Samba - a way for user to change own password?

[TwoProc]

Has anyone found a way for the user to change their own password in SAMBA without logging in and getting a shell in Unix?

[Heironimus]

I'll assume that you're talking about a standalone server with local Samba accounts. You can run smbpasswd remotely to change a password. I think SWAT can also be used by normal users to change their passwords, but I've never used it for that.

[Tim Nelson]

Have then log into the swat admin page.

Each time the users change their NT password they had to access this page to make the same change or their share would not work.

The only other way is to register your SAMBA share with the PDC. Then use PDC authentication. Once registered with the PDC this will make your SAMBA share browseable with the Windows world ( security issue )

[eric roseme · Accepted solution]

Hi John,

A look at your smb.conf and a description of your Windows client access would help clarify things. If your passdb backend is ldapsam or tdbsam, then you can set password policies that dictate expiration dates, etc. These are a couple of the attributes from LDAP:

sambaPwdMustChange: 1851166219
sambaPasswordHistory:
sambaAcctFlags:
sambaPwdCanChange: 1188417288
sambaLMPassword:
sambaNTPassword:
sambaPwdLastSet: 1188417288

There are also domain-wide policies with ldapsam that are in the sambaDomain object. With these set, a Windows client user would enter their user/password at the login screen and then get a pop-up that their "password expired", or whatever, and have to change it.

If your passdb is smbpasswd, then I do not think that the user can administer their own password unless they use an app of some sort (like described above). It's an easy migration from smbpasswd to tdbsam if you need to do that to get password policies. ldapsam is quite complex.

Check out the Samba Howto chapter 11: http://us1.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html

Eric Roseme
Hewlett-Packard

[TwoProc]

Thanks Eric,

I'm going to have a look at that on my test system next week. Good suggestions, I'm hoping I get some forward motion on that. I'd love it if when their password was expired it would prompt them to change it.

Much appreciated.