I'm configuring a system in which all IT resources are available through a single user-password pair, be it access to shell on the servers, logging to Samba domain, WiFi, OpenVPN, Mantis, etc. (with access to specific services governed by group membership or user object fields). Because we have personal data in our network, we need to implement password aging, as per the EU Data Protection Directive (or rather the Polish version of it).
The problem is that Samba and POSIX accounts in LDAP use different password hashing and aging information. While synchronizing the passwords themselves is easy (the ldap password sync = Yes
in smb.conf
), adding password aging to the mix breaks things: Samba doesn't update shadowLastChange. Together with obey pam restrictions = Yes
creates a system in which a windows user can't change aged password, but if I don't use it, home directories won't be automatically created. The alternative is to use use LDAP extended operation for password changing, but the smbk5pwd
module doesn't set it either. What's worse, the OpenLDAP maintainer won't update it/accept patches as this field is considered deprecated.
So, my question is, what is the best solution? What are the up- and downsides of them?
Use LDAP
ppolicy
and internal LDAP password aging?- How well does it work with NSS, PAM modules, samba, other systems?
- Do the NSS and PAM modules need to be configured in special way to use ppolicy, not shadow?
- Does GOsa² work with ppolicy?
- Are there other administrative tools that can work with
ppolicy
-enabled LDAP?
Hack together a change password script that updates the field in LDAP. (leaving the possibility that the user himself will update the field without changing password)