If the password is not included in these environment variables
(using the %pass syntax), rpcclient will look for a PASSWD environment
variable from which to read the password.
A third option is to use a credentials file which contains
the plaintext of the username and password. This option is
mainly provided for scripts where the admin doesn't desire to
pass the credentials on the command line or via environment variables.
If this method is used, make certain that the permissions on the file
restrict access from unwanted users. See the -A for more details.
Be cautious about including passwords in scripts or in the
PASSWD environment variable. Also, on many systems the command
line of a running process may be seen via the ps command to be
safe always allow smbclient to prompt for a password and type it in
directly.
username = <value>
password = <value>
Make certain that the permissions on the file restrict access from
unwanted users.
From Luke Leighton's original rpcclient man page:
"WARNING! The MSRPC over SMB code has been developed from examining
Network traces. No documentation is available from the original creators
(Microsoft) on how MSRPC over SMB works, or how the individual MSRPC services
work. Microsoft's implementation of these services has been demonstrated
(and reported) to be... a bit flakey in places.
The development of Samba's implementation is also a bit rough, and as more
of the services are understood, it can even result in versions of
smbd(8) and rpcclient that are incompatible for some commands or
services. Additionally, the developers are sending reports to Microsoft,
and problems found or reported to Microsoft are fixed in Service Packs,
which may result in incompatibilities."