1

I've implemented Password Policy Overlay on OpenLDAP on Debian Stable. The server side and the policies are working as expected. However, after expiration I cannot force users to change their passwords. User logs in, gets a message that their password is expired and must be immediately changed. However both in local login and SSH login, user is kicked out. Client side is using libnss_ldap, pam_ldap. pwdMustChange, pwdAllowUserChange is both set to true. Using passwd to change passwords is also working as expected.

Client Side Configuration Files

/etc/nsswitch.conf:

passwd:         files ldap
group:          files ldap
shadow:         files 

/etc/pam.d/common-account:

account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
account [success=1 default=ignore] pam_ldap.so
account requisite pam_deny.so
account required pam_permit.so

/etc/pam.d/common-auth:

auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_ldap.so use_first_pass
auth requisite pam_deny.so
auth required pam_permit.so

/etc/pam.d/common-password:

password [success=2 default=ignore] pam_unix.so obscure sha512
password [success=1 user_unknown=ignore default=die] pam_ldap.so try_first_pass

/etc/pam.d/common-password:

session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session required pam_mkhomedir.so umask=0022 skel=/etc/skel
session required pam_unix.so 
session optional pam_ldap.so

/etc/libnss-ldap.conf:

base dc=testldap,dc=example,dc=com
uri ldap://192.168.56.102/
ldap_version 3
pam_lookup_policy yes
pam_password exop

/etc/pam_ldap.conf:

base dc=testldap,dc=example,dc=com
uri ldap://192.168.56.102/
ldap_version 3
pam_lookup_policy yes
pam_password exop

Any ideas?

2

I've solved the problem. Only thing I needed to do is to add new_authtok_reqd=done do the LDAP line in the common-account file. So, the resulting file looks like the following and everything is working is expected:

account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
account [success=1 new_authtok_reqd=done default=ignore] pam_ldap.so
account requisite pam_deny.so
account required pam_permit.so

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.