I have a Red Hat Enterprise Linux VM which has been integrated with Windows AD using Kerberos and Winbind. It all works, bar one feature. In AD, I can reset the users password and select the option 'User must change password on next logon'. When I use this account to logon to Windows, I am obviously prompted to change the password. When I login via Linux (SSH) I am not prompted to change it. How can set this up so Linux prompts the user based on this option from AD:
You haven't made it clear what version of RHEL you're using. I will assume you are using a supported version (6.8 or 7.3).
First thing's first, winbind does not support password changes, at least not natively. You can maybe make a pam configuration change to assist in this, but you may run into the dreaded
The change of the authentication token failed error.
To make your life simpler, I highly suggest using
adcli/realm to work with Active Directory. If using 7.3, you will have the
realm command, which will automatically setup
krb5.conf, and your
pam.d configurations in a sane manner. On 6.8, you will only have
adcli, which will require some manual configuration changes on your part or using the
authconfig command to setup sane defaults. Users that need their passwords changed will be prompted and it will work when using this method. It is supported and is recommended by Red Hat to use
sssd and the