samba - Aug 2017 - Force password complexity on NT4 style domain (Samba 4.6.4)

Hi,

is there a way to force password complexity on NT4 style domains?

the "samba-tool domain passwordsettings" seems to only work on DC 
mode, right?


Boris

On Wed, 30 Aug 2017 15:51:35 +0200
"Boris S. via samba" <samba at lists.samba.org> wrote:
> Hi,
> 
> is there a way to force password complexity on NT4 style domains?
Not that I aware of, the code just isn't there
If you really want/need complex passwords, there is always:

samba-tool domain classicupgrade
> 
> the "samba-tool domain passwordsettings" seems to only work on DC
> mode, right?
Correct, in fact samba-tool is only meant to be used on a Samba AD DC

Rowland

Mandi! Boris S. via samba
  In chel di` si favelave...
> is there a way to force password complexity on NT4 style domains?
> the "samba-tool domain passwordsettings" seems to only work on DC
mode,
> right?
You can use 'password policies':

 pdbedit -P "maximum password age" -C 7776000

 pdbedit -P "min password length" -C 8
 pdbedit -P "password history" -C 5

 pdbedit -P "bad lockout attempt" -C 5
 pdbedit -P "lockout duration" -C 30
 pdbedit -P "reset count minutes" -C 5

-- 
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''         
http://www.lanostrafamiglia.it/
  Polo FVG   -   Via della Bontà, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

Am 30.08.2017 um 16:34 schrieb Rowland Penny via samba:
> the "samba-tool domain passwordsettings" seems to only work on DC
>> mode, right?
> Correct, in fact samba-tool is only meant to be used on a Samba AD DC
>
Thanks for the info. So I'll go for a check password script for now.

Boris

Am 30.08.2017 um 16:38 schrieb Marco Gaiarin via samba:
> Mandi! Boris S. via samba
>    In chel di` si favelave...
>
>> is there a way to force password complexity on NT4 style domains?
>> the "samba-tool domain passwordsettings" seems to only work
on DC mode,
>> right?
> You can use 'password policies':
>
>   pdbedit -P "maximum password age" -C 7776000
>
>   pdbedit -P "min password length" -C 8
>   pdbedit -P "password history" -C 5
>
>   pdbedit -P "bad lockout attempt" -C 5
>   pdbedit -P "lockout duration" -C 30
>   pdbedit -P "reset count minutes" -C 5
>
Thank you. I found these settings already and changed them to my needs.
I will let check the complexity with a script ("check password
script").

Boris