// If UserName is NULL, just return STATUS_SUCCESSif (UserName == NULL) {goto exit;}// If UserName is computer account, just return STATUS_SUCCESSif (UserName.back() == '$') {goto exit;}
There is no way to do this. Passssync doesn't know what suffix it shouldRob Brown via FreeIPA-users wrote:
> I have passsync configured and working just fine, but with one minor
> annoyance:
> the passsync.log file is filled with "computer account" password changes.
>
> Example: (first one is a user passwd change, second is computer account.)
>
> 04/16/18 09:02:02: Received passhook event. Attempting sync
> 04/16/18 09:02:02: 1 new entries loaded from data file
> 04/16/18 09:02:02: Cleared contents of data file
> 04/16/18 09:02:02: Password list has 1 entries
> 04/16/18 09:02:02: Attempting to sync password for userA
> 04/16/18 09:02:02: Searching for (ntuserdomainid=userA)
> 04/16/18 09:02:02: Password modified for remote entry:
> uid=userA,cn=users,cn=accounts,dc=domain,dc=com
> 04/16/18 09:02:02: Removing password change from list
> 04/16/18 09:02:02: Password list is empty. Waiting for passhook event
> 04/16/18 09:10:50: Received passhook event. Attempting sync
> 04/16/18 09:10:50: 1 new entries loaded from data file
> 04/16/18 09:10:50: Cleared contents of data file
> 04/16/18 09:10:50: Password list has 1 entries
> 04/16/18 09:10:50: Attempting to sync password for computerA$
> 04/16/18 09:10:50: Searching for (ntuserdomainid=computerA$)
> 04/16/18 09:10:50: There are no entries that match: computerA$
> 04/16/18 09:10:50: Deferring password change for computerA$
> 04/16/18 09:10:50: Backing off for 2000ms
> 04/16/18 09:10:52: Backoff time expired. Attempting sync
> 04/16/18 09:10:52: Password list has 1 entries
> 04/16/18 09:10:52: Attempting to sync password for computerA$
> 04/16/18 09:10:52: Searching for (ntuserdomainid=computerA$)
> 04/16/18 09:10:52: There are no entries that match: computerA$
> 04/16/18 09:10:52: Deferring password change for computerA$
> 04/16/18 09:10:52: Backing off for 4000ms
>
> ...and so on.
>
>
> Firstly: wondering if that's "normal" to see?
> Second: Is it possible to configure passync to only look for user
> password changes and ignore computer accounts? (or at least not log
> them). I coulda sworn I stumbled across something in the past showing
> how to configure it that way, but cannot find anything today.
handle passwords for so there is no way to specify what should be
included/excluded.
rob