3 # Sets password settings (Password complexity, history length, minimum password
4 # length, the minimum and maximum password age) on a Samba4 server
6 # Copyright Matthias Dieter Wallnoefer 2009
7 # Copyright Andrew Kroeger 2009
9 # This program is free software; you can redistribute it and/or modify
10 # it under the terms of the GNU General Public License as published by
11 # the Free Software Foundation; either version 3 of the License, or
12 # (at your option) any later version.
14 # This program is distributed in the hope that it will be useful,
15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 # GNU General Public License for more details.
19 # You should have received a copy of the GNU General Public License
20 # along with this program. If not, see <http://www.gnu.org/licenses/>.
25 # Find right directory when running from source tree
26 sys
.path
.insert(0, "bin/python")
28 import samba
.getopt
as options
32 from samba
.auth
import system_session
33 from samba
.samdb
import SamDB
34 from samba
.dcerpc
.samr
import DOMAIN_PASSWORD_COMPLEX
36 parser
= optparse
.OptionParser("pwsettings (show | set <options>)")
37 sambaopts
= options
.SambaOptions(parser
)
38 parser
.add_option_group(sambaopts
)
39 parser
.add_option_group(options
.VersionOptions(parser
))
40 credopts
= options
.CredentialsOptions(parser
)
41 parser
.add_option_group(credopts
)
42 parser
.add_option("--quiet", help="Be quiet", action
="store_true")
43 parser
.add_option("--complexity",
44 help="The password complexity (on | off | default). Default is 'on'", type=str)
45 parser
.add_option("--history-length",
46 help="The password history length (<integer> | default). Default is 24.", type=str)
47 parser
.add_option("--min-pwd-length",
48 help="The minimum password length (<integer> | default). Default is 7.", type=str)
49 parser
.add_option("--min-pwd-age",
50 help="The minimum password age (<integer in days> | default). Default is 0.", type=str)
51 parser
.add_option("--max-pwd-age",
52 help="The maximum password age (<integer in days> | default). Default is 43.", type=str)
54 opts
, args
= parser
.parse_args()
57 # print a message if quiet is not set
67 lp
= sambaopts
.get_loadparm()
68 creds
= credopts
.get_credentials(lp
)
70 samdb
= SamDB(url
=lp
.get("sam database"), session_info
=system_session(),
71 credentials
=creds
, lp
=lp
)
73 domain_dn
= SamDB
.domain_dn(samdb
)
74 res
= samdb
.search(domain_dn
, scope
=ldb
.SCOPE_BASE
,
75 attrs
=["pwdProperties", "pwdHistoryLength", "minPwdLength", "minPwdAge",
79 pwd_props
= int(res
[0]["pwdProperties"][0])
80 pwd_hist_len
= int(res
[0]["pwdHistoryLength"][0])
81 min_pwd_len
= int(res
[0]["minPwdLength"][0])
83 min_pwd_age
= int(abs(int(res
[0]["minPwdAge"][0])) / (1e7
* 60 * 60 * 24))
84 max_pwd_age
= int(abs(int(res
[0]["maxPwdAge"][0])) / (1e7
* 60 * 60 * 24))
86 print "ERROR: Could not retrieve password properties!"
88 print "So no settings can be displayed!"
92 message("Password informations for domain '" + domain_dn
+ "'")
94 if pwd_props
& DOMAIN_PASSWORD_COMPLEX
!= 0:
95 message("Password complexity: on")
97 message("Password complexity: off")
98 message("Password history length: " + str(pwd_hist_len
))
99 message("Minimum password length: " + str(min_pwd_len
))
100 message("Minimum password age (days): " + str(min_pwd_age
))
101 message("Maximum password age (days): " + str(max_pwd_age
))
103 elif args
[0] == "set":
107 m
.dn
= ldb
.Dn(samdb
, domain_dn
)
109 if opts
.complexity
is not None:
110 if opts
.complexity
== "on" or opts
.complexity
== "default":
111 pwd_props
= pwd_props | DOMAIN_PASSWORD_COMPLEX
112 msgs
.append("Password complexity activated!")
113 elif opts
.complexity
== "off":
114 pwd_props
= pwd_props
& (~DOMAIN_PASSWORD_COMPLEX
)
115 msgs
.append("Password complexity deactivated!")
117 print "ERROR: Wrong argument '" + opts
.complexity
+ "'!"
120 m
["pwdProperties"] = ldb
.MessageElement(str(pwd_props
),
121 ldb
.FLAG_MOD_REPLACE
, "pwdProperties")
123 if opts
.history_length
is not None:
124 if opts
.history_length
== "default":
127 pwd_hist_len
= int(opts
.history_length
)
129 if pwd_hist_len
< 0 or pwd_hist_len
> 24:
130 print "ERROR: Password history length must be in the range of 0 to 24!"
133 m
["pwdHistoryLength"] = ldb
.MessageElement(str(pwd_hist_len
),
134 ldb
.FLAG_MOD_REPLACE
, "pwdHistoryLength")
135 msgs
.append("Password history length changed!")
137 if opts
.min_pwd_length
is not None:
138 if opts
.min_pwd_length
== "default":
141 min_pwd_len
= int(opts
.min_pwd_length
)
143 if min_pwd_len
< 0 or min_pwd_len
> 14:
144 print "ERROR: Minimum password length must be in the range of 0 to 14!"
147 m
["minPwdLength"] = ldb
.MessageElement(str(min_pwd_len
),
148 ldb
.FLAG_MOD_REPLACE
, "minPwdLength")
149 msgs
.append("Minimum password length changed!")
151 if opts
.min_pwd_age
is not None:
152 if opts
.min_pwd_age
== "default":
155 min_pwd_age
= int(opts
.min_pwd_age
)
157 if min_pwd_age
< 0 or min_pwd_age
> 998:
158 print "ERROR: Minimum password age must be in the range of 0 to 998!"
162 min_pwd_age_ticks
= -int(min_pwd_age
* (24 * 60 * 60 * 1e7
))
164 m
["minPwdAge"] = ldb
.MessageElement(str(min_pwd_age_ticks
),
165 ldb
.FLAG_MOD_REPLACE
, "minPwdAge")
166 msgs
.append("Minimum password age changed!")
168 if opts
.max_pwd_age
is not None:
169 if opts
.max_pwd_age
== "default":
172 max_pwd_age
= int(opts
.max_pwd_age
)
174 if max_pwd_age
< 0 or max_pwd_age
> 999:
175 print "ERROR: Maximum password age must be in the range of 0 to 999!"
179 max_pwd_age_ticks
= -int(max_pwd_age
* (24 * 60 * 60 * 1e7
))
181 m
["maxPwdAge"] = ldb
.MessageElement(str(max_pwd_age_ticks
),
182 ldb
.FLAG_MOD_REPLACE
, "maxPwdAge")
183 msgs
.append("Maximum password age changed!")
185 if max_pwd_age
> 0 and min_pwd_age
>= max_pwd_age
:
186 print "ERROR: Maximum password age (%d) must be greater than minimum password age (%d)!" % (max_pwd_age
, min_pwd_age
)
191 msgs
.append("All changes applied successfully!")
193 message("\n".join(msgs
))
195 print "ERROR: Wrong argument '" + args
[0] + "'!"