Generate samba password hash programatically

Question

I was wondering if there is a standard linux/ubuntu command to generate SMB password hashes to stdout. For the curious, I am wanting to manage a set of of usernames and passwords across multiple machines (using Puppet) including access via Samba (for now, not using something more general like LDAP). More specifically an equivalent of this command that I use to generate linux passwd entries but for SMB/Samba:

openssl passwd -1

Thanks,

Alex

Answer 1

Internally, Samba stores the same LM and NT hashes as Windows does, and which are used for NTLM authentication.

• The NT hash uses the MD4 algorithm, applied to the password in UTF-16 Little Endian encoding. You can use ordinary tools to calculate it, for example:

  #!/usr/bin/env perl
  use Digest::MD4 qw(md4_hex);
  use Encode qw(encode);
  chomp(my $pw = <STDIN>);
  print md4_hex(encode("UTF-16LE", $pw)), "\n";
  

  or OpenSSL:

  printf '%s' "$pw" | iconv -t utf16le | openssl md4
  

• The LM hash is horribly insecure. Nobody uses it anymore. Do not use it.

However, including the hashes as part of your scripts is a very bad idea, not much better than keeping the passwords themselves. The unsalted MD4 hash is very easy to crack if one wants to obtain the original password, and even without that, the hash is password-equivalent – anyone who has the hash can perform NTLM authentication without needing the password itself. (Windows does not allow anyone, not even the administrators, to access the SAM directly, so a salt was initially thought to be unnecessary.)