3 # Sets password settings.
4 # (Password complexity, history length, minimum password length, the minimum
5 # and maximum password age) on a Samba4 server
7 # Copyright Matthias Dieter Wallnoefer 2009
8 # Copyright Andrew Kroeger 2009
9 # Copyright Jelmer Vernooij 2009
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 # GNU General Public License for more details.
21 # You should have received a copy of the GNU General Public License
22 # along with this program. If not, see <http://www.gnu.org/licenses/>.
27 import samba
.getopt
as options
31 from samba
.auth
import system_session
32 from samba
.samdb
import SamDB
33 from samba
.dcerpc
.samr
import DOMAIN_PASSWORD_COMPLEX
34 from samba
.netcmd
import Command
, CommandError
, Option
36 class cmd_pwsettings(Command
):
37 """Sets password settings.
39 Password complexity, history length, minimum password length, the minimum
40 and maximum password age) on a Samba4 server.
43 synopsis
= "(show | set <options>)"
45 takes_optiongroups
= {
46 "sambaopts": options
.SambaOptions
,
47 "versionopts": options
.VersionOptions
,
48 "credopts": options
.CredentialsOptions
,
52 Option("-H", help="LDB URL for database or target server", type=str),
53 Option("--quiet", help="Be quiet", action
="store_true"),
54 Option("--complexity", type="choice", choices
=["on","off","default"],
55 help="The password complexity (on | off | default). Default is 'on'"),
56 Option("--history-length",
57 help="The password history length (<integer> | default). Default is 24.", type=str),
58 Option("--min-pwd-length",
59 help="The minimum password length (<integer> | default). Default is 7.", type=str),
60 Option("--min-pwd-age",
61 help="The minimum password age (<integer in days> | default). Default is 0.", type=str),
62 Option("--max-pwd-age",
63 help="The maximum password age (<integer in days> | default). Default is 43.", type=str),
66 takes_args
= ["subcommand"]
68 def run(self
, subcommand
, H
=None, min_pwd_age
=None, max_pwd_age
=None,
69 quiet
=False, complexity
=None, history_length
=None,
70 min_pwd_length
=None, credopts
=None, sambaopts
=None,
72 lp
= sambaopts
.get_loadparm()
73 creds
= credopts
.get_credentials(lp
)
78 url
= lp
.get("sam database")
80 samdb
= SamDB(url
=url
, session_info
=system_session(),
81 credentials
=creds
, lp
=lp
)
83 domain_dn
= SamDB
.domain_dn(samdb
)
84 res
= samdb
.search(domain_dn
, scope
=ldb
.SCOPE_BASE
,
85 attrs
=["pwdProperties", "pwdHistoryLength", "minPwdLength",
86 "minPwdAge", "maxPwdAge"])
89 pwd_props
= int(res
[0]["pwdProperties"][0])
90 pwd_hist_len
= int(res
[0]["pwdHistoryLength"][0])
91 min_pwd_len
= int(res
[0]["minPwdLength"][0])
93 min_pwd_age
= int(abs(int(res
[0]["minPwdAge"][0])) / (1e7
* 60 * 60 * 24))
94 max_pwd_age
= int(abs(int(res
[0]["maxPwdAge"][0])) / (1e7
* 60 * 60 * 24))
96 raise CommandError("Could not retrieve password properties!")
98 if subcommand
== "show":
99 self
.message("Password informations for domain '%s'" % domain_dn
)
101 if pwd_props
& DOMAIN_PASSWORD_COMPLEX
!= 0:
102 self
.message("Password complexity: on")
104 self
.message("Password complexity: off")
105 self
.message("Password history length: %d" % pwd_hist_len
)
106 self
.message("Minimum password length: %d" % min_pwd_len
)
107 self
.message("Minimum password age (days): %d" % min_pwd_age
)
108 self
.message("Maximum password age (days): %d" % max_pwd_age
)
109 elif subcommand
== "set":
112 m
.dn
= ldb
.Dn(samdb
, domain_dn
)
114 if complexity
is not None:
115 if complexity
== "on" or complexity
== "default":
116 pwd_props
= pwd_props | DOMAIN_PASSWORD_COMPLEX
117 msgs
.append("Password complexity activated!")
118 elif complexity
== "off":
119 pwd_props
= pwd_props
& (~DOMAIN_PASSWORD_COMPLEX
)
120 msgs
.append("Password complexity deactivated!")
122 m
["pwdProperties"] = ldb
.MessageElement(str(pwd_props
),
123 ldb
.FLAG_MOD_REPLACE
, "pwdProperties")
125 if history_length
is not None:
126 if history_length
== "default":
129 pwd_hist_len
= int(history_length
)
131 if pwd_hist_len
< 0 or pwd_hist_len
> 24:
132 raise CommandError("Password history length must be in the range of 0 to 24!")
134 m
["pwdHistoryLength"] = ldb
.MessageElement(str(pwd_hist_len
),
135 ldb
.FLAG_MOD_REPLACE
, "pwdHistoryLength")
136 msgs
.append("Password history length changed!")
138 if min_pwd_length
is not None:
139 if min_pwd_length
== "default":
142 min_pwd_len
= int(min_pwd_length
)
144 if min_pwd_len
< 0 or min_pwd_len
> 14:
145 raise CommandError("Minimum password length must be in the range of 0 to 14!")
147 m
["minPwdLength"] = ldb
.MessageElement(str(min_pwd_len
),
148 ldb
.FLAG_MOD_REPLACE
, "minPwdLength")
149 msgs
.append("Minimum password length changed!")
151 if min_pwd_age
is not None:
152 if min_pwd_age
== "default":
155 min_pwd_age
= int(min_pwd_age
)
157 if min_pwd_age
< 0 or min_pwd_age
> 998:
158 raise CommandError("Minimum password age must be in the range of 0 to 998!")
161 min_pwd_age_ticks
= -int(min_pwd_age
* (24 * 60 * 60 * 1e7
))
163 m
["minPwdAge"] = ldb
.MessageElement(str(min_pwd_age_ticks
),
164 ldb
.FLAG_MOD_REPLACE
, "minPwdAge")
165 msgs
.append("Minimum password age changed!")
167 if max_pwd_age
is not None:
168 if max_pwd_age
== "default":
171 max_pwd_age
= int(max_pwd_age
)
173 if max_pwd_age
< 0 or max_pwd_age
> 999:
174 raise CommandError("Maximum password age must be in the range of 0 to 999!")
177 max_pwd_age_ticks
= -int(max_pwd_age
* (24 * 60 * 60 * 1e7
))
179 m
["maxPwdAge"] = ldb
.MessageElement(str(max_pwd_age_ticks
),
180 ldb
.FLAG_MOD_REPLACE
, "maxPwdAge")
181 msgs
.append("Maximum password age changed!")
183 if max_pwd_age
> 0 and min_pwd_age
>= max_pwd_age
:
184 raise CommandError("Maximum password age (%d) must be greater than minimum password age (%d)!" % (max_pwd_age
, min_pwd_age
))
187 msgs
.append("All changes applied successfully!")
188 self
.message("\n".join(msgs
))
190 raise CommandError("Wrong argument '%s'!" % subcommand
)