| 1 | .\" Title: ntlm_auth
|
|---|
| 2 | .\" Author:
|
|---|
| 3 | .\" Generator: DocBook XSL Stylesheets v1.73.2 <http://docbook.sf.net/>
|
|---|
| 4 | .\" Date: 08/25/2008
|
|---|
| 5 | .\" Manual: User Commands
|
|---|
| 6 | .\" Source: Samba 3.0
|
|---|
| 7 | .\"
|
|---|
| 8 | .TH "NTLM_AUTH" "1" "08/25/2008" "Samba 3\.0" "User Commands"
|
|---|
| 9 | .\" disable hyphenation
|
|---|
| 10 | .nh
|
|---|
| 11 | .\" disable justification (adjust text to left margin only)
|
|---|
| 12 | .ad l
|
|---|
| 13 | .SH "NAME"
|
|---|
| 14 | ntlm_auth - tool to allow external access to Winbind's NTLM authentication function
|
|---|
| 15 | .SH "SYNOPSIS"
|
|---|
| 16 | .HP 1
|
|---|
| 17 | ntlm_auth [\-d\ debuglevel] [\-l\ logdir] [\-s\ <smb\ config\ file>]
|
|---|
| 18 | .SH "DESCRIPTION"
|
|---|
| 19 | .PP
|
|---|
| 20 | This tool is part of the
|
|---|
| 21 | \fBsamba\fR(7)
|
|---|
| 22 | suite\.
|
|---|
| 23 | .PP
|
|---|
| 24 | ntlm_auth
|
|---|
| 25 | is a helper utility that authenticates users using NT/LM authentication\. It returns 0 if the users is authenticated successfully and 1 if access was denied\. ntlm_auth uses winbind to access the user and authentication data for a domain\. This utility is only indended to be used by other programs (currently
|
|---|
| 26 | Squid
|
|---|
| 27 | and
|
|---|
| 28 | mod_ntlm_winbind)
|
|---|
| 29 | .SH "OPERATIONAL REQUIREMENTS"
|
|---|
| 30 | .PP
|
|---|
| 31 | The
|
|---|
| 32 | \fBwinbindd\fR(8)
|
|---|
| 33 | daemon must be operational for many of these commands to function\.
|
|---|
| 34 | .PP
|
|---|
| 35 | Some of these commands also require access to the directory
|
|---|
| 36 | \fIwinbindd_privileged\fR
|
|---|
| 37 | in
|
|---|
| 38 | \fI$LOCKDIR\fR\. This should be done either by running this command as root or providing group access to the
|
|---|
| 39 | \fIwinbindd_privileged\fR
|
|---|
| 40 | directory\. For security reasons, this directory should not be world\-accessable\.
|
|---|
| 41 | .SH "OPTIONS"
|
|---|
| 42 | .PP
|
|---|
| 43 | \-\-helper\-protocol=PROTO
|
|---|
| 44 | .RS 4
|
|---|
| 45 | Operate as a stdio\-based helper\. Valid helper protocols are:
|
|---|
| 46 | .PP
|
|---|
| 47 | squid\-2\.4\-basic
|
|---|
| 48 | .RS 4
|
|---|
| 49 | Server\-side helper for use with Squid 2\.4\'s basic (plaintext) authentication\.
|
|---|
| 50 | .RE
|
|---|
| 51 | .PP
|
|---|
| 52 | squid\-2\.5\-basic
|
|---|
| 53 | .RS 4
|
|---|
| 54 | Server\-side helper for use with Squid 2\.5\'s basic (plaintext) authentication\.
|
|---|
| 55 | .RE
|
|---|
| 56 | .PP
|
|---|
| 57 | squid\-2\.5\-ntlmssp
|
|---|
| 58 | .RS 4
|
|---|
| 59 | Server\-side helper for use with Squid 2\.5\'s NTLMSSP authentication\.
|
|---|
| 60 | .sp
|
|---|
| 61 | Requires access to the directory
|
|---|
| 62 | \fIwinbindd_privileged\fR
|
|---|
| 63 | in
|
|---|
| 64 | \fI$LOCKDIR\fR\. The protocol used is described here:
|
|---|
| 65 | http://devel\.squid\-cache\.org/ntlm/squid_helper_protocol\.html\. This protocol has been extended to allow the NTLMSSP Negotiate packet to be included as an argument to the
|
|---|
| 66 | YR
|
|---|
| 67 | command\. (Thus avoiding loss of information in the protocol exchange)\.
|
|---|
| 68 | .RE
|
|---|
| 69 | .PP
|
|---|
| 70 | ntlmssp\-client\-1
|
|---|
| 71 | .RS 4
|
|---|
| 72 | Client\-side helper for use with arbitrary external programs that may wish to use Samba\'s NTLMSSP authentication knowledge\.
|
|---|
| 73 | .sp
|
|---|
| 74 | This helper is a client, and as such may be run by any user\. The protocol used is effectively the reverse of the previous protocol\. A
|
|---|
| 75 | YR
|
|---|
| 76 | command (without any arguments) starts the authentication exchange\.
|
|---|
| 77 | .RE
|
|---|
| 78 | .PP
|
|---|
| 79 | gss\-spnego
|
|---|
| 80 | .RS 4
|
|---|
| 81 | Server\-side helper that implements GSS\-SPNEGO\. This uses a protocol that is almost the same as
|
|---|
| 82 | squid\-2\.5\-ntlmssp, but has some subtle differences that are undocumented outside the source at this stage\.
|
|---|
| 83 | .sp
|
|---|
| 84 | Requires access to the directory
|
|---|
| 85 | \fIwinbindd_privileged\fR
|
|---|
| 86 | in
|
|---|
| 87 | \fI$LOCKDIR\fR\.
|
|---|
| 88 | .RE
|
|---|
| 89 | .PP
|
|---|
| 90 | gss\-spnego\-client
|
|---|
| 91 | .RS 4
|
|---|
| 92 | Client\-side helper that implements GSS\-SPNEGO\. This also uses a protocol similar to the above helpers, but is currently undocumented\.
|
|---|
| 93 | .RE
|
|---|
| 94 | .PP
|
|---|
| 95 | ntlm\-server\-1
|
|---|
| 96 | .RS 4
|
|---|
| 97 | Server\-side helper protocol, intended for use by a RADIUS server or the \'winbind\' plugin for pppd, for the provision of MSCHAP and MSCHAPv2 authentication\.
|
|---|
| 98 | .sp
|
|---|
| 99 | This protocol consists of lines in the form:
|
|---|
| 100 | Parameter: value
|
|---|
| 101 | and
|
|---|
| 102 | Parameter:: Base64\-encode value\. The presence of a single period
|
|---|
| 103 | \.
|
|---|
| 104 | indicates that one side has finished supplying data to the other\. (Which in turn could cause the helper to authenticate the user)\.
|
|---|
| 105 | .sp
|
|---|
| 106 | Curently implemented parameters from the external program to the helper are:
|
|---|
| 107 | .PP
|
|---|
| 108 | Username
|
|---|
| 109 | .RS 4
|
|---|
| 110 | The username, expected to be in Samba\'s
|
|---|
| 111 | \fIunix charset\fR\.
|
|---|
| 112 | .PP \fBExample\ 1.\ \fR Username: bob
|
|---|
| 113 | .PP \fBExample\ 2.\ \fR Username:: Ym9i
|
|---|
| 114 | .RE
|
|---|
| 115 | .PP
|
|---|
| 116 | Username
|
|---|
| 117 | .RS 4
|
|---|
| 118 | The user\'s domain, expected to be in Samba\'s
|
|---|
| 119 | \fIunix charset\fR\.
|
|---|
| 120 | .PP \fBExample\ 3.\ \fR Domain: WORKGROUP
|
|---|
| 121 | .PP \fBExample\ 4.\ \fR Domain:: V09SS0dST1VQ
|
|---|
| 122 | .RE
|
|---|
| 123 | .PP
|
|---|
| 124 | Full\-Username
|
|---|
| 125 | .RS 4
|
|---|
| 126 | The fully qualified username, expected to be in Samba\'s
|
|---|
| 127 | \fIunix charset\fR
|
|---|
| 128 | and qualified with the
|
|---|
| 129 | \fIwinbind separator\fR\.
|
|---|
| 130 | .PP \fBExample\ 5.\ \fR Full\-Username: WORKGROUP\ebob
|
|---|
| 131 | .PP \fBExample\ 6.\ \fR Full\-Username:: V09SS0dST1VQYm9i
|
|---|
| 132 | .RE
|
|---|
| 133 | .PP
|
|---|
| 134 | LANMAN\-Challenge
|
|---|
| 135 | .RS 4
|
|---|
| 136 | The 8 byte
|
|---|
| 137 | LANMAN Challenge
|
|---|
| 138 | value, generated randomly by the server, or (in cases such as MSCHAPv2) generated in some way by both the server and the client\.
|
|---|
| 139 | .PP \fBExample\ 7.\ \fR LANMAN\-Challege: 0102030405060708
|
|---|
| 140 | .RE
|
|---|
| 141 | .PP
|
|---|
| 142 | LANMAN\-Response
|
|---|
| 143 | .RS 4
|
|---|
| 144 | The 24 byte
|
|---|
| 145 | LANMAN Response
|
|---|
| 146 | value, calculated from the user\'s password and the supplied
|
|---|
| 147 | LANMAN Challenge\. Typically, this is provided over the network by a client wishing to authenticate\.
|
|---|
| 148 | .PP \fBExample\ 8.\ \fR LANMAN\-Response: 0102030405060708090A0B0C0D0E0F101112131415161718
|
|---|
| 149 | .RE
|
|---|
| 150 | .PP
|
|---|
| 151 | NT\-Response
|
|---|
| 152 | .RS 4
|
|---|
| 153 | The >= 24 byte
|
|---|
| 154 | NT Response
|
|---|
| 155 | calculated from the user\'s password and the supplied
|
|---|
| 156 | LANMAN Challenge\. Typically, this is provided over the network by a client wishing to authenticate\.
|
|---|
| 157 | .PP \fBExample\ 9.\ \fR NT\-Response: 0102030405060708090A0B0C0D0E0F101112131415161718
|
|---|
| 158 | .RE
|
|---|
| 159 | .PP
|
|---|
| 160 | Password
|
|---|
| 161 | .RS 4
|
|---|
| 162 | The user\'s password\. This would be provided by a network client, if the helper is being used in a legacy situation that exposes plaintext passwords in this way\.
|
|---|
| 163 | .PP \fBExample\ 10.\ \fR Password: samba2
|
|---|
| 164 | .PP \fBExample\ 11.\ \fR Password:: c2FtYmEy
|
|---|
| 165 | .RE
|
|---|
| 166 | .PP
|
|---|
| 167 | Request\-User\-Session\-Key
|
|---|
| 168 | .RS 4
|
|---|
| 169 | Apon sucessful authenticaiton, return the user session key associated with the login\.
|
|---|
| 170 | .PP \fBExample\ 12.\ \fR Request\-User\-Session\-Key: Yes
|
|---|
| 171 | .RE
|
|---|
| 172 | .PP
|
|---|
| 173 | Request\-LanMan\-Session\-Key
|
|---|
| 174 | .RS 4
|
|---|
| 175 | Apon sucessful authenticaiton, return the LANMAN session key associated with the login\.
|
|---|
| 176 | .PP \fBExample\ 13.\ \fR Request\-LanMan\-Session\-Key: Yes
|
|---|
| 177 | .RE
|
|---|
| 178 | .sp
|
|---|
| 179 | .it 1 an-trap
|
|---|
| 180 | .nr an-no-space-flag 1
|
|---|
| 181 | .nr an-break-flag 1
|
|---|
| 182 | .br
|
|---|
| 183 | Warning
|
|---|
| 184 | Implementors should take care to base64 encode
|
|---|
| 185 | any data (such as usernames/passwords) that may contain malicous user data, such as
|
|---|
| 186 | a newline\. They may also need to decode strings from
|
|---|
| 187 | the helper, which likewise may have been base64 encoded\.
|
|---|
| 188 | .RE
|
|---|
| 189 | .RE
|
|---|
| 190 | .PP
|
|---|
| 191 | \-\-username=USERNAME
|
|---|
| 192 | .RS 4
|
|---|
| 193 | Specify username of user to authenticate
|
|---|
| 194 | .RE
|
|---|
| 195 | .PP
|
|---|
| 196 | \-\-domain=DOMAIN
|
|---|
| 197 | .RS 4
|
|---|
| 198 | Specify domain of user to authenticate
|
|---|
| 199 | .RE
|
|---|
| 200 | .PP
|
|---|
| 201 | \-\-workstation=WORKSTATION
|
|---|
| 202 | .RS 4
|
|---|
| 203 | Specify the workstation the user authenticated from
|
|---|
| 204 | .RE
|
|---|
| 205 | .PP
|
|---|
| 206 | \-\-challenge=STRING
|
|---|
| 207 | .RS 4
|
|---|
| 208 | NTLM challenge (in HEXADECIMAL)
|
|---|
| 209 | .RE
|
|---|
| 210 | .PP
|
|---|
| 211 | \-\-lm\-response=RESPONSE
|
|---|
| 212 | .RS 4
|
|---|
| 213 | LM Response to the challenge (in HEXADECIMAL)
|
|---|
| 214 | .RE
|
|---|
| 215 | .PP
|
|---|
| 216 | \-\-nt\-response=RESPONSE
|
|---|
| 217 | .RS 4
|
|---|
| 218 | NT or NTLMv2 Response to the challenge (in HEXADECIMAL)
|
|---|
| 219 | .RE
|
|---|
| 220 | .PP
|
|---|
| 221 | \-\-password=PASSWORD
|
|---|
| 222 | .RS 4
|
|---|
| 223 | User\'s plaintext password
|
|---|
| 224 | .sp
|
|---|
| 225 | If not specified on the command line, this is prompted for when required\.
|
|---|
| 226 | .sp
|
|---|
| 227 | For the NTLMSSP based server roles, this parameter specifies the expected password, allowing testing without winbindd operational\.
|
|---|
| 228 | .RE
|
|---|
| 229 | .PP
|
|---|
| 230 | \-\-request\-lm\-key
|
|---|
| 231 | .RS 4
|
|---|
| 232 | Retreive LM session key
|
|---|
| 233 | .RE
|
|---|
| 234 | .PP
|
|---|
| 235 | \-\-request\-nt\-key
|
|---|
| 236 | .RS 4
|
|---|
| 237 | Request NT key
|
|---|
| 238 | .RE
|
|---|
| 239 | .PP
|
|---|
| 240 | \-\-diagnostics
|
|---|
| 241 | .RS 4
|
|---|
| 242 | Perform Diagnostics on the authentication chain\. Uses the password from
|
|---|
| 243 | \-\-password
|
|---|
| 244 | or prompts for one\.
|
|---|
|
|---|
