4

I'm using sssd to authenticate against an active directory. The passwords for the user may expire after a given time.

In sssd.conf you can set [pam] pam_pwd_expiration_warning = X to change the days a message appears prior password expiration. This works e.g. when using sudo or when logging in remotely via ssh.

Is there a way to display such a message (maybe as notification) after login?

I'm using Xubuntu 14.04. And it would really help me to see this warning at a prominent position. And the best way IMO would be directly after graphical login.

3

I managed to create a script that works for exactly my problem. Thanks to @kos for the answer - it helped me to show the dialog itself.

I wrote the script based on this solution but since dscl is not available for me I searched for another way to query the AD. This blog entry helped me to get started and find a solution to get exactly what I was looking for..

So here is my script which I then just trigger on session startup:

#!/bin/bash
pwPolicy=90
warnDays=10
user=`whoami`
userRecord=`ldapsearch -h mydomain.de -b 'dc=mydomain,dc=de' "(sAMAccountName=${user})" 2>/dev/null`
lastpwdMS=`grep -i pwdLastSet <<< "$userRecord" | sed 's/pwdLastSet: //'`
todayUnix=`date "+%s"`
lastpwdUnix=`expr $lastpwdMS / 10000000 - 11644473600`
diffUnix=`expr $todayUnix - $lastpwdUnix`
diffdays=`expr $diffUnix / 86400`
daysremaining=`expr $pwPolicy - $diffdays`

if [ "$daysremaining" -le ${warnDays} ]
then
  zenity --info --title="Password expiration" --text="The password for ${user} will expire in ${daysremaining} days."
fi

I'm not familiar with the AD but just try ldapsearch -h mydomain.de -b 'dc=mydomain,dc=de' "(sAMAccountName=${user})" 2>/dev/null if it works for you.

IMO this solution is neither pretty nor usable for other scenarios but it fixes this single problem. I'm still interested if anyone knows how to just show a dialog with the messages that would appear when logging in via ssh.

| improve this answer | |
  • No problem. The hardest thing was to get some information out of the Active Directory ... – Bertram Nudelbach Oct 30 '15 at 13:50
2

I worked out a simple desktop app for my users in order to solve this issue. It is called ADpassword.

It checks (via kerberos tickets) password expiration date and shows a dialog when days left are under a configured threshold.

You can add it to user desktop start and run it everyday.

ADpassword in Github

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.