Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was wondering if there is a standard Linux/Ubuntu command to generate SMB password hashes to stdout. For the curious, I am wanting to manage a set of usernames and passwords across multiple machines (using Puppet) including access via Samba (for now, not using something more general like LDAP). More specifically, an equivalent of this command that I use to generate Linux password entries but for SMB/Samba:

openssl passwd -1
share|improve this question
    
Wouldn't it be better to add the accounts using smbpasswd? Messing with internal Samba data storage is not really recommended. –  grawity Feb 6 '12 at 21:13
    
I could do it via smbpasswd, but then we would need to have the passwords in plaintext in the puppet repo. Which is somewhat undesirable. –  Alex Wilson Feb 7 '12 at 9:36
    
Afaik, Samba stores the same MD4 hash as Windows does. This hash is password-equivalent, knowing it allows authentication the same way knowing the password does. That, and the vulnerabilities of MD4, make your idea of including hashes in the repo just as bad. –  grawity Feb 7 '12 at 9:59
    
Mmm.I knew the samba password hashing was weak. Didn't know it was quite that bad. Nonetheless, I think it is appreciably better for us to have the hashes rather than the plaintext. –  Alex Wilson Feb 8 '12 at 16:06

1 Answer 1

up vote 1 down vote accepted

Internally, Samba stores the same LM and NT hashes as Windows does, and which are used for NTLM authentication.

  • The NT hash uses the MD4 algorithm, applied to the password in UTF-16 Little Endian encoding. You can use ordinary tools to calculate it, for example:

    #!/usr/bin/env perl
    use Digest::MD4 qw(md4_hex);
    use Encode qw(encode);
    chomp(my $pw = <STDIN>);
    print md4_hex(encode("UTF-16LE", $pw)), "\n";
    

    or OpenSSL:

    printf '%s' "$pw" | iconv -t utf16le | openssl md4
    
  • The LM hash is horribly insecure. Nobody uses it anymore. Do not use it.

However, including the hashes as part of your scripts is a very bad idea, not much better than keeping the passwords themselves. The unsalted MD4 hash is very easy to crack if one wants to obtain the original password, and even without that, the hash is password-equivalent – anyone who has the hash can perform NTLM authentication without needing the password itself. (Windows does not allow anyone, not even the administrators, to access the SAM directly, so a salt was initially thought to be unnecessary.)

share|improve this answer
    
A good and thorough reply. Thanks. As a result of your caveats, I think we may revisit ldap/kerberos as an alternative, more secure authentication/authorization system. –  Alex Wilson Feb 8 '12 at 23:05
    
@Alex: LDAP/Kerberos is the usual choice for Unix networks. But if most clients are using Windows, Active Directory (using Samba 4 as the domain controller) might be a lot easier than plain old OpenLDAP+krb5, especially when it comes to authenticating for SMB shares. –  grawity Feb 8 '12 at 23:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.