PDC with Samba and Microsoft client...password problem

[Luca_52]

Hi to all,
I'm Luca and I have a problem.
I would like to set a password policy to users.

1. Change password at next logon

2. Password Expired


Thank!
Best regardes from Rome

[Luca_52]

ahh...
sorry for my bad english...
;)
I hop you understand my post...

[Senthilmurugan]

Hello Luca,

Try using
"machine passowrd timeout" option in the smb.conf file

Regards
Senthil Murugan

[Luca_52]

ok I understand,
but I'm a rookie for linux and samba, this is the 2 week that i work with it.
How can I insert this comment in /etc/samba/smb.passwd?
How much is its value?
Where Must I put it?

Could you tell me the steps for edit this file inserting password policy only?
Thank you for your help
Regardes from Rome

p.s. Sorry for my bad english

[Senthilmurugan]

Hello Luca,

You can insert the following line in the
/etc/smb.conf file ( or /etc/samba/smb.conf whereever you have configured while installing)

#vi /etc/smb.conf

insert the following line under [global] sectoin

machine password timeout = 86400

This time is shown in seconds. You can also use your own time.

The machine password timeout global option sets a retention period for NT domain machine passwords. The default is currently set to the same time period that Windows NT 4.0 uses: 604,800 seconds (one week). Samba will periodically attempt to change the machine account password, which is a password used specifically by another server to report changes to it. This option specifies the number of seconds that Samba should wait before attempting to change that password


Regards,
Senthil Murugan

[Luca_52]

ok...but
for example I have 2 user:
I would like user1 password will expire tomorrow and user2 password will expire at now.
Where Must I insert this value inside the smb.conf file?
in the [global] section o below user raw?
thank you
Regards

[Senthilmurugan]

Hello Luca,

I believe you cannot set password expire for particular or for all the users. But you can make your Samba password to be synchronized with the unix password by including the following in the [global] section

unix password sync = Yes
---------------------------------------------
NOTE:
This boolean parameter controls whether Samba attempts to synchronize the UNIX password with the SMB password when the encrypted SMB password in the smbpasswd file is changed. If this is set to true the program specified in the passwd program parameter is called AS ROOT - to allow the new UNIX password to be set without access to the old UNIX password (as the SMB password change code has no access to the old password cleartext, only the new).

Default: unix password sync = no
---------------------------------------------

Regards,
Senthil Murugan

[Luca_52]

thank you for the information...and helps! ;)
but i think there is a way out to configure clients. With scripts?
someone said to me to use open ldap and kerberos but i don't know this software.
Do you know them?