1

When a user on one of our Windows clients hits ctrl-alt-delete to change his password, our Samba domain controller is notified and performs the password change.

Unfortunately, the group policy rule requiring password complexity is ignored. Further, we recently began implementing kerberos, and samba isn't set up to update the principals.

I feel that the simplest way to fix this would be to disable password changes from our Windows clients on the domain (users can use our web services to change passwords instead).

What's the simplest way to implement this? Hopefully in the smb.conf.

2

If you have a mechanism for updating the registry on the Windows Computers you can set the

DisableChangePassword
DWORD value to 1 in:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
System

and

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\
System

This will disable the change password button, in the Windows Security Dialog box.

  • Thanks. I'd pretty much convinced myself that this is impossible through samba (without totally disabling smbpasswd). I will give this a try for disabling it per-client. My other option seems to be, if I go the route of not disabling the password change function, is simply to set up smb.conf to call kadmin to change user passwords and continue to do an ldap sync as it does now. With the password program option, I can wrap a set of password rules around the kdmin call. This will involve rewriting our current password scripts that call smbpasswd and kpasswd to only call smbpasswd. – thras Jun 25 '09 at 20:26
1

You could try to modify the parameters passwd program and passwd hat in smb.conf, setting it to /bin/false or something. Not sure that this will help though.

1

Depending upon your configuration, enabling

pam password change = no

May do the trick.

  • 1
    According to man smb.conf, there is no option enabling pam password change. Did you mean pam password change? – Martin von Wittich Oct 12 '17 at 15:23
  • 1
    @MartinvonWittich yes, sorry for the mishap. – wazoox Oct 12 '17 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.