samba - Mar 2008 - Strange NT_STATUS_PASSWORD errors after upgrade to 3.0.26a

> I just upgraded one of our samba BDC's (with LDAP back end on 
> solaris 10) from 3.0.23c to
> 3.0.26a and can no longer mount shares.
> 
> The error message I'm seeing in the samba logs is 
> 
> [2007/11/15 14:15:26, 1] auth/auth_sam.c:sam_account_ok(172)
>   sam_account_ok: Account for user 'dbb' password must change!.
> [2007/11/15 14:15:26, 3] auth/auth_winbind.c:check_winbind_security(80)
>   check_winbind_security: Not using winbind, requested domain 
> [CLASSROOM] was for this SAM.
> [2007/11/15 14:15:26, 2] auth/auth.c:check_ntlm_password(319)
>   check_ntlm_password:  Authentication for user [dbb] -> [dbb] FAILED 
> with error NT_STATUS_PASSWORD_MUST_CHANGE
> [2007/11/15 14:15:26, 3] smbd/error.c:error_packet_set(106)
>   error packet at smbd/sesssetup.c(1489) cmd=115 (SMBsesssetupX) 
> NT_STATUS_PASSWORD_MUST_CHANGE
Hi,

Have there been any updates on this?

I have the same issue - after upgrading to the newest Samba, new users 
who have "sambaPwdMustChange" set (to an older date) can no longer log
in.


Whenever they want to log in, they are asked to change the password. 
After changing the password, they are not allowed to log in anyway.

A workaround is to add a X flag to sambaAcctFlags - then, after changing 
the password the user is able to log in, but is prompted to change the 
password each time after he/she logs out and logs in again.


This issue is present in Samba releases newer than 3.0.24 (i.e., 
everything works fine in 3.0.24, the issue exists with 3.0.25 up to 
current 3.0.28).



-- 
Tomasz Chmielewski
http://wpkg.org

Jayabrata Tripathy schrieb:
> Hi Tomasz,
>  
> How to set the "sambaPwdMustChange"? and Where to set this
parameter?
> smb.conf is not able to understand this parameter.
>  
> This problem bugging me quite a long time.
I keep all user data in LDAP, and I use LAM for that - http://lam.sf.net


-- 
Tomasz Chmielewski
http://wpkg.org


> On 3/5/08, *Tomasz Chmielewski* <mangoo@wpkg.org 
> <mailto:mangoo@wpkg.org>> wrote:
> 
>      > I just upgraded one of our samba BDC's (with LDAP back end on
>      > solaris 10) from 3.0.23c to
>      > 3.0.26a and can no longer mount shares.
>      >
>      > The error message I'm seeing in the samba logs is
>      >
>      > [2007/11/15 14:15:26, 1] auth/auth_sam.c:sam_account_ok(172)
>      >   sam_account_ok: Account for user 'dbb' password must
change!.
>      > [2007/11/15 14:15:26, 3]
>     auth/auth_winbind.c:check_winbind_security(80)
>      >   check_winbind_security: Not using winbind, requested domain
>      > [CLASSROOM] was for this SAM.
>      > [2007/11/15 14:15:26, 2] auth/auth.c:check_ntlm_password(319)
>      >   check_ntlm_password:  Authentication for user [dbb] -> [dbb]
FAILED
>      > with error NT_STATUS_PASSWORD_MUST_CHANGE
>      > [2007/11/15 14:15:26, 3] smbd/error.c:error_packet_set(106)
>      >   error packet at smbd/sesssetup.c(1489) cmd=115 (SMBsesssetupX)
>      > NT_STATUS_PASSWORD_MUST_CHANGE
> 
>     Hi,
> 
>     Have there been any updates on this?
> 
>     I have the same issue - after upgrading to the newest Samba, new users
>     who have "sambaPwdMustChange" set (to an older date) can no
longer
>     log in.
> 
> 
>     Whenever they want to log in, they are asked to change the password.
>     After changing the password, they are not allowed to log in anyway.
> 
>     A workaround is to add a X flag to sambaAcctFlags - then, after
changing
>     the password the user is able to log in, but is prompted to change the
>     password each time after he/she logs out and logs in again.
> 
> 
>     This issue is present in Samba releases newer than 3.0.24 (i.e.,
>     everything works fine in 3.0.24, the issue exists with 3.0.25 up to
>     current 3.0.28).
> 
> 
> 
>     --
>     Tomasz Chmielewski
>     http://wpkg.org
>     --
>     To unsubscribe from this list go to the following URL and read the
>     instructions:  https://lists.samba.org/mailman/listinfo/samba
> 
>