Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have followed this excelent post to configure Kerberos + LDAP:
However, there are some local users used for services.
When I try to change the password for one of those, as root, it asks for Kerberos current password then exits:
passwd service1
Current Kerberos password: (I hit enter)
Current Kerberos password: (I hit enter)
passwd: Authentication token manipulation error
passwd: password unchanged
If I switch to the local user and do paswd, it asks once for Kerberos then revers to local:
$ passwd
Current Kerberos password:
Changing password for service1.
(current) UNIX password:

My configuration is similar to the site I posted above, and everything works fine, I just can't change the loca users passwords as root.
Thanks in advance for any help.

3.8.0-29-generic #42~precise1-Ubuntu

Update 1 2013-01-31:
cat /etc/pam.d/common-auth
auth [success=3 default=ignore] pam_krb5.so minimum_uid=1000
auth [success=2 default=ignore] pam_unix.so nullok_secure try_first_pass
auth [success=1 default=ignore] pam_ldap.so use_first_pass
auth requisite pam_deny.so
auth required pam_permit.so
auth optional pam_cap.so

cat /etc/pam.d/common-password
password [success=3 default=ignore] pam_krb5.so minimum_uid=1000
password [success=2 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512
password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
password requisite pam_deny.so
password required pam_permit.so
password optional pam_gnome_keyring.so

share|improve this question
What is the full path to your passwd command? –  Fred the Magic Wonder Dog Jan 31 at 17:58
/usr/bin/passwd –  Daniel C. Lopez Jan 31 at 18:00
The next thing is to look at the pam config for passwd. What does /etc/pam.d/passwd look like? –  Fred the Magic Wonder Dog Jan 31 at 18:38
@include common-password –  Daniel C. Lopez Jan 31 at 18:51
Found something on the link below. Could something on common-auth be forcing Kerberos instead of allowing local? I'll post the contents. link –  Daniel C. Lopez Jan 31 at 19:50
show 2 more comments

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.