Bug 6309

Summary:	samba ignores account expiration when using encrypted(SMB) passwords
Product:	[Retired] Red Hat Linux	Reporter:	Mario Lorenz <ml>
Component:	samba	Assignee:	Trond Eivind Glomsrxd <teg>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	low
Version:	6.1	CC:	creebain, henris
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2000-09-14 07:21:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mario Lorenz 1999-10-24 16:49:55 UTC

Even after account expiration (as per /etc/shadow) that user
can use samba resources if encrypt passwords is set to yes
(to accomodate Win98 users). If not using encrypted
passwords, account expiration works as expected (thanks to
PAM, I guess).

Workaround would be not to use encryption.. But then (fear!)
I would have to change registry settings on all the Win
clients.......

Comment 1 Andrew Bartlett 2000-09-14 07:21:03 UTC

This is becouse samba does not use PAM when checking encryped passwords.

A better approach would be the one used by OpenSSH, still using PAM despite
having a RSA authentication.

Comment 2 Henri Schlereth 2001-01-21 13:45:46 UTC

The current version(s) of Samba now use PAM. Please try a newer version and if the problem still exists re-open this bug report.

Comment 3 Andrew Bartlett 2001-01-28 13:49:18 UTC

No release of Samba will involve PAM in the checking of ANYTHING if encrypted
passwords are used, hence the problem.  Currently all PAM is allowed to do is to
say yea or nea to a particular username/password pair, and only if the
plain-text password is available.  (Account disabling is then caught as it
checks the account module in the same process).