I'm configuring a system in which all IT resources are available through a single user-password pair, be it access to shell on the servers, logging to Samba domain, WiFi, OpenVPN, Mantis, etc. (with access to specific services governed by group membership or user object fields). Because we have personal data in our network, we need to implement password aging, as per the EU Data Protection Directive (or rather the Polish version of it).
The problem is that Samba and POSIX accounts in LDAP use different password hashing and aging information. While synchronizing the passwords themselves is easy (the
ldap password sync = Yes in
smb.conf), adding password aging to the mix breaks things: Samba doesn't update shadowLastChange. Together with
obey pam restrictions = Yes creates a system in which a windows user can't change aged password, but if I don't use it, home directories won't be automatically created. The alternative is to use use LDAP extended operation for password changing, but the
smbk5pwd module doesn't set it either. What's worse, the OpenLDAP maintainer won't update it/accept patches as this field is considered deprecated.
So, my question is, what is the best solution? What are the up- and downsides of them?
ppolicyand internal LDAP password aging?
- How well does it work with NSS, PAM modules, samba, other systems?
- Do the NSS and PAM modules need to be configured in special way to use ppolicy, not shadow?
- Does GOsa² work with ppolicy?
- Are there other administrative tools that can work with
Hack together a change password script that updates the field in LDAP. (leaving the possibility that the user himself will update the field without changing password)