I want to script the addition on a samba user and the password.

I have seen solutions similar to the one here

Piping password to smbpasswd

echo -ne "$PASS\n$PASS\n" | smbpasswd -a -s $LOGIN

but the password is viewable to all that see the script. How can I use a hash and get that to be the password ?


Provided that your smb.conf contains passdb backend = tdbsam you can export a file with encrypted passwords, on a system that was already setup, using:

sudo pdbedit -e smbpasswd:/tmp/smbpasswd

Then, in order to setup a new system, you can import it using

sudo pdbedit -i smbpasswd:/tmp/smbpasswd -e tdbsam:/var/lib/samba/private/passdb.tdb

(/var/lib/samba/private/passdb.tdb is location of the file in Ubuntu)

This is meant rather to initialize the users db during the system setup. I am not sure if you could manage to do something like this just to add a single user.

Actually, for the purpose of setting a new system maybe it could be better to simply copy the existing passdb.tdb instead of exporting and importing it to the other format.


Your script will have to be able to access the password. You can't use a hash of the password: if you did, the hash would be the password, since that would mean anyone with the hash could log in.

You should put the password in a separate file, and read it from your script. Take care to reproduce the password exactly (for example, don't use echo -e "$PASS" since that would interpret backslash escapes).

IFS= read -r password </somewhere/private/file.password
printf '%s\n%s\n' "$password" "$password" | smbpasswd -a -s "$LOGIN"


IFS= read -r password </somewhere/private/file.password
smbpasswd -a -s "$LOGIN" <<EOF

Arguments passed to external commands are visible to other processes while the command is running, so don't use the first solution if printf is an external command in your shell. Most current shells have printf as a builtin; use the type command to check, or the here document form.

Make sure that the file containing the password is readable only by the user that should be executing the script. Of course, any command running as that user will be able to read the script; if this is not desirable then you need to run the script as a different user (or use some other isolation mechanism, but a separate user is the easiest one to set up).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.