samba - May 2019 - samba-tool max-pwd-age error

On Mon, 6 May 2019 08:57:35 +0200
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
> Hai, 
> 
> Well, i think you found a bug here, i get exact the same. 
> But i found a workaround ;-) 
> 
> We need to verify it. Can someone test this on a source build also
> for this.
> 
> Try this for the error. 
> samba-tool domain passwordsettings show
> samba-tool domain passwordsettings set --max-pwd-age=90
> 
> That errors. 
> 
> And if you try this and set Min + Max age, then it works: 
> 
> kinit Administrator
> samba-tool domain passwordsettings set --max-pwd-age=90
> --min-pwd-age=1 -k yes Minimum password age changed!
> Maximum password age changed!
> All changes applied successfully!
> 
> If some people here can verify it, then we can put it in bugzilla. 
> 
Morning Louis,

It does appear to be a bug ;-)

If you run:

samba-tool domain passwordsettings --help

Amongst the output is this:

  --min-pwd-age=MIN_PWD_AGE
                        The minimum password age (<integer in days> |
                        default).  Default is 1.

Which seems to say, if you don't supply the minimum password age,
'1'
will be used, BUT:

The code runs like this:

    def run(self, H=None, min_pwd_age=None,........


        if min_pwd_age is not None:
            if min_pwd_age == "default":
                min_pwd_age = 1
            else:
                min_pwd_age = int(min_pwd_age)

If you haven't supplied the minimum password age, the 'def' will set
it to 'None'.

This means that the code meant to set the minimum password age to '1'
is never run because 'min_pwd_age' is 'None'

I think the code should be:

        if min_pwd_age is None:
            if min_pwd_age == "default":
                min_pwd_age = 1
        else:
            min_pwd_age = int(min_pwd_age)

Rowland

See:




https://bugzilla.samba.org/show_bug.cgi?id=13873


and


https://lists.samba.org/archive/samba/2019-March/222141.html


These seem related, if not the same.

> It does appear to be a bug ;-)
> 
> If you run:
> 
> samba-tool domain passwordsettings --help
> 
> Amongst the output is this:
> 
>   --min-pwd-age=MIN_PWD_AGE
>                         The minimum password age (<integer in days> |
>                         default).  Default is 1.
> 
> Which seems to say, if you don't supply the minimum password age,
'1'
> will be used, BUT:
> 
> The code runs like this:
> 
>     def run(self, H=None, min_pwd_age=None,........
> 
>  
>         if min_pwd_age is not None:
>             if min_pwd_age == "default":
>                 min_pwd_age = 1
>             else:
>                 min_pwd_age = int(min_pwd_age)
> 
> If you haven't supplied the minimum password age, the 'def'
will set
> it to 'None'.
> 
> This means that the code meant to set the minimum password age to
'1'
> is never run because 'min_pwd_age' is 'None'
> 
> I think the code should be:
> 
>         if min_pwd_age is None:
>             if min_pwd_age == "default":
>                 min_pwd_age = 1
>         else:
>             min_pwd_age = int(min_pwd_age)
>

On Mon, 6 May 2019 08:21:15 +0000 (UTC)
Billy Bob via samba <samba at lists.samba.org> wrote:
> See:
> 
> 
> 
> 
> https://bugzilla.samba.org/show_bug.cgi?id=13873
> 
> 
> and
> 
> 
> https://lists.samba.org/archive/samba/2019-March/222141.html
> 
> 
> These seem related, if not the same.
They are, a bit more investigation, reveals why this has all come about.
It appears that if you didn't supply the minimum password age on
earlier versions, AD was searched for it, it isn't now, but the same
code to check is still being used.

Rowland