Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to enable linux hosts to authenticate against an active directory server using port 389 and tls. I seem to have that much working, but the users cannot change their passwords via passwd.

I was on the assumption that during a passwd change it'd bind with the username and old password rather than the binddn/bindpw in ldap.conf, but i may be wrong. If that's the case, how to i get it working, because the test\ldap domain user does not have permissions to change other user's passwords, and i don't want to give it that permission as this config file will be on every client.

This is on rhel5 (and if i get it working, rhel4 also)

Here's my config files on the client:



debug 0

uri ldap://WIN-JERS4CCKFGM.TEST.COM/ base cn=Users,dc=test,dc=com ldap_version 3

binddn TEST\ldap bindpw Pwldap1 bind_policy soft

scope sub timelimit 30

nss_base_passwd cn=Users,dc=test,dc=com?one nss_base_shadow cn=Users,dc=test,dc=com?one nss_base_group cn=Users,dc=test,dc=com?sub nss_schema rfc2307bis nss_map_objectclass posixAccount User nss_map_objectclass shadowAccount User nss_map_objectclass posixGroup group nss_map_attribute uniqueMember member nss_map_attribute homeDirectory UnixHomeDirectory nss_map_attribute gecos name nss_map_attribute ou description


passwd:     files ldap
shadow:     files ldap
group:      files ldap
hosts: files dns

ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: files ldap automount: files ldap aliases: files


auth        required
auth        sufficient nullok try_first_pass
auth        requisite uid >= 500 quiet
auth        sufficient use_first_pass
auth        required

account required broken_shadow account sufficient uid < 500 quiet account [default=bad success=ok user_unknown=ignore] account required

password requisite retry=3 password sufficient md5 shadow nullok try_first_pass use_authtok password sufficient use_authtok password required

session optional revoke session required session optional session [success=1 default=ignore] service in crond quiet use_uid session required session optional

/etc/pam.d/passwd just has the usual 3 include system-auth lines in it.

share|improve this question

Are you using Kerberos or Samba winbind at all? Or are you just trying straight LDAP?

If the latter, your /etc/ldap.conf file should have a series of 'pam_*' parameters that seem to be missing. In particular 'pam_password ad' is necessary to specify ADSI as the password change protocol. You may also need 'pam_login_attribute sAMAccountName' (+ others)

Personally I've always just bound the Linux machine using winbind, then changing passwords is as done with 'net ads password'

share|improve this answer
I'm trying to avoid using winbind (it caused us alot of glitches due to it breaking), but i'm open to using krb5. On the krb5 front, i have kinit working to grab a ticket, but i wasnt sure a) how to tie krb5 into this, b) how to use krb5 to grab a ticket for cron jobs etc and at login time of the user, so for now i disabled krb5 – Sirex Feb 1 '12 at 11:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.