Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have followed this excelent post to configure Kerberos + LDAP:
http://koo.fi/blog/2013/01/06/ubuntu-12-04-active-directory-authentication/
However, there are some local users used for services.
When I try to change the password for one of those, as root, it asks for Kerberos current password then exits:
passwd service1
Current Kerberos password: (I hit enter)
Current Kerberos password: (I hit enter)
passwd: Authentication token manipulation error
passwd: password unchanged
If I switch to the local user and do paswd, it asks once for Kerberos then revers to local:
$ passwd
Current Kerberos password:
Changing password for service1.
(current) UNIX password:

My configuration is similar to the site I posted above, and everything works fine, I just can't change the loca users passwords as root.
Thanks in advance for any help.

3.8.0-29-generic #42~precise1-Ubuntu

Update 1 2013-01-31:
cat /etc/pam.d/common-auth
auth [success=3 default=ignore] pam_krb5.so minimum_uid=1000
auth [success=2 default=ignore] pam_unix.so nullok_secure try_first_pass
auth [success=1 default=ignore] pam_ldap.so use_first_pass
auth requisite pam_deny.so
auth required pam_permit.so
auth optional pam_cap.so

cat /etc/pam.d/common-password
password [success=3 default=ignore] pam_krb5.so minimum_uid=1000
password [success=2 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512
password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
password requisite pam_deny.so
password required pam_permit.so
password optional pam_gnome_keyring.so

share|improve this question
    
What is the full path to your passwd command? –  Fred the Magic Wonder Dog Jan 31 at 17:58
    
/usr/bin/passwd –  Daniel C. Lopez Jan 31 at 18:00
    
The next thing is to look at the pam config for passwd. What does /etc/pam.d/passwd look like? –  Fred the Magic Wonder Dog Jan 31 at 18:38
    
@include common-password –  Daniel C. Lopez Jan 31 at 18:51
    
Found something on the link below. Could something on common-auth be forcing Kerberos instead of allowing local? I'll post the contents. link –  Daniel C. Lopez Jan 31 at 19:50

2 Answers 2

In your /etc/pam.d/common-password , change the minimum_uid in your first line to something bigger than 1000, example:

password        [success=3 default=ignore]      pam_krb5.so minimum_uid=10000

That worked for me. This is what you should see in /var/log/auth.log after changing the password for that user as root:

Dec 26 12:34:36 3.8.0-29-generic passwd[22667]: pam_unix(passwd:chauthtok): password changed for service1
share|improve this answer

if your users are using kerberos password you can remove kerberos password management from pam, because the kerberos password can be changed with command kpasswd

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.