I'm trying to enable linux hosts to authenticate against an active directory server using port 389 and tls. I seem to have that much working, but the users cannot change their passwords via passwd.

I was on the assumption that during a passwd change it'd bind with the username and old password rather than the binddn/bindpw in ldap.conf, but i may be wrong. If that's the case, how to i get it working, because the test\ldap domain user does not have permissions to change other user's passwords, and i don't want to give it that permission as this config file will be on every client.

This is on rhel5 (and if i get it working, rhel4 also)

Here's my config files on the client:



debug 0

uri ldap://WIN-JERS4CCKFGM.TEST.COM/ base cn=Users,dc=test,dc=com ldap_version 3

binddn TEST\ldap bindpw Pwldap1 bind_policy soft

scope sub timelimit 30

nss_base_passwd cn=Users,dc=test,dc=com?one nss_base_shadow cn=Users,dc=test,dc=com?one nss_base_group cn=Users,dc=test,dc=com?sub nss_schema rfc2307bis nss_map_objectclass posixAccount User nss_map_objectclass shadowAccount User nss_map_objectclass posixGroup group nss_map_attribute uniqueMember member nss_map_attribute homeDirectory UnixHomeDirectory nss_map_attribute gecos name nss_map_attribute ou description


passwd:     files ldap
shadow:     files ldap
group:      files ldap
hosts: files dns

ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: files ldap automount: files ldap aliases: files


auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so

password requisite pam_cracklib.so retry=3 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so

session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so

/etc/pam.d/passwd just has the usual 3 include system-auth lines in it.

1 Answer 1


Are you using Kerberos or Samba winbind at all? Or are you just trying straight LDAP?

If the latter, your /etc/ldap.conf file should have a series of 'pam_*' parameters that seem to be missing. In particular 'pam_password ad' is necessary to specify ADSI as the password change protocol. You may also need 'pam_login_attribute sAMAccountName' (+ others)

Personally I've always just bound the Linux machine using winbind, then changing passwords is as done with 'net ads password'

  • I'm trying to avoid using winbind (it caused us alot of glitches due to it breaking), but i'm open to using krb5. On the krb5 front, i have kinit working to grab a ticket, but i wasnt sure a) how to tie krb5 into this, b) how to use krb5 to grab a ticket for cron jobs etc and at login time of the user, so for now i disabled krb5
    – Sirex
    Feb 1, 2012 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.