We have opnldap setup on our ubuntu server, and were getting this message for a user:
auth: pam_unix(dovecot:account): account has expired (account expired) Sep 3 19:05:03 auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=XXXX rhost=::1 user=XXXX
I changed the password with ldappasswd successfully, but still the error persists. Doing some research it seems that shadowLastChange is not getting updated.
How can we resolve this?
access to attrs=userPassword,shadowLastChange by dn="@ADMIN@" write by anonymous auth by self write by * none access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="@ADMIN@" write by * read
OK - this seems to be a PAM issue.
If I edit /etc/nsswitch.conf to :
I don't get the message that the account is expired.
If I change it to:
shadow: files ldap
I do. But in either case, I still get the dovecot error.