This seems like it should be simple, but if it is, I must be missing something. I have a Linux NIS master from which I would like to be able to change users' passwords (in cases of forgotten passwords and similar things), but I can't.
Some details: I'm running Scientific Linux 6.4, with ypserv-2.19-26, ypbind-1.20.4-30, and yp-tools-2.9-12. NIS is configured to use
/etc/yp/passwd for its passwd map (i.e. not the system passwd file). The system is a client of itself and
ypwhich returns "localhost".
Because unprivileged users should not be logging in to the NIS master, we have the following set in
passwd: files compat
and this at the end of
/etc/pam.d/passwd contains the standard RHEL directives:
password substack system-auth
/etc/pam.d/system-auth is a symlink to
/etc/pam.d/system-auth-ac, which contains:
password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so md5 shadow nis nullok try_first_pass use_authtok password required pam_deny.so
(As a side note, we're using md5 instead of sha512 because we have some Solaris clients that don't support sha512.)
If I run
passwd as root, it prompts me for the new passwd, but then fails to change it:
$ sudo passwd phil Changing password for user phil. New password: Retype new password: NIS password could not be changed. passwd: Authentication token manipulation error
The log file (
/var/log/secure) is unhelpful:
passwd: pam_unix(passwd:chauthtok): password not changed for phil on ypmaster.domain.tld
If, instead, I run
yppasswd, I can change the password:
$ sudo yppasswd phil Changing NIS account information for phil on ypmaster.domain.tld. Please enter root password: Changing NIS password for phil on ypmaster.domain.tld. Please enter new password: Please retype new password: The NIS password has been changed on ypmaster.domain.tld.
But that requires any sysadmin who needs to reset a password to know (or look up from our locked password safe) the system's root password, which is a scenario I'd like to avoid.
So how do I need to configure the master to allow us to change user passwords without having to type the system's root password every time?