How to get user password expiration date from Active Directory?

Question

folks!

There are an Active Directory (Windows) and a Linux samba client. At the Active Directory the policy had adjusted in a such way so users need to change his passwords periodically (passwords have an expiration time).

My question is pretty simple: can I get this expiration time for the given user if I work on the Linux machine with the Samba?

Culex

Answer 1

This depends on the configuration of the domaincontroller. You can try:

net ads user info [email protected] -S DC_SERVER_NAME -U USERNAME

where [email protected] is the account to gather info from, DC_SERVER_NAME is the hostname of your domain controller and USERNAME is your username.

You will be prompted for your domain password.

Now you get either information to your account, including expiry date of your password or you get

ads_pull_uint32 failed

in this case, your domain controller is not configured to provide account information to UNIX like systems.

You may contact your domain administrator to convince him to install and configure Microsoft Windows Services for UNIX so that this command gives you the needed information.

This answer might be frustrating. It is for me as I am in the same situation and researched the topic a lot.

My workaround: I set a calendar reminder 80 days in the future, when I set my domain password (smbpasswd -U USERNAME -r DC_SERVER_NAME), since it expires every 90 days. Not perfect, but workable.

[UPDATE] I found a way to determine the expiration date of your domain password with rpcclient, here is my script:

#!/bin/bash
# author: Tim Wahrendorff 2016
# licence: Public Domain - https://wiki.creativecommons.org/wiki/Public_domain
# 
# To use this script you need at least: 
# sudo apt-get install libnotify-bin rpcclient
#
# Please set your account, password and domaincontroller to use this script


USER="username" # Domain accountname
PASS="Pa$$W0rd" # Domain password
DC="vmdc01"     # Domaincontroller

### START RPCCLIENT query
if [ "x$USERDCID" == "x" ]; then
    RPCLOOKUPID=$(rpcclient -U $USER%$PASS -c "lookupnames $USER" $DC 2> ./rpc_errFile)

    USERDCID=$(echo "$RPCLOOKUPID" | grep -e '[0-9]\{4,9\} ' -o)
fi

QUERYUSER=$(rpcclient -U $USER%$PASS -c "queryuser $USERDCID" $DC 2> ./rpc_errFile)

EXPDATE=$(echo "$QUERYUSER" | grep 'Password must change Time' | grep -e '[a-Z]\{2\}, [0-9]\{2\} [a-Z]\{3\} [0-9]\{4\} [0-9]\{2\}:[0-9]\{2\}' -o)

## Load rpc error Message
RPCERR=$(<./rpc_errFile)

## send notifications to Unity Desktop
if [ "x$RPCERR" != "x" ]; then
    notify-send -i /usr/share/icons/gnome/48x48/status/dialog-error.png "Error while fetching expiration date of your domain password" "$RPCERR"    
else
    notify-send -i /usr/share/icons/gnome/48x48/status/dialog-information.png "your domain password expires at " "$EXPDATE h"
fi

### END RPCCLIENT query

I configured this script to run on autostart, I shows me when my domain password will expire in a Unity notification. Feel free to extend, improve and republish this script, it is public domain.

[/UPDATE]

Telic

Thank you. I got the failure answer in my case. – Culex

The cause for NT_STATUS_NONE_MAPPED may be in your smb.conf. in my smb.conf, the only thing that differs from default is these addde two lines: idmap uid = 10000-20000 idmap gid = 10000-20000 – Telic

rpcclient seems not to be a package, install smbclient package instead, it includes rpcclient. – Telic

I've just tested queryuser command using username, instead of userdcid, and just worked. Btw, userdcid calculation was empty in my domain. – Taunyataupe

If you don't know your DC, you can find it by doing an SRV record lookup for _ldap._tcp.domain (and you can find the domain/realm from Samba config, e.g. /etc/samba/smb.conf), e.g. with dig -t srv _ldap._tcp.domain – Misspeak

Thanks for the tip on rpc client. However your regex gave 0 output for me. I think it is because "[a-Z]" is not recognized by bash (at least the version I am using 4.4.12). Also the number of values appeared to be off (example [a-Z\{2\} did not work, as the day appears as 3 letters). This maybe code rot, not sure. However I adjusted. Below is what I used and it worked for me. Replace Line 24 with EXPDATE=$(echo "$QUERYUSER" | grep 'Password must change Time' | grep -e '[A-Za-z]\{3\}, [0-9]\{2\} [A-Za-z]\{3\} [0-9]\{4,\} [0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\} [A-Z]\{3\}' -o) – Contactor

True, I had to adapt the regex myself, since my Company has set all the passwords to not expire anymore until the corona homeoffice is over. One might want to look at the rpcclient output directly to determine the correct regex to use, if the given regex won't work. – Telic

@mondjunge, I have been messing around with the script more. My big problem right now is rpcclient is slow.. as its setting up a tcp scoket for every query. My script is passing an array of all users. Do you know of a way to query a samba4 db directly for "Password must change time"? Or pass a list of users with rpcclient? the net ads commands did not work for me. – Contactor

Well its been close to a year, but I figured out how to use rpcclient faster! Create a command deck (text file) with "queryuser <username>" for every user you want to look up, then use rpcclient -U $USER%$PASS $DC <.users.txt. This is MUCH faster then establishing a tcp connection each time. – Contactor

@Dave: nice one, mate! – Telic

Simple and manual version of the second part: rpcclient -U my_username -c "queryuser target_username" dc_hostname. Use -U my_username%password to avoid interactive pwd prompt. – Barcellona

Answer 2

On linux you can use pdbedit

pdbedit -L -v -u <username>

And look for the line: Password must change

Karisa

This does not work with samba4. Performing a 'samba-tool domain passwordsettings set --max-pwd-age=90' forced all my users to change their passwords (As all accounts are older than 90 days). 'pdbedit' still shows "Password must change: never" while rpcclient shows the updated date / time. More info found here groups.google.com/g/linux.samba/c/D9n62kaiN14 – Contactor

Answer 3

If you are using kerberos tickets, ADpassword is a simple python app to check password expiration and ask users to change it.

ADpassword in GitHub

Felixfeliza