localized pam == no samba password changing

[Steve Langasek]

Binary package hint: samba

To apply password change requests from Samba clients to system passwords and not just to Samba passwords, Samba invokes PAM either directly or by way of /usr/bin/passwd and is configured to know how to communicate with PAM modules using expect-style rules (smb.conf setting "passwd chat"). Version 0.99.7.1 of pam includes l10n support, which means that the prompts generated by PAM modules are now different for each locale. To account for this, Samba should explicitly use the C locale when attempting a password sync and restore the user's locale setting afterwards.

Note that a separate but related bug, #50624, appears to prevent the passwd chat from working by default.

[Mathias Gug (mathiaz)]

Fixed in 3.0.26a-1ubuntu1.

[Steve Langasek (vorlon)]

The patch in 3.0.26a-1ubuntu1 fixes the behavior when calling /usr/bin/passwd, the default configuration, but not when "pam password change" is set. Note that systems which want Unix and Samba passwords kept completely in sync should use pam_smbpass or pam_winbind from /usr/bin/passwd, and therefore Samba must use "pam password change" to avoid recursion.

[Steve Langasek (vorlon)]

Attached is a debdiff that sets the locale for pam password changes as well. Please consider uploading this fix; a signed source package that should be suitable for sponsorship can be found at http://rookery.ubuntu.com/~vorlon/samba/ if that is more convenient for you.

[Steve Langasek (vorlon)]

samba (3.0.26a-1ubuntu2) gutsy; urgency=low

  * debian/patches/chgpasswd.patch:
    - Also set the locale to 'C' when using PAM for password changes,
      since the PAM conversation is equally affected by PAM l10n support
      (LP: #139265).

 -- Steve Langasek <email address hidden> Tue, 02 Oct 2007 13:54:23 -0700