389-ds on Ubuntu 12.04 server up and running. Enabled Fine-grained password policies
and User must change password after reset
for the whole tree. Created test user afterwards.
Login from CentOS client: user gets prompted to change its password: You are required to change your password immediately.
Login from Ubuntu client: user logs in, no prompt.
Copied CentOS client configuration files to Ubuntu client, precisely /etc/pam_ldap.conf (on Ubuntu this is /etc/ldap.conf), /etc/nslcd.conf, /etc/openldap/ldap.conf (on Ubuntu /etc/ldap/ldap.conf) - no dice.
Both clients authenticate successfully, both can change user passwords.
All logins are terminal logins, no GUI involved.
PAM on both clients:
Ubuntu:
/etc/pam.d/common-account
account [success=2 new_authtok_reqd=done default=ignore]
pam_unix.so account [success=1 default=ignore] pam_ldap.so account requisite pam_deny.so account required
pam_permit.so/etc/pam.d/common-auth
auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_ldap.so use_first_pass auth
requisite pam_deny.so auth required
pam_permit.so auth optional pam_cap.so/etc/pam.d/common-password
password [success=2 default=ignore] pam_unix.so obscure sha512 password [success=1 user_unknown=ignore default=die]
pam_ldap.so try_first_pass password requisite
pam_deny.so password required
pam_permit.so password optional pam_gnome_keyring.so
CentOS
/etc/pam.d/system-auth-ac
#%PAM-1.0 auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth
required pam_deny.soaccount required pam_unix.so broken_shadow account
sufficient pam_localuser.so account sufficient
pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required
pam_permit.sopassword requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so
session optional pam_keyinit.so revoke session required
pam_limits.so session optional pam_mkhomedir.so session
[success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional
pam_ldap.so/etc/pam.d/passwd-auth-ac
#%PAM-1.0 auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite
pam_succeed_if.so uid >= 500 quiet auth sufficient
pam_ldap.so use_first_pass auth required pam_deny.soaccount required pam_unix.so broken_shadow account
sufficient pam_localuser.so account sufficient
pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required
pam_permit.sopassword requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so
session optional pam_keyinit.so revoke session required
pam_limits.so session optional pam_mkhomedir.so session
[success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional
pam_ldap.so
One difference is that on Ubuntu I do not have cracklib installed. I plan to do so later, now I am just testing.
I wonder if Ubuntu LDAP client joins Windows AD, how does it receive notifications for password expiration from it. It should be something similar but I can't figure it out.
How to make the Ubuntu client to honour/obey the password policies? Why I don't see the You are required to change your password immediately.
prompt when login, given that the same config works with CentOS?
Thank you!
Happy holidays!