Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We installed ppolicy overlay on our ldap server. Password policies work correctly for locking out user after X incorrect password attempts, but we can't enforce user to change his password.

When we set pwdReset=TRUE attribute for a user - user can login as usual from Ubuntu client machine.

Ldap server & client were setup according to Ubuntu howto:

Client machine uses pam_ldap

Configuration file /etc/ldap.conf has "pam_lookup_policy yes" line

But pwdReset attribute is ignored.

According to what I read on the internet pam_ldap should honor ppolicy and require user to change his password when pwdReset is set. But it doesn't work for us..

How to make ubuntu client honor pwdReset attribute?

Maybe I can turn on debug logging for pam_ldap? But I can't find how to do it...

share|improve this question

You must make sure that pwdMustChange is set to TRUE on the user's effective password policy.

See the slapo-ppolicy manpage for more information.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.