I think that you misunderstood my question. Unix password expiration is not an issue for me. The issue is communicating that expiration in advance to the samba users when SME is used in place of an NT PDC.
I have cooked up my own solution that works, but will need improvement over time. Using 'root preexec' in combination with a short shell script and the user-panel from Darrell May, I can notify users X days in advance of their password expiring and then have them go to a web page to maintain their password.
If this helps anyone else, here's the script:
#!/bin/bash
# This shell script is used to read the /etc/shadow file and extract
# the following information for a specific user:
#
# date password last changed (number of days since 1/1/70)
# number of days to warn of password expiration
# date password will expire (number of days since 1/1/70)
#
# Since we are working in number of days since 1/1/70, we need to
# obtain todays date with the date command and convert it to the
# number of days since 1/1/70. Once we have this, we can do some
# simple math and determine if we need to warn the user that his/her
# password is going to expire soon.
#
# We are expecting to be passed 2 arguments: a user name and a machine
# name. Any more or any less, we want to exit immediately. We will look
# for the user's name in the shadow password file and then determine how
# close we are to his/her password expiring. If we are withing the number
# of days to warn the user, we will use the smbclient program to broadcast
# a message to that user.
#
# Bob Hemedinger (rhemedinger@yahoo.com) 2/26/2002
if [ $# -ne 2 ]
then
echo "Usage: read_shadow username machine_name"
exit 1
fi
grep ^$1 /etc/shadow >> /dev/null 2>&1
if [ $? -ne 0 ]
then
echo "Username $1 not found."
exit 1
fi
#
# log the user's logon
#
echo date "User $1 logon from $2" >> /tmp/logons.txt
lastchange=grep ^$1 /etc/shadow | cut -d':' -f 3
warning=grep ^$1 /etc/shadow | cut -d':' -f 6
inactive=grep ^$1 /etc/shadow | cut -d':' -f 7
must_change=grep ^$1 /etc/shadow | cut -d':' -f 5
# Get today's date and convert it to number of days
# since 1/1/70.
today_seconds=date +%s
today_is=echo $today_seconds/86400 | bc -l | cut -d'.' -f 1
days_since_change=echo $today_is-$lastchange | bc -l | cut -d'.' -f 1
countdown=echo $must_change-$days_since_change | bc -l | cut -d'.' -f 1
if [[ ${countdown} -le ${warning} ]]
then
echo "You must change your password within $countdown day(s)!" | smbclient -M $2
fi
9 Replies
3737 Views