How to have synchronized samba passwords with local Linux accounts where Linux accounts are the leading system/authority?
This seems to be a surprisingly complex request/requirement. Since I already searched the interwebs for weeks and still yet didn't found anything that leads to the scenario I am trying to achieve.
I need to run ONE Linux Server as a compute- and file- and printserver for a specific application. Running this Server OS and App requires a higher level of password security and password policy. That is:
- minimal password length > 8
- password complexity , must contain : +UP-Char, +LC-Char, +Digit, +NonAlphanumeric-Char
- password history > 20
- cracklib dictionary
- automatic (permanent) lockout after 10 false login attempts (both! ssh and samba side)
- max password age of 180 days, with warning on login if password is supposed to be changed within 2 weeks
- min password age of 1 day
Every User requires a local Linux account on that server with a password of that quality for use with SSH Login AND SAMBA. Users access SAMBA from a Windows 10 workstation, which is member of a FOREIGN and autonomous Active Directory domain. So Windows Workstations are allowed to connect to the server via SMB/CIFS on demand, but are NOT Domain-members of that specific SAMBA Server.
Important: The user's password for SSH Login (local linux account) and the remote SAMBA access is supposed to use the same password, set by the users themselfs through "passwd" or another single command but NOT by Samba (via smb/cifs)!
I am trying to achieve this on a SuSE SLES 12 SP4 base.
NOTE: I once have achieved this on a SLES 11 server, back then when the PAM module "pam_smbpass.so" was still part of the SAMBA package, in combination with several additional PAM modules like pam_cracklib, pam_pwhistory etc. But it seems SAMBA.ORG decided for whatever reason, they are going to drop pam_smbpass.so somewhere on the way with SAMBA 4.
Question now is: How to rebuild/configure a Linux SSH+SAMBA Scenario today, with the given requirements NOT having pam_smbpass.so anymore ?
pam_winbind.so does not seem to do the same job. Other PAM modules like pam_exec.so also seem not to do the job.
Wat options are left for me now?