Where Samba stores passwords. How to Extract Samba Usernames and Passwords (SOLVED)

This article is about the Samba password database. It answers popular questions about where Samba passwords are stored and how to perform common actions on the Samba password database.

To set the Samba password, use the command:

sudo smbpasswd -a USER

If you want the user to have no password, then specify the -n option.

See also: SMB and Samba Security Audit Tools

In which file does Samba store passwords?

Samba passwords are stored in the /var/lib/samba/private/passdb.tdb file.

Depending on the distribution and version of Samba, the path to the passdb.tdb file may be different.

What is the format of the Samba password file passdb.tdb?

The passdb.tdb file is a binary file, not a plain text file.

The passdb.tdb file can be opened with the tdbtool utility, but this file is not meant to be edited by the user directly, including with the tdbtool utility. You can also export and import the contents of this file using the pdbedit utility.

tdbtool is a tool for displaying and modifying the contents of Samba TDB (Trivial DataBase) files. Each of the commands listed below can be entered interactively or provided on the command line.

To open the passdb.tdb file, you must run the tdbtool utility as root, otherwise it will not have enough rights even to view this file:

sudo tdbtool

Then run the “open” command specifying the path to the file you want to open:

open /var/lib/samba/private/passdb.tdb

If there were no errors during the opening (for example, due to the fact that the wrong path was specified), then nothing will be displayed.

For help, type

help

Popular commands you might find useful:

list

print the hash table of the database and the list of free spaces

dump

show database contents as strings

keys

print a list of database keys as strings

info

display summary information about the database

erase

clear the database

Is it possible to view or extract passwords from the Samba database?

No, it is not possible to view or extract passwords from the passdb.tdb file. Moreover, the passdb.tdb file does not store passwords in plain text, the Samba database contains only password hashes.

The hash algorithm used is NTLM. Online LM/NTLM hash generator: https://suip.biz/?act=ntlm-hash-generator

You can export hashes as a hex string with the following command:

sudo pdbedit -L -w

The following command will export all data, including hashes:

sudo pdbedit -e smbpasswd:/root/samba-users.backup

How to view Samba usernames?

You can view usernames with the following commands:

sudo pdbedit -L
sudo pdbedit -L -v

How to remove a single user from a Samba database?

To delete, use the -x (--delete) option. You also need to specify the username with the -u option, for example:

sudo pdbedit -x -u mial

How to wipe the Samba password database?

The following command will wipe the entire Samba password database:

sudo tdbtool /var/lib/samba/private/passdb.tdb erase

How to manage Samba accounts?

The -c|--account-control FLAG option can be used with the pdbedit command when adding or modifying a user account. It will specify the user account control property. Possible flags are listed below:

• N: No password required
• D: Account disabled
• H: Home directory required
• T: Temporary duplicate of other account
• U: Regular user account
• M: MNS logon user account
• W: Workstation Trust Account
• S: Server Trust Account
• L: Automatic Locking
• X: Password does not expire
• I: Domain Trust Account

Example: -c "[X ]"