topic Re: Samba in Operating System - HP-UX

Samba

Mark Parsons — Wed, 18 Mar 2009 13:30:04 GMT

Hi All - Quick question. Is there anyway that when a user first invokes Samba to map to a network share that they are asked to change their (samba) password.

I've got a whole bunch of (samba) users who all have been given the same password and I want them to have to change it to one of their own choosing upon first login.

Kind Regards,

Mark Parsons

Re: Samba

Glenn S. Davidson — Thu, 19 Mar 2009 03:07:05 GMT

If you are using tdbsam then you can do this with pdbedit.

What additional configuration information can you give?

Re: Samba

Taifur — Thu, 19 Mar 2009 03:53:10 GMT

Hi Mark,

You can check the link

http://h30097.www3.hp.com/docs/iass/OSIS_59/documents/MAN/MAN7/0001____.HTM

Rgds//
Taifur

Re: Samba

Suraj K Sankari — Thu, 19 Mar 2009 04:09:53 GMT

Hi,

I asked my user to login into the box with there unix passwd and give smbpasswd and change there samba passwd.

[surajks@rspc521 surajks]$ smbpasswd
Old SMB password:
New SMB password:
Retype new SMB password:
Password changed for user surajks
[surajks@rspc521 surajks]$

Suraj

Re: Samba

Mark Parsons — Thu, 19 Mar 2009 09:48:36 GMT

Hi all again, It is just a simple Samba installation on an HPUX 11.11 box. We map a Unix folder as a shared drive onto the users laptop. The user has a Unix password and a Samba password. Is there anything that we can implement to make the user change the password the first time they map the share.

Re: Samba

eric roseme — Thu, 19 Mar 2009 15:02:59 GMT

Hi Mark,

I assume that you have a Samba PDC (security = user) with a passdb backend of tdbsam or ldapsam. If so, then you set domain policies with pdbedit. I believe that you have to set the "user must change password" attribute *and* the "password age" attribute to 0 (for each user) to make it happen at the next logon.

Have you already tried this and it did not work?

http://us1.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html#pdbeditthing

I think it's:

pdbedit -P "maximum password age" -C value
pdbedit -u user --pwd-must-change-time 0

Re: Samba

Mark Parsons — Thu, 19 Mar 2009 15:46:26 GMT

Eric,

Yes I have tried that - this is a one off password change for the users. They all have the same password at the beginning (there are about 100 users) and I want them to change the password upon their first login to the relevant share. That is the only time they should change their password. They are not logging into the HP box but from their laptop when mapping the share. Can this be done when they are asked for their user id / password when mapping the network drive to the unix folder via the users laptop.

Cheers,

Mark P.

Re: Samba

Mark Parsons — Fri, 20 Mar 2009 14:26:24 GMT

Please find screenshot attachment that shows exactly what I am trying to achieve:

Re: Samba

Heironimus — Fri, 20 Mar 2009 14:44:55 GMT

I'm not sure that Windows can a password change when it's just mounting a share, regardless of what server software you're using.

Re: Samba

eric roseme — Fri, 20 Mar 2009 15:15:26 GMT

I have been guessing about how you have your server set up. In this thread (http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1311403) I was guessing domain, in the current thread I was guessing user, but now maybe it looks like server. How about posting your smb.conf?

In any case, a client can change their domain password when logging into the domain (a Windows domain or a Samba domain). Assuming (now) that you are using "server" and your Samba server is not joined to the domain (of the client), then I don't know how a client would change a password (smbpasswd) when mounting a share.

Eric

Re: Samba

Mark Parsons — Fri, 20 Mar 2009 15:29:20 GMT

Hi Eric,

We have security set to USER (which obviously doesn't appear in the smb.conf file)

Mark P.

Re: Samba

eric roseme — Fri, 20 Mar 2009 21:13:32 GMT

Hi Mark,
If "security = user", then your Samba server is a PDC/BDC in a Samba domain, and the client should have to logon to the domain for authentication. At domain logon time is when the password change is prompted for, not at the share mount. If you have changed the policies with pdbedit, then the client needs to logoff the domain and log back on to make the change. I do not know of a way to prompt for a new password in a domain when the client is already logged on.

Eric