| 1 | '\" t
|
|---|
| 2 | .\" Title: ntlm_auth
|
|---|
| 3 | .\" Author: [see the "AUTHOR" section]
|
|---|
| 4 | .\" Generator: DocBook XSL Stylesheets v1.75.2 <http://docbook.sf.net/>
|
|---|
| 5 | .\" Date: 06/14/2011
|
|---|
| 6 | .\" Manual: User Commands
|
|---|
| 7 | .\" Source: Samba 3.5
|
|---|
| 8 | .\" Language: English
|
|---|
| 9 | .\"
|
|---|
| 10 | .TH "NTLM_AUTH" "1" "06/14/2011" "Samba 3\&.5" "User Commands"
|
|---|
| 11 | .\" -----------------------------------------------------------------
|
|---|
| 12 | .\" * set default formatting
|
|---|
| 13 | .\" -----------------------------------------------------------------
|
|---|
| 14 | .\" disable hyphenation
|
|---|
| 15 | .nh
|
|---|
| 16 | .\" disable justification (adjust text to left margin only)
|
|---|
| 17 | .ad l
|
|---|
| 18 | .\" -----------------------------------------------------------------
|
|---|
| 19 | .\" * MAIN CONTENT STARTS HERE *
|
|---|
| 20 | .\" -----------------------------------------------------------------
|
|---|
| 21 | .SH "NAME"
|
|---|
| 22 | ntlm_auth \- tool to allow external access to Winbind\'s NTLM authentication function
|
|---|
| 23 | .SH "SYNOPSIS"
|
|---|
| 24 | .HP \w'\ 'u
|
|---|
| 25 | ntlm_auth [\-d\ debuglevel] [\-l\ logdir] [\-s\ <smb\ config\ file>]
|
|---|
| 26 | .SH "DESCRIPTION"
|
|---|
| 27 | .PP
|
|---|
| 28 | This tool is part of the
|
|---|
| 29 | \fBsamba\fR(7)
|
|---|
| 30 | suite\&.
|
|---|
| 31 | .PP
|
|---|
| 32 | ntlm_auth
|
|---|
| 33 | is a helper utility that authenticates users using NT/LM authentication\&. It returns 0 if the users is authenticated successfully and 1 if access was denied\&. ntlm_auth uses winbind to access the user and authentication data for a domain\&. This utility is only intended to be used by other programs (currently
|
|---|
| 34 | Squid
|
|---|
| 35 | and
|
|---|
| 36 | mod_ntlm_winbind)
|
|---|
| 37 | .SH "OPERATIONAL REQUIREMENTS"
|
|---|
| 38 | .PP
|
|---|
| 39 | The
|
|---|
| 40 | \fBwinbindd\fR(8)
|
|---|
| 41 | daemon must be operational for many of these commands to function\&.
|
|---|
| 42 | .PP
|
|---|
| 43 | Some of these commands also require access to the directory
|
|---|
| 44 | winbindd_privileged
|
|---|
| 45 | in
|
|---|
| 46 | $LOCKDIR\&. This should be done either by running this command as root or providing group access to the
|
|---|
| 47 | winbindd_privileged
|
|---|
| 48 | directory\&. For security reasons, this directory should not be world\-accessable\&.
|
|---|
| 49 | .SH "OPTIONS"
|
|---|
| 50 | .PP
|
|---|
| 51 | \-\-helper\-protocol=PROTO
|
|---|
| 52 | .RS 4
|
|---|
| 53 | Operate as a stdio\-based helper\&. Valid helper protocols are:
|
|---|
| 54 | .PP
|
|---|
| 55 | squid\-2\&.4\-basic
|
|---|
| 56 | .RS 4
|
|---|
| 57 | Server\-side helper for use with Squid 2\&.4\'s basic (plaintext) authentication\&.
|
|---|
| 58 | .RE
|
|---|
| 59 | .PP
|
|---|
| 60 | squid\-2\&.5\-basic
|
|---|
| 61 | .RS 4
|
|---|
| 62 | Server\-side helper for use with Squid 2\&.5\'s basic (plaintext) authentication\&.
|
|---|
| 63 | .RE
|
|---|
| 64 | .PP
|
|---|
| 65 | squid\-2\&.5\-ntlmssp
|
|---|
| 66 | .RS 4
|
|---|
| 67 | Server\-side helper for use with Squid 2\&.5\'s NTLMSSP authentication\&.
|
|---|
| 68 | .sp
|
|---|
| 69 | Requires access to the directory
|
|---|
| 70 | winbindd_privileged
|
|---|
| 71 | in
|
|---|
| 72 | $LOCKDIR\&. The protocol used is described here:
|
|---|
| 73 | http://devel\&.squid\-cache\&.org/ntlm/squid_helper_protocol\&.html\&. This protocol has been extended to allow the NTLMSSP Negotiate packet to be included as an argument to the
|
|---|
| 74 | YR
|
|---|
| 75 | command\&. (Thus avoiding loss of information in the protocol exchange)\&.
|
|---|
| 76 | .RE
|
|---|
| 77 | .PP
|
|---|
| 78 | ntlmssp\-client\-1
|
|---|
| 79 | .RS 4
|
|---|
| 80 | Client\-side helper for use with arbitrary external programs that may wish to use Samba\'s NTLMSSP authentication knowledge\&.
|
|---|
| 81 | .sp
|
|---|
| 82 | This helper is a client, and as such may be run by any user\&. The protocol used is effectively the reverse of the previous protocol\&. A
|
|---|
| 83 | YR
|
|---|
| 84 | command (without any arguments) starts the authentication exchange\&.
|
|---|
| 85 | .RE
|
|---|
| 86 | .PP
|
|---|
| 87 | gss\-spnego
|
|---|
| 88 | .RS 4
|
|---|
| 89 | Server\-side helper that implements GSS\-SPNEGO\&. This uses a protocol that is almost the same as
|
|---|
| 90 | squid\-2\&.5\-ntlmssp, but has some subtle differences that are undocumented outside the source at this stage\&.
|
|---|
| 91 | .sp
|
|---|
| 92 | Requires access to the directory
|
|---|
| 93 | winbindd_privileged
|
|---|
| 94 | in
|
|---|
| 95 | $LOCKDIR\&.
|
|---|
| 96 | .RE
|
|---|
| 97 | .PP
|
|---|
| 98 | gss\-spnego\-client
|
|---|
| 99 | .RS 4
|
|---|
| 100 | Client\-side helper that implements GSS\-SPNEGO\&. This also uses a protocol similar to the above helpers, but is currently undocumented\&.
|
|---|
| 101 | .RE
|
|---|
| 102 | .PP
|
|---|
| 103 | ntlm\-server\-1
|
|---|
| 104 | .RS 4
|
|---|
| 105 | Server\-side helper protocol, intended for use by a RADIUS server or the \'winbind\' plugin for pppd, for the provision of MSCHAP and MSCHAPv2 authentication\&.
|
|---|
| 106 | .sp
|
|---|
| 107 | This protocol consists of lines in the form:
|
|---|
| 108 | Parameter: value
|
|---|
| 109 | and
|
|---|
| 110 | Parameter:: Base64\-encode value\&. The presence of a single period
|
|---|
| 111 | \&.
|
|---|
| 112 | indicates that one side has finished supplying data to the other\&. (Which in turn could cause the helper to authenticate the user)\&.
|
|---|
| 113 | .sp
|
|---|
| 114 | Curently implemented parameters from the external program to the helper are:
|
|---|
| 115 | .PP
|
|---|
| 116 | Username
|
|---|
| 117 | .RS 4
|
|---|
| 118 | The username, expected to be in Samba\'s
|
|---|
| 119 | \m[blue]\fBunix charset\fR\m[]\&.
|
|---|
| 120 | .PP \fBExample\ \&1.\ \&\fR Username: bob
|
|---|
| 121 | .PP \fBExample\ \&2.\ \&\fR Username:: Ym9i
|
|---|
| 122 | .RE
|
|---|
| 123 | .PP
|
|---|
| 124 | NT\-Domain
|
|---|
| 125 | .RS 4
|
|---|
| 126 | The user\'s domain, expected to be in Samba\'s
|
|---|
| 127 | \m[blue]\fBunix charset\fR\m[]\&.
|
|---|
| 128 | .PP \fBExample\ \&3.\ \&\fR NT\-Domain: WORKGROUP
|
|---|
| 129 | .PP \fBExample\ \&4.\ \&\fR NT\-Domain:: V09SS0dST1VQ
|
|---|
| 130 | .RE
|
|---|
| 131 | .PP
|
|---|
| 132 | Full\-Username
|
|---|
| 133 | .RS 4
|
|---|
| 134 | The fully qualified username, expected to be in Samba\'s
|
|---|
| 135 | \m[blue]\fBunix charset\fR\m[]
|
|---|
| 136 | and qualified with the
|
|---|
| 137 | \m[blue]\fBwinbind separator\fR\m[]\&.
|
|---|
| 138 | .PP \fBExample\ \&5.\ \&\fR Full\-Username: WORKGROUP\ebob
|
|---|
| 139 | .PP \fBExample\ \&6.\ \&\fR Full\-Username:: V09SS0dST1VQYm9i
|
|---|
| 140 | .RE
|
|---|
| 141 | .PP
|
|---|
| 142 | LANMAN\-Challenge
|
|---|
| 143 | .RS 4
|
|---|
| 144 | The 8 byte
|
|---|
| 145 | LANMAN Challenge
|
|---|
| 146 | value, generated randomly by the server, or (in cases such as MSCHAPv2) generated in some way by both the server and the client\&.
|
|---|
| 147 | .PP \fBExample\ \&7.\ \&\fR LANMAN\-Challege: 0102030405060708
|
|---|
| 148 | .RE
|
|---|
| 149 | .PP
|
|---|
| 150 | LANMAN\-Response
|
|---|
| 151 | .RS 4
|
|---|
| 152 | The 24 byte
|
|---|
| 153 | LANMAN Response
|
|---|
| 154 | value, calculated from the user\'s password and the supplied
|
|---|
| 155 | LANMAN Challenge\&. Typically, this is provided over the network by a client wishing to authenticate\&.
|
|---|
| 156 | .PP \fBExample\ \&8.\ \&\fR LANMAN\-Response: 0102030405060708090A0B0C0D0E0F101112131415161718
|
|---|
| 157 | .RE
|
|---|
| 158 | .PP
|
|---|
| 159 | NT\-Response
|
|---|
| 160 | .RS 4
|
|---|
| 161 | The >= 24 byte
|
|---|
| 162 | NT Response
|
|---|
| 163 | calculated from the user\'s password and the supplied
|
|---|
| 164 | LANMAN Challenge\&. Typically, this is provided over the network by a client wishing to authenticate\&.
|
|---|
| 165 | .PP \fBExample\ \&9.\ \&\fR NT\-Response: 0102030405060708090A0B0C0D0E0F101112131415161718
|
|---|
| 166 | .RE
|
|---|
| 167 | .PP
|
|---|
| 168 | Password
|
|---|
| 169 | .RS 4
|
|---|
| 170 | The user\'s password\&. This would be provided by a network client, if the helper is being used in a legacy situation that exposes plaintext passwords in this way\&.
|
|---|
| 171 | .PP \fBExample\ \&10.\ \&\fR Password: samba2
|
|---|
| 172 | .PP \fBExample\ \&11.\ \&\fR Password:: c2FtYmEy
|
|---|
| 173 | .RE
|
|---|
| 174 | .PP
|
|---|
| 175 | Request\-User\-Session\-Key
|
|---|
| 176 | .RS 4
|
|---|
| 177 | Apon sucessful authenticaiton, return the user session key associated with the login\&.
|
|---|
| 178 | .PP \fBExample\ \&12.\ \&\fR Request\-User\-Session\-Key: Yes
|
|---|
| 179 | .RE
|
|---|
| 180 | .PP
|
|---|
| 181 | Request\-LanMan\-Session\-Key
|
|---|
| 182 | .RS 4
|
|---|
| 183 | Apon sucessful authenticaiton, return the LANMAN session key associated with the login\&.
|
|---|
| 184 | .PP \fBExample\ \&13.\ \&\fR Request\-LanMan\-Session\-Key: Yes
|
|---|
| 185 | .RE
|
|---|
| 186 | .if n \{\
|
|---|
| 187 | .sp
|
|---|
| 188 | .\}
|
|---|
| 189 | .RS 4
|
|---|
| 190 | .it 1 an-trap
|
|---|
| 191 | .nr an-no-space-flag 1
|
|---|
| 192 | .nr an-break-flag 1
|
|---|
| 193 | .br
|
|---|
| 194 | .ps +1
|
|---|
| 195 | \fBWarning\fR
|
|---|
| 196 | .ps -1
|
|---|
| 197 | .br
|
|---|
| 198 | Implementors should take care to base64 encode
|
|---|
| 199 | any data (such as usernames/passwords) that may contain malicous user data, such as
|
|---|
| 200 | a newline\&. They may also need to decode strings from
|
|---|
| 201 | the helper, which likewise may have been base64 encoded\&..sp .5v
|
|---|
| 202 | .RE
|
|---|
| 203 | .RE
|
|---|
| 204 | .RE
|
|---|
| 205 | .PP
|
|---|
| 206 | \-\-username=USERNAME
|
|---|
| 207 | .RS 4
|
|---|
| 208 | Specify username of user to authenticate
|
|---|
| 209 | .RE
|
|---|
| 210 | .PP
|
|---|
| 211 | \-\-domain=DOMAIN
|
|---|
| 212 | .RS 4
|
|---|
| 213 | Specify domain of user to authenticate
|
|---|
| 214 | .RE
|
|---|
| 215 | .PP
|
|---|
| 216 | \-\-workstation=WORKSTATION
|
|---|
| 217 | .RS 4
|
|---|
| 218 | Specify the workstation the user authenticated from
|
|---|
| 219 | .RE
|
|---|
| 220 | .PP
|
|---|
| 221 | \-\-challenge=STRING
|
|---|
| 222 | .RS 4
|
|---|
| 223 | NTLM challenge (in HEXADECIMAL)
|
|---|
| 224 | .RE
|
|---|
| 225 | .PP
|
|---|
| 226 | \-\-lm\-response=RESPONSE
|
|---|
| 227 | .RS 4
|
|---|
| 228 | LM Response to the challenge (in HEXADECIMAL)
|
|---|
| 229 | .RE
|
|---|
| 230 | .PP
|
|---|
| 231 | \-\-nt\-response=RESPONSE
|
|---|
| 232 | .RS 4
|
|---|
| 233 | NT or NTLMv2 Response to the challenge (in HEXADECIMAL)
|
|---|
| 234 | .RE
|
|---|
| 235 | .PP
|
|---|
| 236 | \-\-password=PASSWORD
|
|---|
| 237 | .RS 4
|
|---|
| 238 | User\'s plaintext password
|
|---|
| 239 | .sp
|
|---|
| 240 | If not specified on the command line, this is prompted for when required\&.
|
|---|
| 241 | .sp
|
|---|
| 242 | For the NTLMSSP based server roles, this parameter specifies the expected password, allowing testing without winbindd operational\&.
|
|---|
| 243 | .RE
|
|---|
| 244 | .PP
|
|---|
| 245 | \-\-request\-lm\-key
|
|---|
| 246 | .RS 4
|
|---|
| 247 | Retreive LM session key
|
|---|
| 248 | .RE
|
|---|
| 249 | .PP
|
|---|
| 250 | \-\-request\-nt\-key
|
|---|
| 251 | .RS 4
|
|---|
| 252 | Request NT key
|
|---|
| 253 | .RE
|
|---|
| 254 | .PP
|
|---|
| 255 | \-\-diagnostics
|
|---|
| 256 | .RS 4
|
|---|
| 257 | Perform Diagnostics on the authentication chain\&. Uses the password from
|
|---|
| 258 | \-\-password
|
|---|
| 259 | or prompts for one\&.
|
|---|
| 260 | .RE
|
|---|
| 261 | .PP
|
|---|
| 262 | \-\-require\-membership\-of={SID|Name}
|
|---|
| 263 | .RS 4
|
|---|
| 264 | Require that a user be a member of specified group (either name or SID) for authentication to succeed\&.
|
|---|
| 265 | .RE
|
|---|
| 266 | .PP
|
|---|
| 267 | \-d|\-\-debuglevel=level
|
|---|
| 268 | .RS 4
|
|---|
| 269 | \fIlevel\fR
|
|---|
| 270 | is an integer from 0 to 10\&. The default value if this parameter is not specified is 0\&.
|
|---|
| 271 | .sp
|
|---|
| 272 | The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day\-to\-day running \- it generates a small amount of information about operations carried out\&.
|
|---|
| 273 | .sp
|
|---|
| 274 | Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&.
|
|---|
| 275 | .sp
|
|---|
| 276 | Note that specifying this parameter here will override the
|
|---|
| 277 | \m[blue]\fB\%smb.conf.5.html#\fR\m[]
|
|---|
| 278 | parameter in the
|
|---|
| 279 | smb\&.conf
|
|---|
| 280 | file\&.
|
|---|
| 281 | .RE
|
|---|
| 282 | .PP
|
|---|
| 283 | \-V|\-\-version
|
|---|
| 284 | .RS 4
|
|---|
| 285 | Prints the program version number\&.
|
|---|
| 286 | .RE
|
|---|
| 287 | .PP
|
|---|
| 288 | \-s|\-\-configfile <configuration file>
|
|---|
| 289 | .RS 4
|
|---|
| 290 | The file specified contains the configuration details required by the server\&. The information in this file includes server\-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See
|
|---|
| 291 | smb\&.conf
|
|---|
| 292 | for more information\&. The default configuration file name is determined at compile time\&.
|
|---|
| 293 | .RE
|
|---|
| 294 | .PP
|
|---|
| 295 | \-l|\-\-log\-basename=logdirectory
|
|---|
| 296 | .RS 4
|
|---|
| 297 | Base directory name for log/debug files\&. The extension
|
|---|
| 298 | \fB"\&.progname"\fR
|
|---|
| 299 | will be appended (e\&.g\&. log\&.smbclient, log\&.smbd, etc\&.\&.\&.)\&. The log file is never removed by the client\&.
|
|---|
| 300 | .RE
|
|---|
| 301 | .PP
|
|---|
| 302 | \-h|\-\-help
|
|---|
| 303 | .RS 4
|
|---|
| 304 | Print a summary of command line options\&.
|
|---|
| 305 | .RE
|
|---|
| 306 | .SH "EXAMPLE SETUP"
|
|---|
| 307 | .PP
|
|---|
| 308 | To setup ntlm_auth for use by squid 2\&.5, with both basic and NTLMSSP authentication, the following should be placed in the
|
|---|
| 309 | squid\&.conf
|
|---|
| 310 | file\&.
|
|---|
| 311 | .sp
|
|---|
| 312 | .if n \{\
|
|---|
| 313 | .RS 4
|
|---|
| 314 | .\}
|
|---|
| 315 | .nf
|
|---|
| 316 | auth_param ntlm program ntlm_auth \-\-helper\-protocol=squid\-2\&.5\-ntlmssp
|
|---|
| 317 | auth_param basic program ntlm_auth \-\-helper\-protocol=squid\-2\&.5\-basic
|
|---|
| 318 | auth_param basic children 5
|
|---|
| 319 | auth_param basic realm Squid proxy\-caching web server
|
|---|
| 320 | auth_param basic credentialsttl 2 hours
|
|---|
| 321 | .fi
|
|---|
| 322 | .if n \{\
|
|---|
| 323 | .RE
|
|---|
| 324 | .\}
|
|---|
| 325 | .if n \{\
|
|---|
| 326 | .sp
|
|---|
| 327 | .\}
|
|---|
| 328 | .RS 4
|
|---|
| 329 | .it 1 an-trap
|
|---|
| 330 | .nr an-no-space-flag 1
|
|---|
| 331 | .nr an-break-flag 1
|
|---|
| 332 | .br
|
|---|
| 333 | .ps +1
|
|---|
| 334 | \fBNote\fR
|
|---|
| 335 | .ps -1
|
|---|
| 336 | .br
|
|---|
| 337 | .PP
|
|---|
| 338 | This example assumes that ntlm_auth has been installed into your path, and that the group permissions on
|
|---|
| 339 | winbindd_privileged
|
|---|
| 340 | are as described above\&.
|
|---|
| 341 | .sp .5v
|
|---|
| 342 | .RE
|
|---|
| 343 | .PP
|
|---|
| 344 | To setup ntlm_auth for use by squid 2\&.5 with group limitation in addition to the above example, the following should be added to the
|
|---|
| 345 | squid\&.conf
|
|---|
| 346 | file\&.
|
|---|
| 347 | .sp
|
|---|
| 348 | .if n \{\
|
|---|
| 349 | .RS 4
|
|---|
| 350 | .\}
|
|---|
| 351 | .nf
|
|---|
| 352 | auth_param ntlm program ntlm_auth \-\-helper\-protocol=squid\-2\&.5\-ntlmssp \-\-require\-membership\-of=\'WORKGROUP\eDomain Users\'
|
|---|
| 353 | auth_param basic program ntlm_auth \-\-helper\-protocol=squid\-2\&.5\-basic \-\-require\-membership\-of=\'WORKGROUP\eDomain Users\'
|
|---|
| 354 | .fi
|
|---|
| 355 | .if n \{\
|
|---|
| 356 | .RE
|
|---|
| 357 | .\}
|
|---|
| 358 | .SH "TROUBLESHOOTING"
|
|---|
| 359 | .PP
|
|---|
| 360 | If you\'re experiencing problems with authenticating Internet Explorer running under MS Windows 9X or Millenium Edition against ntlm_auth\'s NTLMSSP authentication helper (\-\-helper\-protocol=squid\-2\&.5\-ntlmssp), then please read
|
|---|
| 361 | the Microsoft Knowledge Base article #239869 and follow instructions described there\&.
|
|---|
| 362 | .SH "VERSION"
|
|---|
| 363 | .PP
|
|---|
| 364 | This man page is correct for version 3 of the Samba suite\&.
|
|---|
| 365 | .SH "AUTHOR"
|
|---|
| 366 | .PP
|
|---|
| 367 | The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&.
|
|---|
| 368 | .PP
|
|---|
| 369 | The ntlm_auth manpage was written by Jelmer Vernooij and Andrew Bartlett\&.
|
|---|
