Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have followed this excelent post to configure Kerberos + LDAP:
However, there are some local users used for services.
When I try to change the password for one of those, as root, it asks for Kerberos current password then exits:
passwd service1
Current Kerberos password: (I hit enter)
Current Kerberos password: (I hit enter)
passwd: Authentication token manipulation error
passwd: password unchanged
If I switch to the local user and do paswd, it asks once for Kerberos then revers to local:
$ passwd
Current Kerberos password:
Changing password for service1.
(current) UNIX password:

My configuration is similar to the site I posted above, and everything works fine, I just can't change the loca users passwords as root.
Thanks in advance for any help.

3.8.0-29-generic #42~precise1-Ubuntu

Update 1 2013-01-31:
cat /etc/pam.d/common-auth
auth [success=3 default=ignore] minimum_uid=1000
auth [success=2 default=ignore] nullok_secure try_first_pass
auth [success=1 default=ignore] use_first_pass
auth requisite
auth required
auth optional

cat /etc/pam.d/common-password
password [success=3 default=ignore] minimum_uid=1000
password [success=2 default=ignore] obscure use_authtok try_first_pass sha512
password [success=1 user_unknown=ignore default=die] use_authtok try_first_pass
password requisite
password required
password optional

share|improve this question
What is the full path to your passwd command? – Fred the Magic Wonder Dog Jan 31 '14 at 17:58
/usr/bin/passwd – Daniel C. Lopez Jan 31 '14 at 18:00
The next thing is to look at the pam config for passwd. What does /etc/pam.d/passwd look like? – Fred the Magic Wonder Dog Jan 31 '14 at 18:38
@include common-password – Daniel C. Lopez Jan 31 '14 at 18:51
Found something on the link below. Could something on common-auth be forcing Kerberos instead of allowing local? I'll post the contents. link – Daniel C. Lopez Jan 31 '14 at 19:50

In your /etc/pam.d/common-password , change the minimum_uid in your first line to something bigger than 1000, example:

password        [success=3 default=ignore] minimum_uid=10000

That worked for me. This is what you should see in /var/log/auth.log after changing the password for that user as root:

Dec 26 12:34:36 3.8.0-29-generic passwd[22667]: pam_unix(passwd:chauthtok): password changed for service1
share|improve this answer
This is the correct answer. The line with should have minimum_uid of the starting uid of your kerberos users. – jhauris Feb 1 at 18:57

if your users are using kerberos password you can remove kerberos password management from pam, because the kerberos password can be changed with command kpasswd

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.