Password Must Change using SSSD in Samba 4.1.10

[Ashish Yadav]

Hi,

I am trying to implement the *password must change at next logon* in CentOS
6.5 client using sssd 1.11.6 where Samba 4.1.10 is my backend server.

Here are the list of things which I have done,

1. I have setup the CentOS to do the Domain login using sssd service. I can
able to login into the CentOS client using Domain user's credentials from
display
and from SSH also, no problem at all.

2. Next thing which I want to implement is that password must change
feature into Samba 4.1.10 server. To do that, I have been using Windows 7
ultimate
which is already in Domain and I am using RSAT tools for users and groups
where I have a option to check "password must change at next logon" option
for particular user.
After doing that Windows machine is honoring this and telling user to
change the password and allowing user to login after changing the password.

3. As far as the CentOS client is concerned, it was not honoring the
password must change and allowing user to login without asking for password
change using sssd with current password.

Here is the configuration file of sssd service,

[sssd]
config_file_version = 2
services = nss, pam
domains = EXAMPLE
sbus_timeout = 30

[nss]
filter_users = root
filter_groups = root
reconnection_retries = 3

[pam]
reconnection_retries = 3
offline_credentials_expiration = 0

[domain/EXAMPLE]
entry_cache_timeout = 600
entry_cache_group_timeout = 600
min_id = 1000
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_schema = rfc2307bis
ldap_uri = ldap://smbad.intra.example.com:390/
ldap_search_base = dc=intra,dc=example,dc=com
cache_credentials = true
krb5_server = smbad.intra.example.com:8880
krb5_realm= INTRA.EXAMPLE.COM http://intra.example.com/

ldap_default_bind_dn = cn=admin,dc=intra,dc=example,dc=com

ldap_default_authtok_type = password
ldap_default_authtok = 6pNEn7Eo3zmz9MxciGLx

4. I have also tried to achieve above thing using command line tool
"pdbedit" but without any luck. Here is the link <
http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html#pdbed...
>

which I have followed.

Please share your thoughts in order to help me and move forward to solve
this problem.

Thanks very much and regards,
Ashishkumar S. Yadav

[Sumit Bose]

On Wed, Jan 07, 2015 at 03:48:16PM +0530, Ashish Yadav wrote:
> Hi,
>
> I am trying to implement the *password must change at next logon* in CentOS
> 6.5 client using sssd 1.11.6 where Samba 4.1.10 is my backend server.
>
> Here are the list of things which I have done,
> I have setup the CentOS to do the Domain login using sssd service. I can
>
> able to login into the CentOS client using Domain user's credentials from
> display
> and from SSH also, no problem at all.
> Next thing which I want to implement is that password must change
>
> feature into Samba 4.1.10 server. To do that, I have been using Windows 7
> ultimate
> which is already in Domain and I am using RSAT tools for users and groups
> where I have a option to check "password must change at next logon" option
> for particular user.
> After doing that Windows machine is honoring this and telling user to
> change the password and allowing user to login after changing the password.
> As far as the CentOS client is concerned, it was not honoring the
>
> password must change and allowing user to login without asking for password
> change using sssd with current password.
>
> Here is the configuration file of sssd service,
>
> [sssd]
> config_file_version = 2
> services = nss, pam
> domains = EXAMPLE
> sbus_timeout = 30
>
> [nss]
> filter_users = root
> filter_groups = root
> reconnection_retries = 3
>
> [pam]
> reconnection_retries = 3
> offline_credentials_expiration = 0
>
> [domain/EXAMPLE]
> entry_cache_timeout = 600
> entry_cache_group_timeout = 600
> min_id = 1000
> id_provider = ldap
> auth_provider = krb5
> chpass_provider = krb5
> ldap_schema = rfc2307bis
> ldap_uri = ldap://smbad.intra.example.com:390/
> ldap_search_base = dc=intra,dc=example,dc=com
> cache_credentials = true
> krb5_server = smbad.intra.example.com:8880
> krb5_realm= INTRA.EXAMPLE.COM http://intra.example.com/
>
> ldap_default_bind_dn = cn=admin,dc=intra,dc=example,dc=com
>
> ldap_default_authtok_type = password
> ldap_default_authtok = 6pNEn7Eo3zmz9MxciGLx
> I have also tried to achieve above thing using command line tool
>
> "pdbedit" but without any luck. Here is the link <
> http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html#pdbed...
> >
>
> which I have followed.
>
> Please share your thoughts in order to help me and move forward to solve
> this problem.

What happens if you call

kinit [e-mail]

on the Linux command line. Are you asekd you for new password here? If
not Samba might not return the right error code to indicate that the
password is expired. In this case it would be nice if you can send the
output of

KRB5_TRACE=/dev/stdout  kinit [e-mail]

bye,
Sumit
> Thanks very much and regards,
> Ashishkumar S. Yadav
> sssd-users mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users

[Ashish Yadav]

Hi,
> What happens if you call
>
> kinit [e-mail]

It asks for password and current password is working for getting kerberos
ticket and not asking me to reset the password.
> on the Linux command line. Are you asekd you for new password here? If
> not Samba might not return the right error code to indicate that the
> password is expired.

I posted this query in samba mailing list also but they told me that if
Windows 7 client is working fine then Samba is working fine.
> In this case it would be nice if you can send the
> output of
>
> KRB5_TRACE=/dev/stdout  kinit [e-mail]

Here is the output of the above command,

# KRB5_TRACE=/dev/stdout  kinit test
[2507] 1420693228.971649: Getting initial credentials for
[e-mail]
[2507] 1420693228.974468: Sending request (210 bytes) to INTRA.EXAMPLE.COM
[2507] 1420693228.976230: Sending initial UDP request to dgram
172.16.0.170:8880
[2507] 1420693228.981059: Received answer from dgram 172.16.0.170:8880
[2507] 1420693228.981167: Response was not from master KDC
[2507] 1420693228.981252: Received error from KDC: -1765328359/Additional
pre-authentication required
[2507] 1420693228.981413: Processing preauth types: 16, 15, 2, 138, 136,
11, 19
[2507] 1420693228.981477: Selected etype info: etype rc4-hmac, salt
"INTRA.EXAMPLE.COMtest", params ""
[2507] 1420693228.981532: Selected etype info: etype rc4-hmac, salt
"INTRA.EXAMPLE.COMtest", params ""
Password for [e-mail]:
[2507] 1420693231.111979: AS key obtained for encrypted timestamp:
rc4-hmac/3CC1
[2507] 1420693231.112235: Encrypted timestamp (for 1420693231.112064):
plain 301AA011180F32303135303130383035303033315AA105020301B5C0, encrypted
F92A0E3BEF336E51C24C4CB9E8EB1ACE49ECA2BE32C9ABD207062898FD593268EEA31CF0185BE2B2B05F3A4A47328E9B1149AFA0
[2507] 1420693231.112272: Preauth module encrypted_timestamp (2) (flags=1)
returned: 0/Success
[2507] 1420693231.112292: Produced preauth for next request: 2
[2507] 1420693231.112341: Sending request (286 bytes) to INTRA.EXAMPLE.COM
[2507] 1420693231.112611: Sending initial UDP request to dgram
172.16.0.170:8880
[2507] 1420693231.116296: Received answer from dgram 172.16.0.170:8880
[2507] 1420693231.116448: Response was not from master KDC
[2507] 1420693231.116573: Processing preauth types: 3
[2507] 1420693231.116586: Received salt "��" via padata type 3
[2507] 1420693231.116597: Produced preauth for next request: (empty)
[2507] 1420693231.116616: AS key determined by preauth: rc4-hmac/3CC1
[2507] 1420693231.116694: Decrypted AS reply; session key is: rc4-hmac/4D55
[2507] 1420693231.116724: FAST negotiation: available
[2507] 1420693231.116729: Initializing FILE:/tmp/krb5cc_0 with default
princ [e-mail]
[2507] 1420693231.117523: Removing [e-mail] -> krbtgt/
[e-mail] from FILE:/tmp/krb5cc_0
[2507] 1420693231.117542: Storing [e-mail] -> krbtgt/
[e-mail] in FILE:/tmp/krb5cc_0
[2507] 1420693231.117710: Storing config in FILE:/tmp/krb5cc_0 for krbtgt/
[e-mail]: fast_avail: yes
[2507] 1420693231.117903: Removing [e-mail] ->
krb5_ccache_conf_data/fast_avail/krbtgt/INTRA.EXAMPLE.COM
@INTRA.EXAMPLE.COM@X-CACHECONF: from FILE:/tmp/krb5cc_0
[2507] 1420693231.117920: Storing [e-mail] ->
krb5_ccache_conf_data/fast_avail/krbtgt/INTRA.EXAMPLE.COM
@INTRA.EXAMPLE.COM@X-CACHECONF: in FILE:/tmp/krb5cc_0

--Regards
Ashishkumar S. Yadav

[Rowland Penny]

On 08/01/15 05:09, Ashish Yadav wrote:
> Hi,
> What happens if you call
>
> kinit [e-mail] <mailto:[e-mail]>
>
>
> It asks for password and current password is working for getting 
> kerberos ticket and not asking me to reset the password.
> on the Linux command line. Are you asekd you for new password here? If
> not Samba might not return the right error code to indicate that the
> password is expired. 
>
>
> I posted this query in samba mailing list also but they told me that 
> if Windows 7 client is working fine then Samba is working fine.

No you weren't, you were told that you might have a better chance of 
getting it fixed on the sssd list because it worked from a windows 
client, so this meant it was *probably* a sssd problem, it may in the 
end turn out to be a samba problem, but sssd needs ruling out first and 
as I pointed out to you on the samba list, sssd is not part of samba.

Rowland
> In this case it would be nice if you can send the
> output of
>
> KRB5_TRACE=/dev/stdout  kinit [e-mail]
> <mailto:[e-mail]>
>
>
> Here is the output of the above command,
>
> # KRB5_TRACE=/dev/stdout  kinit test
> [2507] 1420693228.971649: Getting initial credentials for 
> [e-mail] 
> [2507] 1420693228.974468: Sending request (210 bytes) to 
> INTRA.EXAMPLE.COM http://INTRA.EXAMPLE.COM
> [2507] 1420693228.976230: Sending initial UDP request to dgram 
> 172.16.0.170:8880 http://172.16.0.170:8880
> [2507] 1420693228.981059: Received answer from dgram 172.16.0.170:8880 
> http://172.16.0.170:8880
> [2507] 1420693228.981167: Response was not from master KDC
> [2507] 1420693228.981252: Received error from KDC: 
> -1765328359/Additional pre-authentication required
> [2507] 1420693228.981413: Processing preauth types: 16, 15, 2, 138, 
> 136, 11, 19
> [2507] 1420693228.981477: Selected etype info: etype rc4-hmac, salt 
> "INTRA.EXAMPLE.COMtest", params ""
> [2507] 1420693228.981532: Selected etype info: etype rc4-hmac, salt 
> "INTRA.EXAMPLE.COMtest", params ""
> Password for [e-mail] :
> [2507] 1420693231.111979: AS key obtained for encrypted timestamp: 
> rc4-hmac/3CC1
> [2507] 1420693231.112235: Encrypted timestamp (for 1420693231.112064): 
> plain 301AA011180F32303135303130383035303033315AA105020301B5C0, 
> encrypted 
> F92A0E3BEF336E51C24C4CB9E8EB1ACE49ECA2BE32C9ABD207062898FD593268EEA31CF0185BE2B2B05F3A4A47328E9B1149AFA0
> [2507] 1420693231.112272: Preauth module encrypted_timestamp (2) 
> (flags=1) returned: 0/Success
> [2507] 1420693231.112292: Produced preauth for next request: 2
> [2507] 1420693231.112341: Sending request (286 bytes) to 
> INTRA.EXAMPLE.COM http://INTRA.EXAMPLE.COM
> [2507] 1420693231.112611: Sending initial UDP request to dgram 
> 172.16.0.170:8880 http://172.16.0.170:8880
> [2507] 1420693231.116296: Received answer from dgram 172.16.0.170:8880 
> http://172.16.0.170:8880
> [2507] 1420693231.116448: Response was not from master KDC
> [2507] 1420693231.116573: Processing preauth types: 3
> [2507] 1420693231.116586: Received salt "��" via padata type 3
> [2507] 1420693231.116597: Produced preauth for next request: (empty)
> [2507] 1420693231.116616: AS key determined by preauth: rc4-hmac/3CC1
> [2507] 1420693231.116694: Decrypted AS reply; session key is: 
> rc4-hmac/4D55
> [2507] 1420693231.116724: FAST negotiation: available
> [2507] 1420693231.116729: Initializing FILE:/tmp/krb5cc_0 with default 
> princ [e-mail] 
> [2507] 1420693231.117523: Removing [e-mail] 
>  -> 
> krbtgt/[e-mail] 
>  from FILE:/tmp/krb5cc_0
> [2507] 1420693231.117542: Storing [e-mail] 
>  -> 
> krbtgt/[e-mail] 
>  in FILE:/tmp/krb5cc_0
> [2507] 1420693231.117710: Storing config in FILE:/tmp/krb5cc_0 for 
> krbtgt/[e-mail] 
> : fast_avail: yes
> [2507] 1420693231.117903: Removing [e-mail] 
>  -> 
> krb5_ccache_conf_data/fast_avail/krbtgt/INTRA.EXAMPLE.COM 
> http://[e-mail]@X-CACHECONF: from 
> FILE:/tmp/krb5cc_0
> [2507] 1420693231.117920: Storing [e-mail] 
>  -> 
> krb5_ccache_conf_data/fast_avail/krbtgt/INTRA.EXAMPLE.COM 
> http://[e-mail]@X-CACHECONF: in 
> FILE:/tmp/krb5cc_0
>
> --Regards
> Ashishkumar S. Yadav
>
> sssd-users mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users

[Sumit Bose]

On Thu, Jan 08, 2015 at 10:39:36AM +0530, Ashish Yadav wrote:
> Hi,
> > What happens if you call
> >
> > kinit [e-mail]
>
> It asks for password and current password is working for getting kerberos
> ticket and not asking me to reset the password.
> > on the Linux command line. Are you asekd you for new password here? If
> > not Samba might not return the right error code to indicate that the
> > password is expired.
>
> I posted this query in samba mailing list also but they told me that if
> Windows 7 client is working fine then Samba is working fine.
> > In this case it would be nice if you can send the
> > output of
> >
> > KRB5_TRACE=/dev/stdout  kinit [e-mail]
>
> Here is the output of the above command,
>
> # KRB5_TRACE=/dev/stdout  kinit test
> [2507] 1420693228.971649: Getting initial credentials for
> [e-mail]
> [2507] 1420693228.974468: Sending request (210 bytes) to INTRA.EXAMPLE.COM
> [2507] 1420693228.976230: Sending initial UDP request to dgram
> 172.16.0.170:8880
> [2507] 1420693228.981059: Received answer from dgram 172.16.0.170:8880
> [2507] 1420693228.981167: Response was not from master KDC
> [2507] 1420693228.981252: Received error from KDC: -1765328359/Additional
> pre-authentication required
> [2507] 1420693228.981413: Processing preauth types: 16, 15, 2, 138, 136,
> 11, 19
> [2507] 1420693228.981477: Selected etype info: etype rc4-hmac, salt
> "INTRA.EXAMPLE.COMtest", params ""
> [2507] 1420693228.981532: Selected etype info: etype rc4-hmac, salt
> "INTRA.EXAMPLE.COMtest", params ""
> Password for [e-mail]:
> [2507] 1420693231.111979: AS key obtained for encrypted timestamp:
> rc4-hmac/3CC1
> [2507] 1420693231.112235: Encrypted timestamp (for 1420693231.112064):
> plain 301AA011180F32303135303130383035303033315AA105020301B5C0, encrypted
> F92A0E3BEF336E51C24C4CB9E8EB1ACE49ECA2BE32C9ABD207062898FD593268EEA31CF0185BE2B2B05F3A4A47328E9B1149AFA0
> [2507] 1420693231.112272: Preauth module encrypted_timestamp (2) (flags=1)
> returned: 0/Success
> [2507] 1420693231.112292: Produced preauth for next request: 2
> [2507] 1420693231.112341: Sending request (286 bytes) to INTRA.EXAMPLE.COM
> [2507] 1420693231.112611: Sending initial UDP request to dgram
> 172.16.0.170:8880
> [2507] 1420693231.116296: Received answer from dgram 172.16.0.170:8880
> [2507] 1420693231.116448: Response was not from master KDC

Thank you for the output. When I run kinit against a Windows DC I get

[10020] 1420716572.35107: Received error from KDC: -1765328361/Password has expired

which lets the client know that the password is expired and must be
renewed which kinit and SSSD does correctly when talking to a Windows
server. Since Windows clients do not use only plain Kerberos for
authentication they might get the information that the password must be
renewed by other means.

I will talk to Samba developers to see if Samba can be changed to behave
link a Windows DC here and will let you know the result.

bye,
Sumit
> [2507] 1420693231.116573: Processing preauth types: 3
> [2507] 1420693231.116586: Received salt "��" via padata type 3
> [2507] 1420693231.116597: Produced preauth for next request: (empty)
> [2507] 1420693231.116616: AS key determined by preauth: rc4-hmac/3CC1
> [2507] 1420693231.116694: Decrypted AS reply; session key is: rc4-hmac/4D55
> [2507] 1420693231.116724: FAST negotiation: available
> [2507] 1420693231.116729: Initializing FILE:/tmp/krb5cc_0 with default
> princ [e-mail]
> [2507] 1420693231.117523: Removing [e-mail] -> krbtgt/
> [e-mail] from FILE:/tmp/krb5cc_0
> [2507] 1420693231.117542: Storing [e-mail] -> krbtgt/
> [e-mail] in FILE:/tmp/krb5cc_0
> [2507] 1420693231.117710: Storing config in FILE:/tmp/krb5cc_0 for krbtgt/
> [e-mail]: fast_avail: yes
> [2507] 1420693231.117903: Removing [e-mail] ->
> krb5_ccache_conf_data/fast_avail/krbtgt/INTRA.EXAMPLE.COM
> @INTRA.EXAMPLE.COM@X-CACHECONF: from FILE:/tmp/krb5cc_0
> [2507] 1420693231.117920: Storing [e-mail] ->
> krb5_ccache_conf_data/fast_avail/krbtgt/INTRA.EXAMPLE.COM
> @INTRA.EXAMPLE.COM@X-CACHECONF: in FILE:/tmp/krb5cc_0
>
> --Regards
> Ashishkumar S. Yadav
> sssd-users mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users