Red Hat ENTERPRISE LINUX 4 System Administration Manual page 237

To configure Samba to use encrypted passwords, follow these steps:
1. Create a separate password file for Samba. To create one based on your existing /etc/passwd
file, at a shell prompt, type the following command:
cat /etc/passwd | mksmbpasswd.sh > /etc/samba/smbpasswd
If the system uses NIS, type the following command:
ypcat passwd | mksmbpasswd.sh > /etc/samba/smbpasswd
The mksmbpasswd.sh script is installed in your /usr/bin directory with the samba package.
2. Change the permissions of the Samba password file so that only root has read and write
permissions:
chmod 600 /etc/samba/smbpasswd
3. The script does not copy user passwords to the new file, and a Samba user account is not
active until a password is set for it. For higher security, it is recommended that the user's Samba
password be different from the user's system password. To set each Samba user's password, use
the following command (replace username with each user's username):
smbpasswd username
4. Encrypted passwords must be enabled. Since they are enabled by default, they do not have to be
specifically enabled in the configuration file. However, they can not be disabled in the configuration
file either. In the file /etc/samba/smb.conf, verify that the following line does not exist:
encrypt passwords = no
If it does exist but is commented out with a semi-colon (;) at the beginning of the line, then the
line is ignored, and encrypted passwords are enabled. If this line exists but is not commented out,
either remove it or comment it out.
To specifically enable encrypted passwords in the configuration file, add the following lines to
etc/samba/smb.conf:
encrypt passwords = yes
smb passwd file = /etc/samba/smbpasswd
5. Make sure the smb service is started by typing the command service smb restart at a shell
prompt.
6. If you want the smb service to start automatically, use ntsysv, chkconfig, or the Services
Configuration Tool to enable it at runtime. Refer to
for details.
The pam_smbpass PAM module can be used to sync users' Samba passwords with their system
passwords when the passwd command is used. If a user invokes the passwd command, the
Chapter 19, Controlling Access to Services
Encrypted Passwords
219