On Wed, 2 May 2001, Andrew Bartlett wrote: > Note that the reverse is similarly untested and needs some serious > debugging. That is, when we have the plaintext I'm not sure we have > sufficient privilage to update the database, nor that the PAM module > knows that we are a normal user that needs the old password. (We still > authenticate them against smbpasswd however.). Honestly, there are never any guarantees you will be able to call pam_chauthtok() successfully when there's no way to get additional information from the user. It all depends on the PAM modules used on the system. You may only need root privilege in order to change the password (pam_unix, pam_pwdb). You may need the user's current password (pam_krb4, pam_krb5, pam_ldap?). You may also need to provide the user's grandmother's maiden name in order to change passwords, in which case it'll never work from Samba (unless Samba can prompt the user for this information during a password change? :). This being the case, Samba should always 1) authenticate the user to its own satisfaction before calling pam_chauthtok, 2) assume maximum system creds (become_root()) before invoking PAM, and 3) be prepared to deal gracefully with a permission denied error from the password changing function. Steve Langasek postmodern programmer
