samba - Jul 2022 - Password Hash Swapping

On Thu, 2022-07-21 at 10:02 -0400, ralph strebbing via samba
wrote:
> Hey All,
> 
> Got something we're trying to make work, and wondering if it's even
> possible with the current state of Active Directory. A while back
> (presumably when we were still running an NT Domain on Samba 3), the
> company I work for built a tool to basically read the password hash
> of
> a user, and replace it with a preset hash so we could provision user
> accounts and log in as them, then revert the change when we were done
> to prevent them from having to reset their password. We're looking to
> do that again if possible, but with the amount of contradicting
> information, and scouring the Samba code has left the conclusion of:
> Don't touch the ldb files lest you want to break stuff horribly.
No, you can edit sam.ldb, provided you use the ldb tools or ldap utils
etc. What isn't recommended is to modify the files under sam.ldb.d 

There is nothing stopping you creating users with a password and then
changing it again once everything is set up, but there numerous ways of
creating user homedirs etc as the user logs in for the first time.

I think what is going on here is that you are thinking in NT4-style
domain setup and you should be thing in AD domain setup.

Rowland

On Thu, Jul 21, 2022 at 10:22 AM Rowland Penny via samba
<samba at lists.samba.org> wrote:
> No, you can edit sam.ldb, provided you use the ldb tools or ldap utils
> etc. What isn't recommended is to modify the files under sam.ldb.d
Yeah, the issue was the sam.ldb file didn't have any of the hashes we
were looking for (if we were looking at the right info). This is where
the conflicting information comes into play, because only from the
domain specific ldb file in sam.ldb.d/ were we able to find the
unicodePwd, which I can't even verify is being used anymore, nor can I
peg down how it's calculated in a way that we can just swap
easily/safely without breaking things like our Azure sync.
> There is nothing stopping you creating users with a password and then
> changing it again once everything is set up, but there numerous ways of
> creating user homedirs etc as the user logs in for the first time.
Right, well when we need to specifically create a user, this isn't a
problem, and it's what we do. I was talking more about when we need to
set up a new workstation for an existing user, we do a LOT of prep and
customization for the users here, dealing with a lot of stupidity.
Regardless it's the concept of being able to log in as that user to
perform tasks, then revert the password so they don't have to reset it
on next login.
> I think what is going on here is that you are thinking in NT4-style
> domain setup and you should be thing in AD domain setup.
Can you fill me in on the different lines of thought here? I was a bit
too young to work with NT4 domains, so AD style (with Windows Server
2012 and above), or what I've done with this AD DC setup through Samba
is the most I've worked with domain setups. I know NT4 was an older
style of domain, and a lot less secure (Based on what I was reading,
things like smbpasswd, pdbedit, etc. being tools to work-around
accomplish what I'm trying to do), but I guess I don't really know the
key differences in mentality, if you feel like giving a brief history
lesson for me.

Regards,
Ralph