0

I want to detect when a user changes his password on the Samba4 DC.
As far as i know Samba4 stores the passwords in /var/lib/samba/private/secrets.tdb.
But when I change a password with smbpasswd the file does not change, the last change date is unchanged and the md5sum is the same.

So how can i detect if a password was changed?

1 Answer 1

2

Samba 4.x in domain controller mode stores the entire user account information in its built-in directory service database (not to be confused with a filesystem directory), very much like Windows DCs do.

The directory can be accessed with LDAP protocol, so you can use ldapsearch command to query account information, including pwdLastSet attribute. However be aware that this attribute may not be replicated between DCs, in this case you should query all of them separately.

1
  • Thanks, with that hint i solved my problem For those interested in ldapsearch -h localhost -p 389 -x -D "CN=username,CN=Users,DC=ACME,dc=com" -y ldap.credentials -b "CN=Users,DC=ACME,DC=com" -s one '(mail=*@ACME.com)' | grep "pwdLastSet: " | md5sum did the job for me
    – W4rlock
    Oct 23, 2015 at 6:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .