Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have opnldap setup on our ubuntu server, and were getting this message for a user:

 auth: pam_unix(dovecot:account): account has expired (account expired)
Sep  3 19:05:03  auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=XXXX rhost=::1  user=XXXX

I changed the password with ldappasswd successfully, but still the error persists. Doing some research it seems that shadowLastChange is not getting updated.

How can we resolve this?


access to attrs=userPassword,shadowLastChange
        by dn="@ADMIN@" write
        by anonymous auth
        by self write
        by * none
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="@ADMIN@" write
        by * read

OK - this seems to be a PAM issue.

If I edit /etc/nsswitch.conf to :

shadow: compat

I don't get the message that the account is expired.

If I change it to:

shadow: files ldap

I do. But in either case, I still get the dovecot error.

share|improve this question
Does this help?… – iii Sep 4 '13 at 3:22
no, because these are ldap users that are not in shadow... – NinjaCat Sep 4 '13 at 5:22

Never really answered my own question before, but I wanted to share in case anyone else ever comes across this. It had to do with saslauthd not installed, configured, and running. Once I did that, error went away.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.