One interesting feature in Active Directory, is the ability to -create a new user with an expired password, and thus force the user to -change the password on the first login attempt.
- -I'm not quite sure how to do that with the LDAP setup in Debian -Edu, but did some initial testing with a local account. The account -and password aging information is available in /etc/shadow, but -unfortunately, it is not possible to specify an expiration time for -passwords, only a maximum age for passwords.
- -A freshly created account (using adduser test) will have these -settings in /etc/shadow:
- -- --root@tjener:~# chage -l test -Last password change : May 02, 2010 -Password expires : never -Password inactive : never -Account expires : never -Minimum number of days between password change : 0 -Maximum number of days between password change : 99999 -Number of days of warning before password expires : 7 -root@tjener:~# -
The only way I could come up with to create a user with an expired -account, is to change the date of the last password change to the -lowest value possible (January 1th 1970), and the maximum password age -to the difference in days between that date and today. To make it -simple, I went for 30 years (30 * 365 = 10950) and January 2th (to -avoid testing if 0 is a valid value).
- -After using these commands to set it up, it seem to work as -intended:
- -- --root@tjener:~# chage -d 1 test; chage -M 10950 test -root@tjener:~# chage -l test -Last password change : Jan 02, 1970 -Password expires : never -Password inactive : never -Account expires : never -Minimum number of days between password change : 0 -Maximum number of days between password change : 10950 -Number of days of warning before password expires : 7 -root@tjener:~# -
So far I have tested this with ssh and console, and kdm (in -Squeeze) login, and all ask for a new password before login in the -user (with ssh, I was thrown out and had to log in again).
- -Perhaps we should set up something similar for Debian Edu, to make -sure only the user itself have the account password?
- -If you want to comment on or help out with implementing this for -Debian Edu, please contact us on debian-edu@lists.debian.org.
- -Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the -shadow(8) page in Debian/testing now state that setting the date of -last password change to zero (0) will force the password to be changed -on the first login. This was not mentioned in the manual in Lenny, so -I did not notice this in my initial testing. I have tested it on -Squeeze, and 'chage -d 0 username' do work there. I have not -tested it on Lenny yet.
- -Update 2010-05-02-19:05: Jim Paris tells me via email that an -equivalent command to expire a password is 'passwd -e -username', which insert zero into the date of the last password -change.
+For ca. et og et halvt år siden +startet +jeg på et kart over overvåkningskamera i Norge, i regi av +personvernforeningen. Det har +blitt oppdatert regelmessing, og jeg oppdaterte det nettopp. Fra den +spede start med 22 kamera registrert er det nå registrert 54 kamera. +Det er bare en brøkdel av de kamera som finnes i Norge, men det går +sakte men sikkert i riktig retning.
+ +Informasjonen registreres fortsatt direkte inn i +OpenStreetmap, og hentes +automatisk over i + +når jeg kjører et script for å filtrere ut overvåkningskamera fra +OSM-dumpen for Norge.