<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7226.0">
<TITLE>Re: [TLUG]: smbldap-passwd fun.</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Had a similar problem. Created a web front end that creates a change password file that a peel script looks for every 10 seconds. Not elegant but it works<BR>
D<BR>
Dave Bour<BR>
Desktop Solution Center<BR>
905.381.0077<BR>
dcbour@desktopsolutioncenter.ca<BR>
<BR>
For those who just want it to work...<BR>
Giving you complete IT peace of mind.<BR>
<BR>
(Sent via Blackberry - hence message may be shorter than my usual verbose responses)<BR>
PIN 3010A5AF (as of June 12, 2006) <BR>
<BR>
-----Original Message-----<BR>
From: owner-tlug@ss.org <owner-tlug@ss.org><BR>
To: tlug@ss.org <tlug@ss.org><BR>
Sent: Tue Jul 04 01:02:49 2006<BR>
Subject: [TLUG]: smbldap-passwd fun.<BR>
<BR>
I'm trying to get users to be able to change their passwords<BR>
(LDAP + SAMBA in one go) with smbldap-passwd; this works, but the<BR>
command has to read a file that contains the admin password to the<BR>
LDAP tree - this is a slight problem.<BR>
<BR>
SETUIDing it doesn't work, because further file-open calls are<BR>
done as the user, so permissions are an issue. sudoing doesn't work,<BR>
either, because then the user could change anyone else's password.<BR>
Annoyingly enough, I can't chmod 711 it, as the shell<BR>
complains that it can't read it; so much for being able to execute a<BR>
file without having to read it.<BR>
Further, I can't just set the users' shell to that command,<BR>
because they need to be able to ssh in and run other commands.<BR>
<BR>
About the only thing I can think of is making a custom shell<BR>
that only allows a few commands to be run (nothing that could<BR>
open/read/cat a file), or using a web-based frontend - I've heard<BR>
phpldapadmin or somesuch mentioned.<BR>
<BR>
Has anyone ever ran into such a situation/requirement?<BR>
<BR>
<BR>
Thanks in advance,<BR>
<BR>
-- Vlad<BR>
<BR>
--<BR>
end<BR>
--<BR>
The Toronto Linux Users Group. Meetings: <A HREF="http://tlug.ss.org">http://tlug.ss.org</A><BR>
TLUG requests: Linux topics, No HTML, wrap text below 80 columns<BR>
How to UNSUBSCRIBE: <A HREF="http://tlug.ss.org/subscribe.shtml">http://tlug.ss.org/subscribe.shtml</A><BR>
</FONT>
</P>
</BODY>
</HTML>