带参数运行)它会尝试在本地改变当前用户的SMB口令。这和passwd (1)程
序的工作方式类似。不过，smbpasswd和passwd具有setuid root特性还是不一样的，除非
当它工作在客户机-服务器模式并且与本地运行中的smbd通信时。为了实现这样的结果，
smbd守护程序必须在本地主机上运行。在UNIX主机上通常用smbpasswd (5)来存放SMB的加
密口令。

When run by an ordinary user with no options. smbpasswd will prompt them for
their old smb password and then ask them for their new password twice, to
ensure that the new password was typed correctly. No passwords will be echoed
on the screen whilst being typed. If you have a blank smb password (specified
by the string "NO PASSWORD" in the smbpasswd file) then just press the
<Enter> key when asked for your old password.

当普通用户不带选项来运行这个程序时，smbpasswd会向他们提示输入原SMB口令并询问所
需的新口令两次，这时必须确保输入正确，输入时屏幕并不显示任何口令字符。如果你用
了一个空SMB口令(在smbpasswd文件中会指定字串“NO PASSWORD”)的话，在程序提示输
入原口令时可以直接输入<Enter>键。

smbpasswd can also be used by a normal user to change their SMB password on
remote machines, such as Windows NT Primary Domain Controllers. See the (-r)
and -U options below.

普通用户也可以在远程主机(例如NT域控制器)上用smbpasswd来改他们的SMB口令。详细情
况请参见以下的(-r)和-U两个选项。

When run by root, smbpasswd allows new users to be added and deleted in the
smbpasswd file, as well as allows changes to the attributes of the user in
this file to be made. When run by root, smbpasswd accesses the local
smbpasswd file directly, thus enabling changes to be made even if smbd is not
running.

当root运行这个程序时，smbpasswd可以在smbpasswd文件中增删用户，也可以改变用户属
性。这时，程序会直接访问本地smbpasswd文件，甚至smbd并没有在运行时也可以。

OPTIONS

选项

-a
This option specifies that the username following should be added to the
local smbpasswd file, with the new password typed (type <Enter> for the old
password). This option is ignored if the username following already exists in
the smbpasswd file and it is treated like a regular change password command.
Note that the user to be added must already exist in the system password file
(usually /etc/passwd) else the request to add the user will fail.
通过在这个选项后跟上用户名来实现在本地smbpasswd文件中增加用户，并且同时提供新
的口令(提示原口令时用<Enter>)。如果smbpasswd文件中已经存在了这样的用户时，命令
就变成通常的改口令模式。注意，所要加入的SMB用户必须在系统口令文件中(通常是
/etc/passwd)已经存在的用户否则加入操作将会失败。

This option is only available when running smbpasswd as root.

只有root运行smbpasswd程序时才可以使用这个选项。

-d
This option specifies that the username following should be disabled in the
local smbpasswd file. This is done by writing a 'D' flag into the account
control space in the smbpasswd file. Once this is done all attempts to
authenticate via SMB using this username will fail.
用这个选项后跟用户名来禁止存在于smbpasswd文件中的这个账号。通过在smbpasswd文件
的账号控制部分写入'D'标志来实现这个功能。一旦账号被禁止，所有使用这个账号作SMB
身份验证的尝试都将失败。

If the smbpasswd file is in the 'old' format (pre-Samba 2.0 format) there is
no space in the users password entry to write this information and so the
user is disabled by writing 'X' characters into the password space in the
smbpasswd file. See smbpasswd (5) for details on the 'old' and new password
file formats.

如果smbpasswd文件还是老格式的话(比如samba 2.0之前版本)，在用户口令项中没有这样
的账号控制部分可以作任何标志，所以只能向smbpasswd文件中的口令字部分写入'X'字符
来达到目的。关于口令文件的新格式和旧格式细节可以参见smbpasswd (5)。

This option is only available when running smbpasswd as root.

同样，也只有root运行smbpasswd程序时才可以使用这个选项。

-e
This option specifies that the username following should be enabled in the
local smbpasswd file, if the account was previously disabled. If the account
was not disabled this option has no effect. Once the account is enabled then
the user will be able to authenticate via SMB once again.
这个选项达到的功能和上面一个正好相反，而使用格式相同。账号被禁止时用来重新允许
使用这个账号。如果账号并未被禁止的话，使用这个选项不会有什么结果(废话)。允许账
号将使用户再一次可以通过身份验证。

If the smbpasswd file is in the 'old' format then smbpasswd will prompt for a
new password for this user, otherwise the account will be enabled by removing
the 'D' flag from account control space in the smbpasswd file. See smbpasswd
(5) for details on the 'old' and new password file formats.

使用老格式的口令文件时，允许账号会被提示输入一个新口令；使用新格式时会清除
smbpasswd文件中账号控制部分的'D' 标志。关于口令文件的新格式和旧格式细节可以参
见smbpasswd (5)。

This option is only available when running smbpasswd as root.

只有root运行smbpasswd程序时才可以使用这个选项。

-D debuglevel
debuglevel is an integer from 0 to 10. The default value if this parameter is
not specified is zero.
调试级是个0到10的整数。如果不指定具体的数值时默认为0。

The higher this value, the more detail will be logged to the log files about
the activities of smbpasswd. At level 0, only critical errors and serious
warnings will be logged.

这个值越高，将记录越多关于smbpasswd活动的资料。在把调试级设为0时，只记录紧急错
误和严重警告。

Levels above 1 will generate considerable amounts of log data, and should
only be used when investigating a problem. Levels above 3 are designed for
use only by developers and generate HUGE amounts of log data, most of which
is extremely cryptic.

1以上的调试级将产生相当多的记录数据，并且只在研究问题时才有用。3以上的调试级只
被设计为让开发者使用并会产生极大数量的记录数据，而且其中很多部分非常难以理解。

-n
This option specifies that the username following should have their password
set to null (i.e. a blank password) in the local smbpasswd file. This is done
by writing the string "NO PASSWORD" as the first part of the first password
stored in the smbpasswd file.
用这个选项后跟用户名来把这个账号的口令设为空(例如空口令)。程序会把smbpasswd文
件中口令项的第一部分都改为“NO PASSWORD”。(我试了一下，都是“NO
PASSWORDXXXXXXXXX”这种形式)

Note that to allow users to logon to a Samba server once the password has
been set to "NO PASSWORD" in the smbpasswd file the administrator must set
the following parameter in the [global] section of the smb.conf file :

注意如果希望用户以空口令登录到samba服务器，管理员必须在smb.conf配置文件的
[global]段中设置以下的参数：

null passwords = true

This option is only available when running smbpasswd as root.

只有root运行smbpasswd程序时才可以使用这个选项。

-r remote machine name
This option allows a user to specify what machine they wish to change their
password on. Without this parameter smbpasswd defaults to the local host. The
"remote machine name" is the NetBIOS name of the SMB/CIFS server to contact
to attempt the password change. This name is resolved into an IP address
using the standard name resolution mechanism in all programs of the Samba
suite. See the -R name resolve order parameter for details on changing this
resolving mechanism.
使用这个选项来让用户指定他们所希望改变口令的主机，不用此参数时默认对本地更改口
令。SMB/CIFS服务器会试图联接以“remote machine name”作为NetBIOS名字的主机以更
改口令。Samba套件中的所有程序都使用标准的名字解析机制来把这样的名字转换成IP地
址。请参见-R name resolve order参数获得改变解析机制的详细信息。

The username whose password is changed is that of the current UNIX logged on
user. See the -U username parameter for details on changing the password for
a different username.

用这个选项更改的用户账号就是当前登录UNIX的账号。要改变其它用户名可以参见-U
username参数中的细节。

Note that if changing a Windows NT Domain password the remote machine
specified must be the Primary Domain Controller for the domain (Backup Domain
Controllers only have a read-only copy of the user account database and will
not allow the password change).

注意，如果要改变一个NT域账号，指定的远程主机必须是域中的主域控制器，因为备份域
控制器只维护用户账号数据库的只读复本，而不能更改。

Note that Windows 95/98 do not have a real password database so it is not
possible to change passwords specifying a Win95/98 machine as remote machine
target.

还需注意的是Windows 95/98实际根本没有口令数据库，所以不可能更改远程Win95/98主
机上的口令。

-R name resolve order
This option allows the user of smbclient to determine what name resolution
services to use when looking up the NetBIOS name of the host being connected
to.
用这个选项来让使用smbclient的用户在查询主机NetBIOS名字用于联接时，决定使用怎样
的名字解析服务。

The options are :"lmhosts", "host", "wins" and "bcast". They cause names to
be resolved as follows :

以下有三种方法可以用在名字解析上：

lmhosts : Lookup an IP address in the Samba lmhosts file.

lmhosts代表在samba的lmhosts文件中查询IP地址。

host : Do a standard host name to IP address resolution, using the system
/etc/hosts, NIS, or DNS lookups. This method of name resolution is operating
system dependent. For instance on IRIX or Solaris, this may be controlled by
the /etc/nsswitch.conf file).

host代表使用标准的主机名到IP地址的解析方法，这需要用到系统中的/etc/hosts文件、
NIS或者DNS。如何使用这个名字解析由系统决定。举例来说，在IRIX或者Solaris系统中
，/etc/nsswitch.conf文件会处理这些问题。

wins : Query a name with the IP address listed in the wins server parameter
in the smb.conf file. If no WINS server has been specified this method will
be ignored.

wins代表向smb.conf配置文件中设定的wins server参数指定的WINS服务器进行查询。如
果不指定WINS服务器的话这种方法将会被忽略。

bcast : Do a broadcast on each of the known local interfaces listed in the
interfaces parameter in the smb.conf file. This is the least reliable of the
name resolution methods as it depends on the target host being on a locally
connected subnet.

bcast代表向smb.conf配置文件中设定的interfaces参数列出的本地接口上广播查询。当
目标主机联接到本地子网时这是最可靠的名字解析方法。

If this parameter is not set then the name resolve order defined in the
smb.conf file parameter name resolve order will be used.

如果不使用这个参数的话，将按smb.conf配置文件中name resolve order参数指定的次序
来进行名字解析。

The default order is lmhosts, host, wins, bcast and without this parameter or
any entry in the smb.conf file the name resolution methods will be attempted
in this order.

默认的解析次序是lmhosts，host，wins，bcast，在不使用这个参数或者没有在smb.conf
设定名字解析方法的情况下将使用这样的次序进行解析。

-m
This option tells smbpasswd that the account being changed is a MACHINE
account. Currently this is used when Samba is being used as an NT Primary
Domain Controller. PDC support is not a supported feature in Samba2.0 but
will become supported in a later release. If you wish to know more about
using Samba as an NT PDC then please subscribe to the mailing list
samba-ntdom@samba.org.
smbpasswd用这个选项来把账号改为一个MACHINE账号。通常当samba作为NT主域控制器的
时候可以使用它。PDC功能在samba 2.0版本中是个不被支持的功能，而在以后的版本中将
会对它进行支持。如果要了解关于把samba作为一个NT主域控制器的情况可以订阅
samba-ntdom@samba.org的邮件列表。

This option is only available when running smbpasswd as root.

只有root运行smbpasswd程序时才可以使用这个选项。

-j DOMAIN
This option is used to add a Samba server into a Windows NT Domain, as a
Domain member capable of authenticating user accounts to any Domain
Controller in the same way as a Windows NT Server. See the security=domain
option in the smb.conf (5) man page.
使用这个选项可以把samba服务器作为一个与NT服务器一样具有验证用户账号能力的域成
员加入到NT域中。请参见smb.conf (5)配置文件中的security=domain参数。

In order to be used in this way, the Administrator for the Windows NT Domain
must have used the program "Server Manager for Domains" to add the primary
NetBIOS name of the Samba server as a member of the Domain.

为了使用这个选项，NT域管理员必须先用“Server Manager for Domains”程序加入作为
域成员的samba服务器的primary NetBIOS name。

After this has been done, to join the Domain invoke smbpasswd with this
parameter. smbpasswd will then look up the Primary Domain Controller for the
Domain found in the smb.conf file in the parameter password server and change
the machine account password used to create the secure Domain communication.
This password is then stored by smbpasswd in a file, read only by root,
called <Domain>.<Machine>.mac where <Domain> is the name of the Domain we are
joining and <Machine> is the primary NetBIOS name of the machine we are
running on.

完成这步工作以后，调用带这个参数的smbpasswd命令来加入到域中。smbpasswd会查询
smb.conf配置文件中password server参数指定的主域控制器，改变机器账号的口令用于
建立安全的域内通信。smbpasswd会把这个口令保存在一个只有root用户可读的名字为
<Domain>.<Machine>.mac的文件中，其中的<Domain>是要加入的域名而<Machine>是本身
主机的NetBIOS名字。对于具体的操作还可参见DOMAIN_MEMBER中的描述。

Once this operation has been performed the smb.conf file may be updated to
set the security=domain option and all future logins to the Samba server will
be authenticated to the Windows NT PDC.

一旦执行了这些操作，smb.conf配置文件就把安全级更新为security=domain，今后所有
对samba服务器的登录都被由NT的PDC来验证。

Note that even though the authentication is being done to the PDC all users
accessing the Samba server must still have a valid UNIX account on that
machine.

注意虽然验证工作是由PDC来完成，但是PDC上所有的用户要访问samba服务器仍然必须要
有服务器上的合法UNIX账号。

This option is only available when running smbpasswd as root.

只有root运行smbpasswd程序时才可以使用这个选项。

-U username
This option may only be used in conjunction with the -r option. When changing
a password on a remote machine it allows the user to specify the user name on
that machine whose password will be changed. It is present to allow users who
have different user names on different systems to change these passwords.
　
这个选项只能和-r选项联合使用。当从远程主机更改口令时，用它来允许用户指定要改变
的远程主机口令的用户账号。这使得用户可以在不同的系统上使用不同的账号来改变这些
口令。
-h
This option prints the help string for smbpasswd, selecting the correct one
for running as root or as an ordinary user.
使用这个选项可以打印出root用户和普通用户使用smbpasswd的帮助信息，
　
-s
This option causes smbpasswd to be silent (i.e. not issue prompts) and to
read it's old and new passwords from standard input, rather than from
/dev/tty (like the passwd (1) program does). This option is to aid people
writing scripts to drive smbpasswd
使用这个选项会使smbpasswd在标准输入上读取原口令和新口令时保持静态(例如发出提示
)，这样使用比从/dev/tty上读口令(象passwd (1)就是这样做的)更好。使用脚本来处理
smbpasswd时可以考虑用它。
username
This specifies the username for all of the root only options to operate on.
Only root can specify this parameter as only root has the permission needed
to modify attributes directly in the local smbpasswd file.
这里指定的用户名是针对那些只有root能用的操作参数中要用到的账号。只有root可以使
用这个参数，并有权直接在本地smbpasswd文件中更改属性。
　
NOTES

注意

Since smbpasswd works in client-server mode communicating with a local smbd
for a non-root user then the smbd daemon must be running for this to work. A
common problem is to add a restriction to the hosts that may access the smbd
running on the local machine by specifying a "allow hosts" or "deny hosts"
entry in the smb.conf file and neglecting to allow "localhost" access to the
smbd.

当非root用户用smbpasswd以客户机-服务器模式与本地smbd通信时时，smbd守护程序必须
在运行之中。问题是在本地主机上运行的smbd可以通过在smb.conf配置文件中指定allow
hosts和deny hosts参数并忽略localhost对smbd的访问来对访问的主机进行一定的限制。

In addition, the smbpasswd command is only useful if Samba has been set up to
use encrypted passwords. See the file ENCRYPTION.txt in the docs directory
for details on how to do this.

另外smbpasswd命令只有在已经把samba设成使用加密口令时才能发挥作用。详细情况看一
下docs目录中的ENCRYPTION.txt。

VERSION

版本

This man page is correct for version 2.0 of the Samba suite.

此手册页是针对samba套件版本2.0的。

AUTHOR

作者

The original Samba software and related utilities were created by Andrew
Tridgell samba-bugs@samba.org. Samba is now developed by the Samba Team as an
Open Source project similar to the way the Linux kernel is developed.

samba软件和相关工具最初由Andrew Tridgell samba-bugs@samba.org创建。samba现在由
开发组作为类似Linux内核开发采用的开放源代码计划方式来发展。

The original Samba man pages were written by Karl Auer. The man page sources
were converted to YODL format (another excellent piece of Open Source
software, available at ftp://ftp.icce.rug.nl/pub/unix/) and updated for the
Samba2.0 release by Jeremy Allison. samba-bugs@samba.org.

samba手册页最初由Karl Auer撰写。它的源码已被转换成YODL(一种极好的开放源代码软
件，可以在ftp://ftp.icce.rug.nl/pub/unix/处获得)格式并已由Jeremy Allison更新到
samba2.0版本。

See samba (7) to find out how to get a full list of contributors and details
on how to submit bug reports, comments etc.

请参见samba (7)查找如何获得一份完整的维护者列表以及如何提交错误报告及注解等等
。

--
"这一千多年没写诗了?"
"写了, 不过只写了两句."
"千年得两句, 一定是万古丽句了. 念来听听."
"好吧, 我现丑了" 太白星清了清嗓子, 浑厚的男中音在天庭响起:
大海啊, 都是水;
骏马啊, 四条腿;

※ 来源:·紫丁香 bbs.hit.edu.cn·[FROM: freesrc.hit.edu]

Linux 版 (精华区)