2
.\" Author: [see the "AUTHOR" section]
3
.\" Generator: DocBook XSL Stylesheets v1.74.0 <http://docbook.sf.net/>
5
.\" Manual: User Commands
9
.TH "NTLM_AUTH" "1" "10/29/2009" "Samba 3\&.4" "User Commands"
10
.\" -----------------------------------------------------------------
11
.\" * (re)Define some macros
12
.\" -----------------------------------------------------------------
13
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
14
.\" toupper - uppercase a string (locale-aware)
15
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
17
.tr aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ
19
.tr aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz
21
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
22
.\" SH-xref - format a cross-reference to an SH section
23
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
32
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
33
.\" SH - level-one heading that works better for non-TTY output
34
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
36
.\" put an extra blank line of space above the head in non-TTY output
43
.nr an-prevailing-indent \\n[IN]
47
.HTML-TAG ".NH \\n[an-level]"
49
.nr an-no-space-flag 1
51
\." make the size of the head bigger
56
.\" if n (TTY output), use uppercase
61
.\" if not n (not TTY), use normal case (not uppercase)
65
.\" if not n (not TTY), put a border/line under subheading
70
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
71
.\" SS - level-two heading that works better for non-TTY output
72
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
77
.nr an-prevailing-indent \\n[IN]
82
.nr an-no-space-flag 1
85
\." make the size of the head bigger
91
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
92
.\" BB/BE - put background/screen (filled box) around block of text
93
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
106
.if "\\$2"adjust-for-leading-newline" \{\
114
.nr BW \\n(.lu-\\n(.i
117
.ie "\\$2"adjust-for-leading-newline" \{\
118
\M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
121
\M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
132
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
133
.\" BM/EM - put colored marker in margin next to block of text
134
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
151
\M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[]
159
.\" -----------------------------------------------------------------
160
.\" * set default formatting
161
.\" -----------------------------------------------------------------
162
.\" disable hyphenation
164
.\" disable justification (adjust text to left margin only)
166
.\" -----------------------------------------------------------------
167
.\" * MAIN CONTENT STARTS HERE *
168
.\" -----------------------------------------------------------------
170
ntlm_auth \- tool to allow external access to Winbind\'s NTLM authentication function
174
\FCntlm_auth\F[] [\-d\ debuglevel] [\-l\ logdir] [\-s\ <smb\ config\ file>]
178
This tool is part of the
183
is a helper utility that authenticates users using NT/LM authentication\&. It returns 0 if the users is authenticated successfully and 1 if access was denied\&. ntlm_auth uses winbind to access the user and authentication data for a domain\&. This utility is only indended to be used by other programs (currently
187
.SH "OPERATIONAL REQUIREMENTS"
191
daemon must be operational for many of these commands to function\&.
193
Some of these commands also require access to the directory
194
\FCwinbindd_privileged\F[]
196
\FC$LOCKDIR\F[]\&. This should be done either by running this command as root or providing group access to the
197
\FCwinbindd_privileged\F[]
198
directory\&. For security reasons, this directory should not be world\-accessable\&.
201
\-\-helper\-protocol=PROTO
203
Operate as a stdio\-based helper\&. Valid helper protocols are:
207
Server\-side helper for use with Squid 2\&.4\'s basic (plaintext) authentication\&.
212
Server\-side helper for use with Squid 2\&.5\'s basic (plaintext) authentication\&.
215
squid\-2\&.5\-ntlmssp
217
Server\-side helper for use with Squid 2\&.5\'s NTLMSSP authentication\&.
219
Requires access to the directory
220
\FCwinbindd_privileged\F[]
222
\FC$LOCKDIR\F[]\&. The protocol used is described here:
223
http://devel\&.squid\-cache\&.org/ntlm/squid_helper_protocol\&.html\&. This protocol has been extended to allow the NTLMSSP Negotiate packet to be included as an argument to the
225
command\&. (Thus avoiding loss of information in the protocol exchange)\&.
230
Client\-side helper for use with arbitrary external programs that may wish to use Samba\'s NTLMSSP authentication knowledge\&.
232
This helper is a client, and as such may be run by any user\&. The protocol used is effectively the reverse of the previous protocol\&. A
234
command (without any arguments) starts the authentication exchange\&.
239
Server\-side helper that implements GSS\-SPNEGO\&. This uses a protocol that is almost the same as
240
\FCsquid\-2\&.5\-ntlmssp\F[], but has some subtle differences that are undocumented outside the source at this stage\&.
242
Requires access to the directory
243
\FCwinbindd_privileged\F[]
250
Client\-side helper that implements GSS\-SPNEGO\&. This also uses a protocol similar to the above helpers, but is currently undocumented\&.
255
Server\-side helper protocol, intended for use by a RADIUS server or the \'winbind\' plugin for pppd, for the provision of MSCHAP and MSCHAPv2 authentication\&.
257
This protocol consists of lines in the form:
258
\FCParameter: value\F[]
260
\FCParameter:: Base64\-encode value\F[]\&. The presence of a single period
262
indicates that one side has finished supplying data to the other\&. (Which in turn could cause the helper to authenticate the user)\&.
264
Curently implemented parameters from the external program to the helper are:
268
The username, expected to be in Samba\'s
269
\m[blue]\fBunix charset\fR\m[]\&.
270
.PP \fBExample\ \&1.\ \&\fR Username: bob
271
.PP \fBExample\ \&2.\ \&\fR Username:: Ym9i
276
The user\'s domain, expected to be in Samba\'s
277
\m[blue]\fBunix charset\fR\m[]\&.
278
.PP \fBExample\ \&3.\ \&\fR Domain: WORKGROUP
279
.PP \fBExample\ \&4.\ \&\fR Domain:: V09SS0dST1VQ
284
The fully qualified username, expected to be in Samba\'s
285
\m[blue]\fBunix charset\fR\m[]
286
and qualified with the
287
\m[blue]\fBwinbind separator\fR\m[]\&.
288
.PP \fBExample\ \&5.\ \&\fR Full\-Username: WORKGROUP\ebob
289
.PP \fBExample\ \&6.\ \&\fR Full\-Username:: V09SS0dST1VQYm9i
295
\FCLANMAN Challenge\F[]
296
value, generated randomly by the server, or (in cases such as MSCHAPv2) generated in some way by both the server and the client\&.
297
.PP \fBExample\ \&7.\ \&\fR LANMAN\-Challege: 0102030405060708
303
\FCLANMAN Response\F[]
304
value, calculated from the user\'s password and the supplied
305
\FCLANMAN Challenge\F[]\&. Typically, this is provided over the network by a client wishing to authenticate\&.
306
.PP \fBExample\ \&8.\ \&\fR LANMAN\-Response: 0102030405060708090A0B0C0D0E0F101112131415161718
313
calculated from the user\'s password and the supplied
314
\FCLANMAN Challenge\F[]\&. Typically, this is provided over the network by a client wishing to authenticate\&.
315
.PP \fBExample\ \&9.\ \&\fR NT\-Response: 0102030405060708090A0B0C0D0E0F101112131415161718
320
The user\'s password\&. This would be provided by a network client, if the helper is being used in a legacy situation that exposes plaintext passwords in this way\&.
321
.PP \fBExample\ \&10.\ \&\fR Password: samba2
322
.PP \fBExample\ \&11.\ \&\fR Password:: c2FtYmEy
325
Request\-User\-Session\-Key
327
Apon sucessful authenticaiton, return the user session key associated with the login\&.
328
.PP \fBExample\ \&12.\ \&\fR Request\-User\-Session\-Key: Yes
331
Request\-LanMan\-Session\-Key
333
Apon sucessful authenticaiton, return the LANMAN session key associated with the login\&.
334
.PP \fBExample\ \&13.\ \&\fR Request\-LanMan\-Session\-Key: Yes
342
.nr an-no-space-flag 1
349
Implementors should take care to base64 encode
350
any data (such as usernames/passwords) that may contain malicous user data, such as
351
a newline\&. They may also need to decode strings from
352
the helper, which likewise may have been base64 encoded\&..sp .5v
358
\-\-username=USERNAME
360
Specify username of user to authenticate
365
Specify domain of user to authenticate
368
\-\-workstation=WORKSTATION
370
Specify the workstation the user authenticated from
375
NTLM challenge (in HEXADECIMAL)
378
\-\-lm\-response=RESPONSE
380
LM Response to the challenge (in HEXADECIMAL)
383
\-\-nt\-response=RESPONSE
385
NT or NTLMv2 Response to the challenge (in HEXADECIMAL)
388
\-\-password=PASSWORD
390
User\'s plaintext password
392
If not specified on the command line, this is prompted for when required\&.
394
For the NTLMSSP based server roles, this parameter specifies the expected password, allowing testing without winbindd operational\&.
399
Retreive LM session key
409
Perform Diagnostics on the authentication chain\&. Uses the password from
411
or prompts for one\&.
414
\-\-require\-membership\-of={SID|Name}
416
Require that a user be a member of specified group (either name or SID) for authentication to succeed\&.
419
\-d|\-\-debuglevel=level
422
is an integer from 0 to 10\&. The default value if this parameter is not specified is 0\&.
424
The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day\-to\-day running \- it generates a small amount of information about operations carried out\&.
426
Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&.
428
Note that specifying this parameter here will override the
429
\m[blue]\fBlog level\fR\m[]
437
Prints the program version number\&.
440
\-s <configuration file>
442
The file specified contains the configuration details required by the server\&. The information in this file includes server\-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See
444
for more information\&. The default configuration file name is determined at compile time\&.
447
\-l|\-\-log\-basename=logdirectory
449
Base directory name for log/debug files\&. The extension
451
will be appended (e\&.g\&. log\&.smbclient, log\&.smbd, etc\&.\&.\&.)\&. The log file is never removed by the client\&.
456
Print a summary of command line options\&.
460
To setup ntlm_auth for use by squid 2\&.5, with both basic and NTLMSSP authentication, the following should be placed in the
473
.BB lightgray adjust-for-leading-newline
476
auth_param ntlm program ntlm_auth \-\-helper\-protocol=squid\-2\&.5\-ntlmssp
477
auth_param basic program ntlm_auth \-\-helper\-protocol=squid\-2\&.5\-basic
478
auth_param basic children 5
479
auth_param basic realm Squid proxy\-caching web server
480
auth_param basic credentialsttl 2 hours
481
.EB lightgray adjust-for-leading-newline
497
.nr an-no-space-flag 1
505
This example assumes that ntlm_auth has been installed into your path, and that the group permissions on
506
\FCwinbindd_privileged\F[]
507
are as described above\&.
512
To setup ntlm_auth for use by squid 2\&.5 with group limitation in addition to the above example, the following should be added to the
525
.BB lightgray adjust-for-leading-newline
528
auth_param ntlm program ntlm_auth \-\-helper\-protocol=squid\-2\&.5\-ntlmssp \-\-require\-membership\-of=\'WORKGROUP\eDomain Users\'
529
auth_param basic program ntlm_auth \-\-helper\-protocol=squid\-2\&.5\-basic \-\-require\-membership\-of=\'WORKGROUP\eDomain Users\'
530
.EB lightgray adjust-for-leading-newline
540
.SH "TROUBLESHOOTING"
542
If you\'re experiencing problems with authenticating Internet Explorer running under MS Windows 9X or Millenium Edition against ntlm_auth\'s NTLMSSP authentication helper (\-\-helper\-protocol=squid\-2\&.5\-ntlmssp), then please read
543
the Microsoft Knowledge Base article #239869 and follow instructions described there\&.
546
This man page is correct for version 3 of the Samba suite\&.
549
The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&.
551
The ntlm_auth manpage was written by Jelmer Vernooij and Andrew Bartlett\&.