Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've installed Kerberos on the Debian machine that hosts an internal application, to be able to use it to authenticate users against our AD.
This works.

However, Kerberos seems to feel responsible for managing the linux user accounts on that machine as well and tells the admin to enter the "Current Kerberos Password" when he tries to change a users password.

Since I don't need nor want the linux users to be managed by Kerberos, is there a way to configure Kerberos that way, that it only acts when asked by Apache?

I realise there are some settings in /etc/pam.d/ but I'm unsure what changes would be save.

share|improve this question
I'm unsure if this is on topic here, so feel free to migrate to Superusers or Unix – npst Oct 16 '13 at 13:14
What are you doing when it tell you 'Current Kerberos Password'? What do you mean with 'change user's password'? You mean 'passwd foobar'? Maybe you should check your nsswitch.conf... – Jiri Xichtkniha Oct 16 '13 at 13:38
yes, 'passwd foobar' is followed by "Current Kerberos Password". My nsswitch.conf shows passwd: compat – npst Oct 16 '13 at 14:57
Depends on your system, I don't know Debian, but something added into your pam files. You have to remove it from files which are not related to your "services". Refer to Debian PAM documentation. Warning: having wrong pam files could make your system accessible without password (or I think at least). If you have backup of previous files, it's easy to compare. Or compare with non-kerberized Debian installation. If httpd does not need PAM, you could probably uninstall libpam-krb5 or something like that. – Jiri Xichtkniha Oct 16 '13 at 18:50
Right, the question would be what pam-things httpd uses, then. thanks. – npst Oct 17 '13 at 2:59
up vote 4 down vote accepted

Your pam configuration for passwd usually /etc/pam.d/chpasswd is making a call to either directly or as part of an include statement.

Kerberos (GSSAPI/SPNEGO) for HTTP SSO is handled outside of pam making the most expedient solution to remove it entirely from your pam config (hopefully using a similar method as to what put it in).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.