samba - Apr 2022 - Password Filtering

On Wed, 2022-04-13 at 17:21 -0400, ralph strebbing
wrote:
> On Wed, Apr 13, 2022, 5:17 PM Andrew Bartlett <abartlet at samba.org>
> wrote:
> > On Wed, 2022-04-13 at 12:10 -0400, ralph strebbing via samba wrote:
> > 
> > Remote password changes are intended to be caught by the 'check
> > 
> > password script' and we do have tests for this.  Do you have this 
> > 
> > set identically on all DCs?
> 
> We do. Did we need to push a GPUpdate? Because we didn't do that
> while testing. Also we aren't using a wrapper script as suggested in
> Jonathon's Gitlab repo, so our parameter is defined as:
> check password script = chkastropwd --path=/opt/pwcache
> With Samba-Tool that worked fine, but perhaps we NEED a wrapper
> script for it to work?
> 
> Regards, 
> Ralph
It should work the same, but samba-tool may be running in a very
different environment to 'samba', for example in terms of a PATH.  Turn
up the logging in 'samba' via the smb.conf or (eg) -d10 to debug.
This isn't impacted by group policies and the same settings are
evaluated in both modes, indeed the same code is run (the password_hash
module is invoked in both cases and calls the same helper).

Andrew Bartlett


-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/Samba Team Member
(since 2001) https://samba.orgSamba Team Lead, Catalyst IT  
https://catalyst.net.nz/services/samba
Samba Development and Support, Catalyst IT - Expert Open SourceSolutions

On Wed, Apr 13, 2022 at 5:45 PM Andrew Bartlett <abartlet at samba.org>
wrote:
> It should work the same, but samba-tool may be running in a very different
environment to 'samba', for example in terms of a PATH.  Turn up the
logging in 'samba' via the smb.conf or (eg) -d10 to debug.
I set my log level = 10 but there is so much stuff pouring into the
logs it's a bit hard to know what I'm looking for.
I've also put the executable into a wrapper script as Jonathon did, so
my smb.conf now reads:
check password script = /etc/samba/astropwchg.sh
with the script containing the following:
#!/bin/bash

PWCACHE="--path /opt/pwcache"
LOGFILE="/opt/pwcache/pw.log"

exec /usr/local/bin/astrochkpwd $PWCACHE 2>>$LOGFILE

I also checked the logfile specified above to see if the script
returned some error, but there was nothing in the file, as if it
hadn't been called at all.
> This isn't impacted by group policies and the same settings are
evaluated in both modes, indeed the same code is run (the password_hash module
is invoked in both cases and calls the same helper).
To clarify, I'm changing the passwords via Windows Ctrl-Alt-Del Change
Password screen on an end-user host machine.

Thanks for the help so far, looking forward to anything else I can do
to diagnose this!

Regards,
Ralph