ntlm_auth.1

samba-3.0.22.tar.gz 编译smb服务器的源码

.\"Generated by db2man.xsl. Don't modify this, modify the source.
.de Sh \" Subsection
.br
.if t .Sp
.ne 5
.PP
\fB\\$1\fR
.PP
..
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Ip \" List item
.br
.ie \\n(.$>=3 .ne \\$3
.el .ne 3
.IP "\\$1" \\$2
..
.TH "NTLM_AUTH" 1 "" "" ""
.SH NAME
ntlm_auth \- tool to allow external access to Winbind's NTLM authentication function
.SH "SYNOPSIS"
.ad l
.hy 0
.HP 10
\fBntlm_auth\fR [\-d\ debuglevel] [\-l\ logdir] [\-s\ <smb\ config\ file>]
.ad
.hy

.SH "DESCRIPTION"

.PP
This tool is part of the \fBsamba\fR(7) suite\&.

.PP
\fBntlm_auth\fR is a helper utility that authenticates users using NT/LM authentication\&. It returns 0 if the users is authenticated successfully and 1 if access was denied\&. ntlm_auth uses winbind to access the user and authentication data for a domain\&. This utility is only indended to be used by other programs (currentlySquid and mod_ntlm_winbind)

.SH "OPERATIONAL REQUIREMENTS"

.PP
The \fBwinbindd\fR(8) daemon must be operational for many of these commands to function\&.

.PP
Some of these commands also require access to the directory \fIwinbindd_privileged\fR in \fI$LOCKDIR\fR\&. This should be done either by running this command as root or providing group access to the \fIwinbindd_privileged\fR directory\&. For security reasons, this directory should not be world\-accessable\&.

.SH "OPTIONS"

.TP
\-\-helper\-protocol=PROTO
Operate as a stdio\-based helper\&. Valid helper protocols are:

.RS

.TP
squid\-2\&.4\-basic
Server\-side helper for use with Squid 2\&.4's basic (plaintext) authentication\&.

.TP
squid\-2\&.5\-basic
Server\-side helper for use with Squid 2\&.5's basic (plaintext) authentication\&.

.TP
squid\-2\&.5\-ntlmssp
Server\-side helper for use with Squid 2\&.5's NTLMSSP authentication\&.

Requires access to the directory \fIwinbindd_privileged\fR in\fI$LOCKDIR\fR\&. The protocol used is described here: http://devel\&.squid\-cache\&.org/ntlm/squid_helper_protocol\&.html\&. This protocol has been extended to allow the NTLMSSP Negotiate packet to be included as an argument to the \fBYR\fR command\&. (Thus avoiding loss of information in the protocol exchange)\&.

.TP
ntlmssp\-client\-1
Client\-side helper for use with arbitary external programs that may wish to use Samba's NTLMSSP authentication knowlege\&.

This helper is a client, and as such may be run by any user\&. The protocol used is effectivly the reverse of the previous protocol\&. A\fBYR\fR command (without any arguments) starts the authentication exchange\&.

.TP
gss\-spnego
Server\-side helper that implements GSS\-SPNEGO\&. This uses a protocol that is almost the same as\fBsquid\-2\&.5\-ntlmssp\fR, but has some subtle differences that are undocumented outside the source at this stage\&.

Requires access to the directory \fIwinbindd_privileged\fR in\fI$LOCKDIR\fR\&.

.TP
gss\-spnego\-client
Client\-side helper that implements GSS\-SPNEGO\&. This also uses a protocol similar to the above helpers, but is currently undocumented\&.

.TP
ntlm\-server\-1
Server\-side helper protocol, intended for use by a RADIUS server or the 'winbind' plugin for pppd, for the provision of MSCHAP and MSCHAPv2 authentication\&.

This protocol consists of lines in for form: \fBParameter: value\fR and \fBParamter:: Base64\-encode value\fR\&. The presence of a single period \fB\&.\fR indicates that one side has finished supplying data to the other\&. (Which in turn could cause the helper to authenticate the user)\&.

Curently implemented parameters from the external program to the helper are:

.RS

.TP
Username
The username, expected to be in Samba's unix charset\&.

Example