summaryrefslogtreecommitdiff
path: root/docs/manpages
diff options
context:
space:
mode:
Diffstat (limited to 'docs/manpages')
-rw-r--r--docs/manpages/smbcacls.1369
-rw-r--r--docs/manpages/smbpasswd.5365
-rw-r--r--docs/manpages/smbpasswd.8607
3 files changed, 639 insertions, 702 deletions
diff --git a/docs/manpages/smbcacls.1 b/docs/manpages/smbcacls.1
index 9f5c00c6c4..fd8ca13591 100644
--- a/docs/manpages/smbcacls.1
+++ b/docs/manpages/smbcacls.1
@@ -1,192 +1,191 @@
-.TH "smbcacls " "1" "22 Dec 2000" "Samba" "SAMBA"
-.PP
-.SH "NAME"
-smbcacls \- Set or get ACLs on an NT file or directory
-.PP
-.SH "SYNOPSIS"
-.PP
-\fBsmbcacls\fP //server/share filename [-U username]
-[-A acls] [-M acls]
-[-D acls] [-S acls]
-[-C name] [-G name]
-[-n] [-h]
-.PP
-.SH "DESCRIPTION"
-.PP
-The \fBsmbcacls\fP program manipulates NT Access Control Lists (ACLs) on
-SMB file shares\&.
-.PP
-.SH "OPTIONS"
-.PP
-The following options are available to the \fBsmbcacls\fP program\&. The
-format of ACLs is described in the section ACL FORMAT
-.PP
-.IP
-.IP "\fB-A acls\fP"
-.IP
-Add the ACLs specified to the ACL list\&. Existing access control entries
-are unchanged\&.
-.IP
-.IP "\fB-M acls\fP"
-.IP
-Modify the mask value (permissions) for the ACLs specified on the command
-line\&. An error will be printed for each ACL specified that was not already
-present in the ACL list\&.
-.IP
-.IP "\fB-D acls\fP"
-.IP
-Delete any ACLs specfied on the command line\&. An error will be printed for
-each ACL specified that was not already present in the ACL list\&.
-.IP
-.IP "\fB-S acls\fP"
-.IP
-This command sets the ACLs on the file with only the ones specified on the
-command line\&. All other ACLs are erased\&. Note that the ACL specified must
-contain at least a revision, type, owner and group for the call to succeed\&.
-.IP
-.IP "\fB-U username\fP"
-.IP
-Specifies a username used to connect to the specified service\&. The
-username may be of the form \f(CWusername\fP in which case the user is
-prompted to enter in a password and the workgroup specified in the
-\fBsmb\&.conf\fP file is used, or \f(CWusername%password\fP
-or \f(CWDOMAIN\eusername%password\fP and the password and workgroup names are
-used as provided\&.
-.IP
-.IP "\fB-C name\fP"
-.IP
-The owner of a file or directory can be changed to the name given
-using the -C option\&. The name can be a sid in the form \f(CWS-1-x-y-z\fP or a
-name resolved against the server specified in the first argument\&.
-.IP
-This command is a shortcut for \f(CW-M OWNER:name\fP\&.
-.IP
-.IP "\fB-G name\fP"
-.IP
-The group owner of a file or directory can be changed to the name given
-using the -G option\&. The name can be a sid in the form \f(CWS-1-x-y-z\fP or a
-name resolved against the server specified in the first argument\&.
-.IP
-This command is a shortcut for \f(CW-M GROUP:name\fP\&.
-.IP
-.IP "\fB-n\fP"
-.IP
-This option displays all ACL information in numeric format\&. The default is
-to convert SIDs to names and ACE types and masks to a readable string
-format\&.
-.IP
-.IP "\fB-h\fP"
-.IP
-Print usage information on the \fBsmbcacls\fP program
-.IP
-.PP
-.SH "ACL FORMAT"
-.PP
-The format of an ACL is one or more ACL entries separated by either
-commas or newlines\&. An ACL entry is one of the following:
-.PP
+.\" This manpage has been automatically generated by docbook2man-spec
+.\" from a DocBook document. docbook2man-spec can be found at:
+.\" <http://shell.ipoline.com/~elmert/hacks/docbook2X/>
+.\" Please send any bug reports, improvements, comments, patches,
+.\" etc. to Steve Cheng <steve@ggi-project.org>.
+.TH "SMBCACLS" "1" "22 February 2001" "" ""
+.SH NAME
+smbcacls \- Set or get ACLs on an NT file or directory names
+.SH SYNOPSIS
+.sp
+\fBnmblookup\fR \fB//server/share\fR \fBfilename\fR [ \fB-U username\fR ] [ \fB-A acls\fR ] [ \fB-M acls\fR ] [ \fB-D acls\fR ] [ \fB-S acls\fR ] [ \fB-C name\fR ] [ \fB-G name\fR ] [ \fB-n\fR ] [ \fB-h\fR ]
+.SH "DESCRIPTION"
+.PP
+This tool is part of the Samba <URL:samba.7.html> suite.
+.PP
+The smbcacls program manipulates NT Access Control Lists
+(ACLs) on SMB file shares.
+.SH "OPTIONS"
+.PP
+The following options are available to the smbcacls program.
+The format of ACLs is described in the section ACL FORMAT
+.TP
+\fB-A acls\fR
+Add the ACLs specified to the ACL list. Existing
+access control entries are unchanged.
+.TP
+\fB-M acls\fR
+Modify the mask value (permissions) for the ACLs
+specified on the command line. An error will be printed for each
+ACL specified that was not already present in the ACL list
+.TP
+\fB-D acls\fR
+Delete any ACLs specfied on the command line.
+An error will be printed for each ACL specified that was not
+already present in the ACL list.
+.TP
+\fB-S acls\fR
+This command sets the ACLs on the file with
+only the ones specified on the command line. All other ACLs are
+erased. Note that the ACL specified must contain at least a revision,
+type, owner and group for the call to succeed.
+.TP
+\fB-U username\fR
+Specifies a username used to connect to the
+specified service. The username may be of the form "username" in
+which case the user is prompted to enter in a password and the
+workgroup specified in the \fIsmb.conf\fR file is
+used, or "username%password" or "DOMAIN\\username%password" and the
+password and workgroup names are used as provided.
+.TP
+\fB-C name\fR
+The owner of a file or directory can be changed
+to the name given using the \fI-C\fR option.
+The name can be a sid in the form S-1-x-y-z or a name resolved
+against the server specified in the first argument.
-.nf
+This command is a shortcut for -M OWNER:name.
+.TP
+\fB-G name\fR
+The group owner of a file or directory can
+be changed to the name given using the \fI-G\fR
+option. The name can be a sid in the form S-1-x-y-z or a name
+resolved against the server specified n the first argument.
+
+This command is a shortcut for -M GROUP:name.
+.TP
+\fB-n\fR
+This option displays all ACL information in numeric
+format. The default is to convert SIDs to names and ACE types
+and masks to a readable string format.
+.TP
+\fB-h\fR
+Print usage information on the \fBsmbcacls
+\fRprogram.
+.SH "ACL FORMAT"
+.PP
+The format of an ACL is one or more ACL entries separated by
+either commas or newlines. An ACL entry is one of the following:
+.PP
+.sp
+.nf
REVISION:<revision number>
OWNER:<sid or name>
GROUP:<sid or name>
ACL:<sid or name>:<type>/<flags>/<mask>
-.fi
-
-
-.PP
-The revision of the ACL specifies the internal Windows NT ACL revision for
-the security descriptor\&. If not specified it defaults to 1\&. Using values
-other than 1 may cause strange behaviour\&.
-.PP
-The owner and group specify the owner and group sids for the object\&. If a
-SID in the format \f(CWS-1-x-y-z\fP is specified this is used, otherwise
-the name specified is resolved using the server on which the file or
-directory resides\&.
-.PP
-ACLs specify permissions granted to the SID\&. This SID again can be
-specified in \f(CWS-1-x-y-z\fP format or as a name in which case it is resolved
-against the server on which the file or directory resides\&. The type, flags
-and mask values determine the type of access granted to the SID\&.
-.PP
-The type can be either 0 or 1 corresponding to ALLOWED or DENIED access to
-the SID\&. The flags values are generally zero for file ACLs and either 9 or
-2 for directory ACLs\&. Some common flags are:
-.PP
-
-.nf
-
-#define SEC_ACE_FLAG_OBJECT_INHERIT 0x1
-#define SEC_ACE_FLAG_CONTAINER_INHERIT 0x2
-#define SEC_ACE_FLAG_NO_PROPAGATE_INHERIT 0x4
-#define SEC_ACE_FLAG_INHERIT_ONLY 0x8
-.fi
-
-
-.PP
-At present flags can only be specified as decimal or hexadecimal values\&.
-.PP
-The mask is a value which expresses the access right granted to the SID\&.
-It can be given as a decimal or hexadecimal value, or by using one of the
-following text strings which map to the NT file permissions of the same
-name\&.
-.PP
-.IP
-.IP ""
-\f(CWR\fP Allow read access
-.IP
-.IP ""
-\f(CWW\fP Allow write access
-.IP
-.IP ""
-\f(CWX\fP Execute permission on the object
-.IP
-.IP ""
-\f(CWD\fP Delete the object
-.IP
-.IP ""
-\f(CWP\fP Change permissions
-.IP
-.IP ""
-\f(CWO\fP Take ownership
-.IP
-.PP
+
+.sp
+.fi
+.PP
+The revision of the ACL specifies the internal Windows
+NT ACL revision for the security descriptor.
+If not specified it defaults to 1. Using values other than 1 may
+cause strange behaviour.
+.PP
+The owner and group specify the owner and group sids for the
+object. If a SID in the format CWS-1-x-y-z is specified this is used,
+otherwise the name specified is resolved using the server on which
+the file or directory resides.
+.PP
+ACLs specify permissions granted to the SID. This SID again
+can be specified in CWS-1-x-y-z format or as a name in which case
+it is resolved against the server on which the file or directory
+resides. The type, flags and mask values determine the type of
+access granted to the SID.
+.PP
+The type can be either 0 or 1 corresponding to ALLOWED or
+DENIED access to the SID. The flags values are generally
+zero for file ACLs and either 9 or 2 for directory ACLs. Some
+common flags are:
+.TP 0.2i
+\(bu
+#define SEC_ACE_FLAG_OBJECT_INHERIT 0x1
+.TP 0.2i
+\(bu
+#define SEC_ACE_FLAG_CONTAINER_INHERIT 0x2
+.TP 0.2i
+\(bu
+#define SEC_ACE_FLAG_NO_PROPAGATE_INHERIT 0x4
+.TP 0.2i
+\(bu
+#define SEC_ACE_FLAG_INHERIT_ONLY 0x8
+.PP
+At present flags can only be specified as decimal or
+hexadecimal values.
+.PP
+.PP
+The mask is a value which expresses the access right
+granted to the SID. It can be given as a decimal or hexadecimal value,
+or by using one of the following text strings which map to the NT
+file permissions of the same name.
+.PP
+.TP 0.2i
+\(bu
+\fBR\fR - Allow read access
+.TP 0.2i
+\(bu
+\fBW\fR - Allow write access
+.TP 0.2i
+\(bu
+\fBX\fR - Execute permission on the object
+.TP 0.2i
+\(bu
+\fBD\fR - Delete the object
+.TP 0.2i
+\(bu
+\fBP\fR - Change permissions
+.TP 0.2i
+\(bu
+\fBO\fR - Take ownership
+.PP
The following combined permissions can be specified:
-.PP
-.IP
-.IP ""
-\f(CWREAD\fP
-.IP
-Equivalent to \f(CWRX\fP permissions
-.IP
-.IP ""
-\f(CWCHANGE\fP
-.IP
-Equivalent to \f(CWRXWD\fP permissions
-.IP
-.IP ""
-\f(CWFULL\fP
-.IP
-Equivalent to \f(CWRWXDPO\fP permissions
-.IP
-.PP
-.SH "EXIT STATUS"
-.PP
-The \fBsmbcacls\fP program sets the exit status depending on the success or
-otherwise of the operations performed\&. The exit status may be one of the
-following values\&.
-.PP
-If the operation succeded, \fBsmbcacls\fP returns and exit status of 0\&. If
-\fBsmbcacls\fP couldn\'t connect to the specified server, or there was an
-error getting or setting the ACLs, an exit status of 1 is returned\&. If
-there was an error parsing any command line arguments, an exit status of 2
-is returned\&.
-.PP
-.SH "AUTHOR"
-.PP
-The original Samba software and related utilities were created by
-Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open
-Source project\&.
-.PP
-\fBsmbcacls\fP was written by Andrew Tridgell and Tim Potter\&.
+.PP
+.TP 0.2i
+\(bu
+\fBREAD\fR - Equivalent to 'RX'
+permissions
+.TP 0.2i
+\(bu
+\fBCHANGE\fR - Equivalent to 'RXWD' permissions
+.TP 0.2i
+\(bu
+\fBFULL\fR - Equivalent to 'RWXDPO'
+permissions
+.SH "EXIT STATUS"
+.PP
+The \fBsmbcacls\fR program sets the exit status
+depending on the success or otherwise of the operations performed.
+The exit status may be one of the following values.
+.PP
+If the operation succeded, smbcacls returns and exit
+status of 0. If smbcacls couldn't connect to the specified server,
+or there was an error getting or setting the ACLs, an exit status
+of 1 is returned. If there was an error parsing any command line
+arguments, an exit status of 2 is returned.
+.SH "VERSION"
+.PP
+This man page is correct for version 2.2 of
+the Samba suite.
+.SH "AUTHOR"
+.PP
+The original Samba software and related utilities
+were created by Andrew Tridgell. Samba is now developed
+by the Samba Team as an Open Source project similar
+to the way the Linux kernel is developed.
+.PP
+\fBsmbcacls\fR was written by Andrew Tridgell
+and Tim Potter.
+.PP
+The conversion to DocBook for Samba 2.2 was done
+by Gerald Carter
diff --git a/docs/manpages/smbpasswd.5 b/docs/manpages/smbpasswd.5
index bc87d134d2..fef3713425 100644
--- a/docs/manpages/smbpasswd.5
+++ b/docs/manpages/smbpasswd.5
@@ -1,214 +1,159 @@
-.TH "smbpasswd " "5" "23 Oct 1998" "Samba" "SAMBA"
-.PP
-.SH "NAME"
+.\" This manpage has been automatically generated by docbook2man-spec
+.\" from a DocBook document. docbook2man-spec can be found at:
+.\" <http://shell.ipoline.com/~elmert/hacks/docbook2X/>
+.\" Please send any bug reports, improvements, comments, patches,
+.\" etc. to Steve Cheng <steve@ggi-project.org>.
+.TH "SMBPASSWD" "5" "22 February 2001" "" ""
+.SH NAME
smbpasswd \- The Samba encrypted password file
-.PP
-.SH "SYNOPSIS"
-.PP
-smbpasswd is the \fBSamba\fP encrypted password file\&.
-.PP
-.SH "DESCRIPTION"
-.PP
-This file is part of the \fBSamba\fP suite\&.
-.PP
-smbpasswd is the \fBSamba\fP encrypted password file\&. It contains
-the username, Unix user id and the SMB hashed passwords of the
-user, as well as account flag information and the time the password
-was last changed\&. This file format has been evolving with Samba
-and has had several different formats in the past\&.
-.PP
-.SH "FILE FORMAT"
-.PP
-The format of the smbpasswd file used by Samba 2\&.0 is very similar to
-the familiar Unix \fBpasswd (5)\fP file\&. It is an ASCII file containing
-one line for each user\&. Each field within each line is separated from
-the next by a colon\&. Any entry beginning with # is ignored\&. The
-smbpasswd file contains the following information for each user:
-.PP
-.IP
-.IP "\fBname\fP"
-.br
-.br
-.IP
-This is the user name\&. It must be a name that already exists
-in the standard UNIX passwd file\&.
-.IP
-.IP "\fBuid\fP"
-.br
-.br
-.IP
-This is the UNIX uid\&. It must match the uid field for the same
-user entry in the standard UNIX passwd file\&. If this does not
-match then Samba will refuse to recognize this \fBsmbpasswd\fP file entry
-as being valid for a user\&.
-.IP
-.IP "\fBLanman Password Hash\fP"
-.br
-.br
-.IP
-This is the \fILANMAN\fP hash of the users password, encoded as 32 hex
-digits\&. The \fILANMAN\fP hash is created by DES encrypting a well known
-string with the users password as the DES key\&. This is the same
-password used by Windows 95/98 machines\&. Note that this password hash
-is regarded as weak as it is vulnerable to dictionary attacks and if
-two users choose the same password this entry will be identical (i\&.e\&.
-the password is not \fI"salted"\fP as the UNIX password is)\&. If the
-user has a null password this field will contain the characters
-\f(CW"NO PASSWORD"\fP as the start of the hex string\&. If the hex string
-is equal to 32 \f(CW\'X\'\fP characters then the users account is marked as
-\fIdisabled\fP and the user will not be able to log onto the Samba
-server\&.
-.IP
-\fIWARNING !!\fP\&. Note that, due to the challenge-response nature of the
-SMB/CIFS authentication protocol, anyone with a knowledge of this
-password hash will be able to impersonate the user on the network\&.
-For this reason these hashes are known as \fI"plain text equivalent"\fP
-and must \fINOT\fP be made available to anyone but the root user\&. To
-protect these passwords the \fBsmbpasswd\fP file is placed in a
-directory with read and traverse access only to the root user and the
-\fBsmbpasswd\fP file itself must be set to be read/write only by root,
-with no other access\&.
-.IP
-.IP "\fBNT Password Hash\fP"
-.br
-.br
-.IP
-This is the \fIWindows NT\fP hash of the users password, encoded as 32
-hex digits\&. The \fIWindows NT\fP hash is created by taking the users
-password as represented in 16-bit, little-endian UNICODE and then
-applying the \fIMD4\fP (internet rfc1321) hashing algorithm to it\&.
-.IP
-This password hash is considered more secure than the \fBLanman
-Password Hash\fP as it preserves the case of the
-password and uses a much higher quality hashing algorithm\&. However, it
-is still the case that if two users choose the same password this
-entry will be identical (i\&.e\&. the password is not \fI"salted"\fP as the
-UNIX password is)\&.
-.IP
-\fIWARNING !!\fP\&. Note that, due to the challenge-response nature of the
-SMB/CIFS authentication protocol, anyone with a knowledge of this
-password hash will be able to impersonate the user on the network\&.
-For this reason these hashes are known as \fI"plain text equivalent"\fP
-and must \fINOT\fP be made available to anyone but the root user\&. To
-protect these passwords the \fBsmbpasswd\fP file is placed in a
-directory with read and traverse access only to the root user and the
-\fBsmbpasswd\fP file itself must be set to be read/write only by root,
-with no other access\&.
-.IP
-.IP "\fBAccount Flags\fP"
-.br
-.br
-.IP
-This section contains flags that describe the attributes of the users
-account\&. In the \fBSamba2\&.0\fP release this field is bracketed by \f(CW\'[\'\fP
-and \f(CW\']\'\fP characters and is always 13 characters in length (including
-the \f(CW\'[\'\fP and \f(CW\']\'\fP characters)\&. The contents of this field may be
-any of the characters\&.
-.IP
-.IP
-.IP o
-\fB\'U\'\fP This means this is a \fI"User"\fP account, i\&.e\&. an ordinary
-user\&. Only \fBUser\fP and \fBWorkstation Trust\fP accounts are
-currently supported in the \fBsmbpasswd\fP file\&.
-.IP
-.IP o
-\fB\'N\'\fP This means the account has \fIno\fP password (the passwords
-in the fields \fBLanman Password Hash\fP and
-\fBNT Password Hash\fP are ignored)\&. Note that this
-will only allow users to log on with no password if the
-\fBnull passwords\fP parameter is set
-in the \fBsmb\&.conf (5)\fP config file\&.
-.IP
-.IP o
-\fB\'D\'\fP This means the account is disabled and no SMB/CIFS logins
-will be allowed for this user\&.
-.IP
-.IP o
-\fB\'W\'\fP This means this account is a \fI"Workstation Trust"\fP account\&.
-This kind of account is used in the Samba PDC code stream to allow Windows
-NT Workstations and Servers to join a Domain hosted by a Samba PDC\&.
-.IP
-.IP
-Other flags may be added as the code is extended in future\&. The rest of
-this field space is filled in with spaces\&.
-.IP
-.IP "\fBLast Change Time\fP"
-.br
-.br
-.IP
-This field consists of the time the account was last modified\&. It consists of
-the characters \f(CWLCT-\fP (standing for \fI"Last Change Time"\fP) followed by a numeric
-encoding of the UNIX time in seconds since the epoch (1970) that the last change
-was made\&.
-.IP
-.IP "\fBFollowing fields\fP"
-.br
-.br
-.IP
-All other colon separated fields are ignored at this time\&.
-.IP
-.PP
-.SH "NOTES"
-.PP
-In previous versions of Samba (notably the 1\&.9\&.18 series) this file
-did not contain the \fBAccount Flags\fP or
-\fBLast Change Time\fP fields\&. The Samba 2\&.0
-code will read and write these older password files but will not be able to
-modify the old entries to add the new fields\&. New entries added with
-\fBsmbpasswd (8)\fP will contain the new fields
-in the added accounts however\&. Thus an older \fBsmbpasswd\fP file used
-with Samba 2\&.0 may end up with some accounts containing the new fields
-and some not\&.
-.PP
-In order to convert from an old-style \fBsmbpasswd\fP file to a new
-style, run the script \fBconvert_smbpasswd\fP, installed in the
-Samba \f(CWbin/\fP directory (the same place that the \fBsmbd\fP
-and \fBnmbd\fP binaries are installed) as follows:
-.PP
+.SH SYNOPSIS
+.PP
+\fIsmbpasswd\fR
+.SH "DESCRIPTION"
+.PP
+This tool is part of the Samba <URL:samba.7.html> suite.
+.PP
+smbpasswd is the Samba encrypted password file. It contains
+the username, Unix user id and the SMB hashed passwords of the
+user, as well as account flag information and the time the
+password was last changed. This file format has been evolving with
+Samba and has had several different formats in the past.
+.SH "FILE FORMAT"
+.PP
+The format of the smbpasswd file used by Samba 2.2
+is very similar to the familiar Unix \fIpasswd(5)\fR
+file. It is an ASCII file containing one line for each user. Each field
+ithin each line is separated from the next by a colon. Any entry
+beginning with '#' is ignored. The smbpasswd file contains the
+following information for each user:
+.TP
+\fBname\fR
+This is the user name. It must be a name that
+already exists in the standard UNIX passwd file.
+.TP
+\fBuid\fR
+This is the UNIX uid. It must match the uid
+field for the same user entry in the standard UNIX passwd file.
+If this does not match then Samba will refuse to recognize
+this smbpasswd file entry as being valid for a user.
+.TP
+\fBLanman Password Hash\fR
+This is the LANMAN hash of the users password,
+encoded as 32 hex digits. The LANMAN hash is created by DES
+encrypting a well known string with the users password as the
+DES key. This is the same password used by Windows 95/98 machines.
+Note that this password hash is regarded as weak as it is
+vulnerable to dictionary attacks and if two users choose the
+same password this entry will be identical (i.e. the password
+is not "salted" as the UNIX password is). If the user has a
+null password this field will contain the characters "NO PASSWORD"
+as the start of the hex string. If the hex string is equal to
+32 'X' characters then the users account is marked as
+disabled and the user will not be able to
+log onto the Samba server.
-.nf
-
+\fBWARNING !!\fR Note that, due to
+the challenge-response nature of the SMB/CIFS authentication
+protocol, anyone with a knowledge of this password hash will
+be able to impersonate the user on the network. For this
+reason these hashes are known as \fBplain text
+equivalents\fR and must \fBNOT\fR be made
+available to anyone but the root user. To protect these passwords
+the smbpasswd file is placed in a directory with read and
+traverse access only to the root user and the smbpasswd file
+itself must be set to be read/write only by root, with no
+other access.
+.TP
+\fBNT Password Hash\fR
+This is the Windows NT hash of the users
+password, encoded as 32 hex digits. The Windows NT hash is
+created by taking the users password as represented in
+16-bit, little-endian UNICODE and then applying the MD4
+(internet rfc1321) hashing algorithm to it.
+This password hash is considered more secure than
+the Lanman Password Hash as it preserves the case of the
+password and uses a much higher quality hashing algorithm.
+However, it is still the case that if two users choose the same
+password this entry will be identical (i.e. the password is
+not "salted" as the UNIX password is).
- cat old_smbpasswd_file | convert_smbpasswd > new_smbpasswd_file
-
-
-.fi
-
-
-.PP
-The \fBconvert_smbpasswd\fP script reads from stdin and writes to stdout
-so as not to overwrite any files by accident\&.
-.PP
-Once this script has been run, check the contents of the new smbpasswd
-file to ensure that it has not been damaged by the conversion script
-(which uses \fBawk\fP), and then replace the \f(CW<old smbpasswd file>\fP
-with the \f(CW<new smbpasswd file>\fP\&.
-.PP
-.SH "VERSION"
-.PP
-This man page is correct for version 2\&.0 of the Samba suite\&.
-.PP
-.SH "SEE ALSO"
-.PP
-\fBsmbpasswd (8)\fP, \fBsamba
-(7)\fP, and the Internet RFC1321 for details on the MD4
-algorithm\&.
-.PP
-.SH "AUTHOR"
-.PP
-The original Samba software and related utilities were created by
-Andrew Tridgell samba@samba\&.org\&. Samba is now developed
-by the Samba Team as an Open Source project similar to the way the
-Linux kernel is developed\&.
-.PP
-The original Samba man pages were written by Karl Auer\&. The man page
-sources were converted to YODL format (another excellent piece of Open
-Source software, available at
-\fBftp://ftp\&.icce\&.rug\&.nl/pub/unix/\fP)
-and updated for the Samba2\&.0 release by Jeremy
-Allison, samba@samba\&.org\&.
-.PP
-See \fBsamba (7)\fP to find out how to get a full
-list of contributors and details on how to submit bug reports,
-comments etc\&.
+\fBWARNING !!\fR. Note that, due to
+the challenge-response nature of the SMB/CIFS authentication
+protocol, anyone with a knowledge of this password hash will
+be able to impersonate the user on the network. For this
+reason these hashes are known as \fBplain text
+equivalents\fR and must \fBNOT\fR be made
+available to anyone but the root user. To protect these passwords
+the smbpasswd file is placed in a directory with read and
+traverse access only to the root user and the smbpasswd file
+itself must be set to be read/write only by root, with no
+other access.
+.TP
+\fBAccount Flags\fR
+This section contains flags that describe
+the attributes of the users account. In the Samba 2.2 release
+this field is bracketed by '[' and ']' characters and is always
+13 characters in length (including the '[' and ']' characters).
+The contents of this field may be any of the characters.
+.RS
+.TP 0.2i
+\(bu
+\fBU\fR - This means
+this is a "User" account, i.e. an ordinary user. Only User
+and Workstation Trust accounts are currently supported
+in the smbpasswd file.
+.TP 0.2i
+\(bu
+\fBN\fR - This means the
+account has no password (the passwords in the fields Lanman
+Password Hash and NT Password Hash are ignored). Note that this
+will only allow users to log on with no password if the \fI null passwords\fR parameter is set in the \fIsmb.conf(5)
+\fR <URL:smb.conf.5.html#NULLPASSWORDS> config file.
+.TP 0.2i
+\(bu
+\fBD\fR - This means the account
+is disabled and no SMB/CIFS logins will be allowed for
+this user.
+.TP 0.2i
+\(bu
+\fBW\fR - This means this account
+is a "Workstation Trust" account. This kind of account is used
+in the Samba PDC code stream to allow Windows NT Workstations
+and Servers to join a Domain hosted by a Samba PDC.
+.RE
+.PP
+Other flags may be added as the code is extended in future.
+The rest of this field space is filled in with spaces.
+.PP
+.TP
+\fBLast Change Time\fR
+This field consists of the time the account was
+last modified. It consists of the characters 'LCT-' (standing for
+"Last Change Time") followed by a numeric encoding of the UNIX time
+in seconds since the epoch (1970) that the last change was made.
+.PP
+All other colon separated fields are ignored at this time.
+.PP
+.SH "VERSION"
+.PP
+This man page is correct for version 2.2 of
+the Samba suite.
+.SH "SEE ALSO"
+.PP
+\fBsmbpasswd(8)\fR <URL:smbpasswd.8.html>,
+samba(7) <URL:samba.7.html>, and
+the Internet RFC1321 for details on the MD4 algorithm.
+.SH "AUTHOR"
+.PP
+The original Samba software and related utilities
+were created by Andrew Tridgell. Samba is now developed
+by the Samba Team as an Open Source project similar
+to the way the Linux kernel is developed.
+.PP
+The original Samba man pages were written by Karl Auer.
+The man page sources were converted to YODL format (another
+excellent piece of Open Source software, available at
+ftp://ftp.icce.rug.nl/pub/unix/ <URL:ftp://ftp.icce.rug.nl/pub/unix/>) and updated for the Samba 2.0
+release by Jeremy Allison. The conversion to DocBook for
+Samba 2.2 was done by Gerald Carter
diff --git a/docs/manpages/smbpasswd.8 b/docs/manpages/smbpasswd.8
index be70fad031..3c134913a9 100644
--- a/docs/manpages/smbpasswd.8
+++ b/docs/manpages/smbpasswd.8
@@ -1,308 +1,301 @@
-.TH "smbpasswd " "8" "23 Oct 1998" "Samba" "SAMBA"
-.PP
-.SH "NAME"
+.\" This manpage has been automatically generated by docbook2man-spec
+.\" from a DocBook document. docbook2man-spec can be found at:
+.\" <http://shell.ipoline.com/~elmert/hacks/docbook2X/>
+.\" Please send any bug reports, improvements, comments, patches,
+.\" etc. to Steve Cheng <steve@ggi-project.org>.
+.TH "SMBPASSWD" "8" "22 February 2001" "" ""
+.SH NAME
smbpasswd \- change a users SMB password
-.PP
-.SH "SYNOPSIS"
-.PP
-\fBsmbpasswd\fP [-a] [-x] [-d] [-e] [-D debug level] [-n] [-r remote_machine] [-R name resolve order] [-m] [-j DOMAIN] [-U username] [-h] [-s] username
-.PP
-.SH "DESCRIPTION"
-.PP
-This program is part of the \fBSamba\fP suite\&.
-.PP
-The \fBsmbpasswd\fP program has several different functions, depending
-on whether it is run by the \fIroot\fP user or not\&. When run as a normal
-user it allows the user to change the password used for their SMB
-sessions on any machines that store SMB passwords\&.
-.PP
-By default (when run with no arguments) it will attempt to change the
-current users SMB password on the local machine\&. This is similar to
-the way the \fBpasswd (1)\fP program works\&. \fBsmbpasswd\fP differs from how
-the \fBpasswd\fP program works however in that it is not \fIsetuid root\fP
-but works in a client-server mode and communicates with a locally
-running \fBsmbd\fP\&. As a consequence in order for this
-to succeed the \fBsmbd\fP daemon must be running on
-the local machine\&. On a UNIX machine the encrypted SMB passwords are
-usually stored in the \fBsmbpasswd (5)\fP file\&.
-.PP
-When run by an ordinary user with no options\&. \fBsmbpasswd\fP will
-prompt them for their old smb password and then ask them for their new
-password twice, to ensure that the new password was typed
-correctly\&. No passwords will be echoed on the screen whilst being
-typed\&. If you have a blank smb password (specified by the string "NO
-PASSWORD" in the \fBsmbpasswd\fP file) then just
-press the <Enter> key when asked for your old password\&.
-.PP
-\fBsmbpasswd\fP can also be used by a normal user to change their SMB
-password on remote machines, such as Windows NT Primary Domain
-Controllers\&. See the (\fB-r\fP) and
-\fB-U\fP options below\&.
-.PP
-When run by root, \fBsmbpasswd\fP allows new users to be added and
-deleted in the \fBsmbpasswd\fP file, as well as
-allows changes to the attributes of the user in this file to be made\&. When
-run by root, \fBsmbpasswd\fP accesses the local
-\fBsmbpasswd\fP file directly, thus enabling
-changes to be made even if \fBsmbd\fP is not running\&.
-.PP
-.SH "OPTIONS"
-.PP
-.IP
-.IP "\fB-a\fP"
-This option specifies that the username following should
-be added to the local \fBsmbpasswd\fP file, with
-the new password typed (type <Enter> for the old password)\&. This
-option is ignored if the username following already exists in the
-\fBsmbpasswd\fP file and it is treated like a
-regular change password command\&. Note that the user to be added
-\fBmust\fP already exist in the system password file (usually /etc/passwd)
-else the request to add the user will fail\&.
-.IP
-This option is only available when running \fBsmbpasswd\fP as
-root\&.
-.IP
-.IP "\fB-x\fP"
-This option specifies that the username following should
-be deleted from the local \fBsmbpasswd\fP file\&.
-.IP
-This option is only available when running \fBsmbpasswd\fP as
-root\&.
-.IP
-.IP "\fB-d\fP"
-This option specifies that the username following should be
-\fIdisabled\fP in the local \fBsmbpasswd\fP file\&.
-This is done by writing a \fI\'D\'\fP flag into the account control space
-in the \fBsmbpasswd\fP file\&. Once this is done
-all attempts to authenticate via SMB using this username will fail\&.
-.IP
-If the \fBsmbpasswd\fP file is in the \'old\'
-format (pre-Samba 2\&.0 format) there is no space in the users password
-entry to write this information and so the user is disabled by writing
-\'X\' characters into the password space in the
-\fBsmbpasswd\fP file\&. See \fBsmbpasswd
-(5)\fP for details on the \'old\' and new password file
-formats\&.
-.IP
-This option is only available when running \fBsmbpasswd\fP as root\&.
-.IP
-.IP "\fB-e\fP"
-This option specifies that the username following should be
-\fIenabled\fP in the local \fBsmbpasswd\fP file,
-if the account was previously disabled\&. If the account was not
-disabled this option has no effect\&. Once the account is enabled
-then the user will be able to authenticate via SMB once again\&.
-.IP
-If the smbpasswd file is in the \'old\' format then \fBsmbpasswd\fP will
-prompt for a new password for this user, otherwise the account will be
-enabled by removing the \fI\'D\'\fP flag from account control space in the
-\fBsmbpasswd\fP file\&. See \fBsmbpasswd
-(5)\fP for details on the \'old\' and new password file
-formats\&.
-.IP
-This option is only available when running \fBsmbpasswd\fP as root\&.
-.IP
-.IP "\fB-D debuglevel\fP"
-debuglevel is an integer from 0
-to 10\&. The default value if this parameter is not specified is zero\&.
-.IP
-The higher this value, the more detail will be logged to the log files
-about the activities of smbpasswd\&. At level 0, only critical errors
-and serious warnings will be logged\&.
-.IP
-Levels above 1 will generate considerable amounts of log data, and
-should only be used when investigating a problem\&. Levels above 3 are
-designed for use only by developers and generate HUGE amounts of log
-data, most of which is extremely cryptic\&.
-.IP
-.IP "\fB-n\fP"
-This option specifies that the username following should
-have their password set to null (i\&.e\&. a blank password) in the local
-\fBsmbpasswd\fP file\&. This is done by writing the
-string "NO PASSWORD" as the first part of the first password stored in
-the \fBsmbpasswd\fP file\&.
-.IP
-Note that to allow users to logon to a Samba server once the password
-has been set to "NO PASSWORD" in the
-\fBsmbpasswd\fP file the administrator must set
-the following parameter in the [global] section of the
-\fBsmb\&.conf\fP file :
-.IP
-null passwords = true
-.IP
-This option is only available when running \fBsmbpasswd\fP as root\&.
-.IP
-.IP "\fB-r remote machine name\fP"
-This option allows a
-user to specify what machine they wish to change their password
-on\&. Without this parameter \fBsmbpasswd\fP defaults to the local
-host\&. The \fI"remote machine name"\fP is the NetBIOS name of the
-SMB/CIFS server to contact to attempt the password change\&. This name
-is resolved into an IP address using the standard name resolution
-mechanism in all programs of the \fBSamba\fP
-suite\&. See the \fB-R name resolve order\fP parameter for details on changing this resolving
-mechanism\&.
-.IP
-The username whose password is changed is that of the current UNIX
-logged on user\&. See the \fB-U username\fP
-parameter for details on changing the password for a different
-username\&.
-.IP
-Note that if changing a Windows NT Domain password the remote machine
-specified must be the Primary Domain Controller for the domain (Backup
-Domain Controllers only have a read-only copy of the user account
-database and will not allow the password change)\&.
-.IP
-\fINote\fP that Windows 95/98 do not have a real password database
-so it is not possible to change passwords specifying a Win95/98
-machine as remote machine target\&.
-.IP
-.IP "\fB-R name resolve order\fP"
-This option allows the user of
-smbclient to determine what name resolution services to use when
-looking up the NetBIOS name of the host being connected to\&.
-.IP
-The options are :"lmhosts", "host",
-"wins" and "bcast"\&. They cause names to be
-resolved as follows :
-.IP
-.IP
-.IP o
-\fBlmhosts\fP : Lookup an IP address in the Samba lmhosts file\&.
-.IP
-.IP o
-\fBhost\fP : Do a standard host name to IP address resolution,
-using the system /etc/hosts, NIS, or DNS lookups\&. This method of name
-resolution is operating system dependent\&. For instance on IRIX or
-Solaris, this may be controlled by the \fI/etc/nsswitch\&.conf\fP file)\&.
-.IP
-.IP o
-\fBwins\fP : Query a name with the IP address listed in the
-\fBwins server\fP parameter in the
-\fBsmb\&.conf file\fP\&. If
-no WINS server has been specified this method will be ignored\&.
-.IP
-.IP o
-\fBbcast\fP : Do a broadcast on each of the known local interfaces
-listed in the \fBinterfaces\fP parameter
-in the smb\&.conf file\&. This is the least reliable of the name resolution
-methods as it depends on the target host being on a locally connected
-subnet\&.
-.IP
-.IP
-If this parameter is not set then the name resolve order defined
-in the \fBsmb\&.conf\fP file parameter
-\fBname resolve order\fP
-will be used\&.
-.IP
-The default order is lmhosts, host, wins, bcast and without this
-parameter or any entry in the \fBsmb\&.conf\fP
-file the name resolution methods will be attempted in this order\&.
-.IP
-.IP "\fB-m\fP"
-This option tells \fBsmbpasswd\fP that the account being
-changed is a \fIMACHINE\fP account\&. Currently this is used when Samba is
-being used as an NT Primary Domain Controller\&. PDC support is not a
-supported feature in Samba2\&.0 but will become supported in a later
-release\&. If you wish to know more about using Samba as an NT PDC then
-please subscribe to the mailing list
-samba-ntdom@samba\&.org\&.
-.IP
-This option is only available when running \fBsmbpasswd\fP as root\&.
-.IP
-.IP "\fB-j DOMAIN\fP"
-This option is used to add a Samba server into a
-Windows NT Domain, as a Domain member capable of authenticating user
-accounts to any Domain Controller in the same way as a Windows NT
-Server\&. See the \fBsecurity=domain\fP
-option in the \fBsmb\&.conf (5)\fP man page\&.
-.IP
-In order to be used in this way, the Administrator for the Windows
-NT Domain must have used the program \fI"Server Manager for Domains"\fP
-to add the primary NetBIOS name of
-the Samba server as a member of the Domain\&.
-.IP
-After this has been done, to join the Domain invoke \fBsmbpasswd\fP with
-this parameter\&. \fBsmbpasswd\fP will then look up the Primary Domain
-Controller for the Domain (found in the
-\fBsmb\&.conf\fP file in the parameter
-\fBpassword server\fP and change
-the machine account password used to create the secure Domain
-communication\&. This password is then stored by \fBsmbpasswd\fP in a
-file, read only by root, called \f(CW<Domain>\&.<Machine>\&.mac\fP where
-\f(CW<Domain>\fP is the name of the Domain we are joining and \f(CW<Machine>\fP
-is the primary NetBIOS name of the machine we are running on\&.
-.IP
-Once this operation has been performed the
-\fBsmb\&.conf\fP file may be updated to set the
-\fBsecurity=domain\fP option and all
-future logins to the Samba server will be authenticated to the Windows
-NT PDC\&.
-.IP
-Note that even though the authentication is being done to the PDC all
-users accessing the Samba server must still have a valid UNIX account
-on that machine\&.
-.IP
-This option is only available when running \fBsmbpasswd\fP as root\&.
-.IP
-.IP "\fB-U username\fP"
-This option may only be used in
-conjunction with the \fB-r\fP
-option\&. When changing a password on a remote machine it allows the
-user to specify the user name on that machine whose password will be
-changed\&. It is present to allow users who have different user names on
-different systems to change these passwords\&.
-.IP
-.IP "\fB-h\fP"
-This option prints the help string for \fBsmbpasswd\fP,
-selecting the correct one for running as root or as an ordinary user\&.
-.IP
-.IP "\fB-s\fP"
-This option causes \fBsmbpasswd\fP to be silent (i\&.e\&. not
-issue prompts) and to read it\'s old and new passwords from standard
-input, rather than from \f(CW/dev/tty\fP (like the \fBpasswd (1)\fP program
-does)\&. This option is to aid people writing scripts to drive \fBsmbpasswd\fP
-.IP
-.IP "\fBusername\fP"
-This specifies the username for all of the \fIroot
-only\fP options to operate on\&. Only root can specify this parameter as
-only root has the permission needed to modify attributes directly
-in the local \fBsmbpasswd\fP file\&.
-.IP
-.SH "NOTES"
-.IP
-Since \fBsmbpasswd\fP works in client-server mode communicating with a
-local \fBsmbd\fP for a non-root user then the \fBsmbd\fP
-daemon must be running for this to work\&. A common problem is to add a
-restriction to the hosts that may access the \fBsmbd\fP running on the
-local machine by specifying a \fB"allow
-hosts"\fP or \fB"deny
-hosts"\fP entry in the
-\fBsmb\&.conf\fP file and neglecting to allow
-\fI"localhost"\fP access to the \fBsmbd\fP\&.
-.IP
-In addition, the \fBsmbpasswd\fP command is only useful if \fBSamba\fP has
-been set up to use encrypted passwords\&. See the file \fBENCRYPTION\&.txt\fP
-in the docs directory for details on how to do this\&.
-.IP
-.SH "VERSION"
-.IP
-This man page is correct for version 2\&.0 of the Samba suite\&.
-.IP
-.SH "AUTHOR"
-.IP
-The original Samba software and related utilities were created by
-Andrew Tridgell samba@samba\&.org\&. Samba is now developed
-by the Samba Team as an Open Source project similar to the way the
-Linux kernel is developed\&.
-.IP
-The original Samba man pages were written by Karl Auer\&. The man page
-sources were converted to YODL format (another excellent piece of Open
-Source software, available at
-\fBftp://ftp\&.icce\&.rug\&.nl/pub/unix/\fP)
-and updated for the Samba2\&.0 release by Jeremy Allison\&.
-samba@samba\&.org\&.
-.IP
-See \fBsamba (7)\fP to find out how to get a full
-list of contributors and details on how to submit bug reports,
-comments etc\&.
+.SH SYNOPSIS
+.sp
+\fBsmbpasswd\fR [ \fB-a\fR ] [ \fB-x\fR ] [ \fB-d\fR ] [ \fB-e\fR ] [ \fB-D debuglevel\fR ] [ \fB-n\fR ] [ \fB-r <remote machine>\fR ] [ \fB-R <name resolve order>\fR ] [ \fB-m\fR ] [ \fB-j DOMAIN\fR ] [ \fB-U username\fR ] [ \fB-h\fR ] [ \fB-s\fR ] [ \fBusername\fR ]
+.SH "DESCRIPTION"
+.PP
+This tool is part of the Samba <URL:samba.7.html> suite.
+.PP
+The smbpasswd program has several different
+functions, depending on whether it is run by the \fBroot\fR
+user or not. When run as a normal user it allows the user to change
+the password used for their SMB sessions on any machines that store
+SMB passwords.
+.PP
+By default (when run with no arguments) it will attempt to
+change the current users SMB password on the local machine. This is
+similar to the way the \fBpasswd(1)\fR program works.
+\fBsmbpasswd\fR differs from how the passwd program works
+however in that it is not \fBsetuid root\fR but works in
+a client-server mode and communicates with a locally running
+\fBsmbd(8)\fR. As a consequence in order for this to
+succeed the smbd daemon must be running on the local machine. On a
+UNIX machine the encrypted SMB passwords are usually stored in
+the \fIsmbpasswd(5)\fR file.
+.PP
+When run by an ordinary user with no options. smbpasswd
+will prompt them for their old smb password and then ask them
+for their new password twice, to ensure that the new password
+was typed correctly. No passwords will be echoed on the screen
+whilst being typed. If you have a blank smb password (specified by
+the string "NO PASSWORD" in the smbpasswd file) then just press
+the <Enter> key when asked for your old password.
+.PP
+smbpasswd can also be used by a normal user to change their
+SMB password on remote machines, such as Windows NT Primary Domain
+Controllers. See the (-r) and -U options below.
+.PP
+When run by root, smbpasswd allows new users to be added
+and deleted in the smbpasswd file, as well as allows changes to
+the attributes of the user in this file to be made. When run by root,
+\fBsmbpasswd\fR accesses the local smbpasswd file
+directly, thus enabling changes to be made even if smbd is not
+running.
+.SH "OPTIONS"
+.TP
+\fB-a\fR
+This option specifies that the username
+following should be added to the local smbpasswd file, with the
+new password typed (type <Enter> for the old password). This
+option is ignored if the username following already exists in
+the smbpasswd file and it is treated like a regular change
+password command. Note that the user to be added must already exist
+in the system password file (usually \fI/etc/passwd\fR)
+else the request to add the user will fail.
+
+This option is only available when running smbpasswd
+as root.
+.TP
+\fB-x\fR
+This option specifies that the username
+following should be deleted from the local smbpasswd file.
+
+This option is only available when running smbpasswd as
+root.
+.TP
+\fB-d\fR
+This option specifies that the username following
+should be disabled in the local smbpasswd
+file. This is done by writing a 'D' flag
+into the account control space in the smbpasswd file. Once this
+is done all attempts to authenticate via SMB using this username
+will fail.
+
+If the smbpasswd file is in the 'old' format (pre-Samba 2.0
+format) there is no space in the users password entry to write
+this information and so the user is disabled by writing 'X' characters
+into the password space in the smbpasswd file. See \fBsmbpasswd(5)
+\fRfor details on the 'old' and new password file formats.
+
+This option is only available when running smbpasswd as
+root.
+.TP
+\fB-e\fR
+This option specifies that the username following
+should be enabled in the local smbpasswd file,
+if the account was previously disabled. If the account was not
+disabled this option has no effect. Once the account is enabled then
+the user will be able to authenticate via SMB once again.
+
+If the smbpasswd file is in the 'old' format, then \fB smbpasswd\fR will prompt for a new password for this user,
+otherwise the account will be enabled by removing the 'D'
+flag from account control space in the \fI smbpasswd\fR file. See \fBsmbpasswd (5)\fR for
+details on the 'old' and new password file formats.
+
+This option is only available when running smbpasswd as root.
+.TP
+\fB-D debuglevel\fR
+\fIdebuglevel\fR is an integer
+from 0 to 10. The default value if this parameter is not specified
+is zero.
+
+The higher this value, the more detail will be logged to the
+log files about the activities of smbpasswd. At level 0, only
+critical errors and serious warnings will be logged.
+
+Levels above 1 will generate considerable amounts of log
+data, and should only be used when investigating a problem. Levels
+above 3 are designed for use only by developers and generate
+HUGE amounts of log data, most of which is extremely cryptic.
+.TP
+\fB-n\fR
+This option specifies that the username following
+should have their password set to null (i.e. a blank password) in
+the local smbpasswd file. This is done by writing the string "NO
+PASSWORD" as the first part of the first password stored in the
+smbpasswd file.
+
+Note that to allow users to logon to a Samba server once
+the password has been set to "NO PASSWORD" in the smbpasswd
+file the administrator must set the following parameter in the [global]
+section of the \fIsmb.conf\fR file :
+
+\fBnull passwords = yes\fR
+
+This option is only available when running smbpasswd as
+root.
+.TP
+\fB-r remote machine name\fR
+This option allows a user to specify what machine
+they wish to change their password on. Without this parameter
+smbpasswd defaults to the local host. The \fIremote
+machine name\fR is the NetBIOS name of the SMB/CIFS
+server to contact to attempt the password change. This name is
+resolved into an IP address using the standard name resolution
+mechanism in all programs of the Samba suite. See the \fI-R
+name resolve order\fR parameter for details on changing
+this resolving mechanism.
+
+The username whose password is changed is that of the
+current UNIX logged on user. See the \fI-U username\fR
+parameter for details on changing the password for a different
+username.
+
+Note that if changing a Windows NT Domain password the
+remote machine specified must be the Primary Domain Controller for
+the domain (Backup Domain Controllers only have a read-only
+copy of the user account database and will not allow the password
+change).
+
+\fBNote\fR that Windows 95/98 do not have
+a real password database so it is not possible to change passwords
+specifying a Win95/98 machine as remote machine target.
+.TP
+\fB-R name resolve order\fR
+This option allows the user of smbclient to determine
+what name resolution services to use when looking up the NetBIOS
+name of the host being connected to.
+
+The options are :"lmhosts", "host", "wins" and "bcast". They cause
+names to be resolved as follows :
+.RS
+.TP 0.2i
+\(bu
+lmhosts : Lookup an IP
+address in the Samba lmhosts file. If the line in lmhosts has
+no name type attached to the NetBIOS name (see the lmhosts(5) <URL:lmhosts.5.html> for details) then
+any name type matches for lookup.
+.TP 0.2i
+\(bu
+host : Do a standard host
+name to IP address resolution, using the system \fI/etc/hosts
+\fR, NIS, or DNS lookups. This method of name resolution
+is operating system depended for instance on IRIX or Solaris this
+may be controlled by the \fI/etc/nsswitch.conf\fR
+file). Note that this method is only used if the NetBIOS name
+type being queried is the 0x20 (server) name type, otherwise
+it is ignored.
+.TP 0.2i
+\(bu
+wins : Query a name with
+the IP address listed in the \fIwins server\fR
+parameter. If no WINS server has been specified this method
+will be ignored.
+.TP 0.2i
+\(bu
+bcast : Do a broadcast on
+each of the known local interfaces listed in the
+\fIinterfaces\fR parameter. This is the least
+reliable of the name resolution methods as it depends on the
+target host being on a locally connected subnet.
+.RE
+.PP
+The default order is \fBlmhosts, host, wins, bcast\fR
+and without this parameter or any entry in the
+\fIsmb.conf\fR file the name resolution methods will
+be attempted in this order.
+.PP
+.TP
+\fB-m\fR
+This option tells smbpasswd that the account
+being changed is a MACHINE account. Currently this is used
+when Samba is being used as an NT Primary Domain Controller.
+
+This option is only available when running smbpasswd as root.
+.TP
+\fB-j DOMAIN\fR
+This option is used to add a Samba server
+into a Windows NT Domain, as a Domain member capable of authenticating
+user accounts to any Domain Controller in the same way as a Windows
+NT Server. See the \fBsecurity = domain\fR option in
+the \fIsmb.conf(5)\fR man page.
+
+In order to be used in this way, the Administrator for
+the Windows NT Domain must have used the program "Server Manager
+for Domains" to add the primary NetBIOS name of the Samba server
+as a member of the Domain.
+
+After this has been done, to join the Domain invoke \fB smbpasswd\fR with this parameter. smbpasswd will then
+look up the Primary Domain Controller for the Domain (found in
+the \fIsmb.conf\fR file in the parameter
+\fIpassword server\fR and change the machine account
+password used to create the secure Domain communication. This
+password is then stored by smbpasswd in a TDB, writeable only by root,
+called \fIsecrets.tdb\fR
+
+Once this operation has been performed the \fI smb.conf\fR file may be updated to set the \fB security = domain\fR option and all future logins
+to the Samba server will be authenticated to the Windows NT
+PDC.
+
+Note that even though the authentication is being
+done to the PDC all users accessing the Samba server must still
+have a valid UNIX account on that machine.
+
+This option is only available when running smbpasswd as root.
+.TP
+\fB-U username\fR
+This option may only be used in conjunction
+with the \fI-r\fR option. When changing
+a password on a remote machine it allows the user to specify
+the user name on that machine whose password will be changed. It
+is present to allow users who have different user names on
+different systems to change these passwords.
+.TP
+\fB-h\fR
+This option prints the help string for \fB smbpasswd\fR, selecting the correct one for running as root
+or as an ordinary user.
+.TP
+\fB-s\fR
+This option causes smbpasswd to be silent (i.e.
+not issue prompts) and to read it's old and new passwords from
+standard input, rather than from \fI/dev/tty\fR
+(like the \fBpasswd(1)\fR program does). This option
+is to aid people writing scripts to drive smbpasswd
+.TP
+\fBusername\fR
+This specifies the username for all of the
+\fBroot only\fR options to operate on. Only root
+can specify this parameter as only root has the permission needed
+to modify attributes directly in the local smbpasswd file.
+.SH "NOTES"
+.PP
+Since \fBsmbpasswd\fR works in client-server
+mode communicating with a local smbd for a non-root user then
+the smbd daemon must be running for this to work. A common problem
+is to add a restriction to the hosts that may access the \fB smbd\fR running on the local machine by specifying a
+\fIallow hosts\fR or \fIdeny hosts\fR
+entry in the \fIsmb.conf\fR file and neglecting to
+allow "localhost" access to the smbd.
+.PP
+In addition, the smbpasswd command is only useful if Samba
+has been set up to use encrypted passwords. See the file
+\fIENCRYPTION.txt\fR in the docs directory for details
+on how to do this.
+.SH "VERSION"
+.PP
+This man page is correct for version 2.2 of
+the Samba suite.
+.SH "SEE ALSO"
+.PP
+\fIsmbpasswd(5)\fR <URL:smbpasswd.5.html>,
+samba(7) <URL:samba.7.html>
+.SH "AUTHOR"
+.PP
+The original Samba software and related utilities
+were created by Andrew Tridgell. Samba is now developed
+by the Samba Team as an Open Source project similar
+to the way the Linux kernel is developed.
+.PP
+The original Samba man pages were written by Karl Auer.
+The man page sources were converted to YODL format (another
+excellent piece of Open Source software, available at
+ftp://ftp.icce.rug.nl/pub/unix/ <URL:ftp://ftp.icce.rug.nl/pub/unix/>) and updated for the Samba 2.0
+release by Jeremy Allison. The conversion to DocBook for
+Samba 2.2 was done by Gerald Carter