Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I started an office and i NEED centralized login and home directories to work. Since all workstations are going to run Arch and problems with different LDAP versions I finally concluded the LDAP server also needed Arch.

I have done a completely clean install of Arch on the server and on a workstation. Both have Arch's "base" and "base-devel" package groups, NTP, OpenSSH & OpenLDAP installed, the server has nss-pam-ldapd as well. That's pretty much it right now.

  1. I have followed the but had to do the following things differently (and I have not set up SSL or TLS yet):
    • Before I copied DB_CONFIG.example I ran updatedb, and used locate DB_CONFIG
    • I had to run slaptest with -u option to supress database warnings
    • After running slaptest I did chown -R ldap:ldap on /etc/openldap/slap.d
    • systemctl start slapd fails, so does sudo slapd -u ldap -g ldap, but sudo slapd worked.
    • After running sudo slapd i killed slapd and chown -R ldap:ldap /var/lib/openldap but systemctl start slapd still failed.
    • after chown -R ldap:ldap /etc/openldap i could finally use systemctl start slapd... i assume it was the schema folder that was not able to be read by ldap when started with ldap user.
  2. Followed
    • I did not start or enable nscd
  3. I can now log in with LDAP users on the workstation fine, and I can update the directory using my rootdn.

Problem: users cannot change password using passwd. LPAD returns:

password change failed: Insufficient access

/etc/slapd.conf (on server):

include     /etc/openldap/schema/core.schema
include     /etc/openldap/schema/cosine.schema
include     /etc/openldap/schema/inetorgperson.schema
include     /etc/openldap/schema/nis.schema
pidfile     /run/openldap/
argsfile    /run/openldap/slapd.args
access to attrs=userPassword
    by self write
    by anonymous auth
    by * none
access to *
    by self write
    by * read
database    bdb
suffix      "dc=testing,dc=com"
rootdn      "cn=Manager,dc=testing,dc=com"
rootpw      {SSHA}ntsD5qrvHJtMflarQPhJzapiEEnqH2/L
directory   /var/lib/openldap/openldap-data
index   objectClass eq
index   uid             pres,eq
index   mail            pres,sub,eq
index   cn              pres,sub,eq
index   sn              pres,sub,eq
index   dc              eq

/etc/openldap/ldap.conf (on client):

BASE   dc=testing,dc=com
URI    ldap://

/etc/nslcd.conf (on client):

uid nslcd
gid nslcd
uri ldap://
base dc=testing,dc=com

/etc/pam.d/system-auth (on client):

auth      sufficient
auth      required     try_first_pass nullok
auth      optional
auth      required
account   sufficient
account   required
account   optional
account   required
password  sufficient
password  required     try_first_pass nullok sha512 shadow
password  optional
session   required
session   required
session   optional
session   optional

/etc/pam.d/passwd (on client):

password    sufficient
password    required sha512 shadow nullok

So finally, my questions:

  1. First off, where is the best place to read up on this kind of stuff?
  2. Second off, how do I debug myself? Arch uses systemd, where is the syslog for systemd based systems?
  3. What is the mlocate package with updatedb and locate? Do i need to use it? It is not mentioned in the archwiki, but mentioned in many other places.
  4. And the actual question: Why can my users not change passwords with passwd
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.