ppolicy not enforced on OpenLDAP Client when using 'passwd'

Question

The issue: Password Policy is not being enforced when I change the password using the 'passwd' command. It is enforced when I use the 'ldappaswd' command. But the OpenLDAP password still changes using the 'passwd' command

The setup: I've setup an OpenLDAP server in Ubuntu and enforced a basic password policy using 'ppolicy' I have another Ubuntu machine which is a client system and connected to the OpenLDAP server. The policies mentioned in the ppolicy is being enforced when I use the 'ldappasswd' command to change the password but it is not happening when I use 'passwd'

Eg: When using ldappasswd, I cannot set a password less than 10 characters(as set in ppolicy), but using 'passwd' I'm able to change with less than 10 characters And the password changed is the LDAP password only. So 'passwd' still connects to 'LDAP'

What am I missing? These are the tutorials I used to set ppolicy and enforce LDAP Authentication

https://help.ubuntu.com/community/LDAPClientAuthentication http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies http://tutoriels.meddeb.net/openldap-password-policy-managing-users-accounts/

Answer 1

Maybe it is caused by...

1. Your local PAM password setup sends a LDAP modify request with a client-hashed password and
2. slapd accepts that because of pwdCheckQuality: 1 in your pwdPolicy entry.

The tutorials you've mentioned indicate that you're using nss-pam-ldapd (aka nslcd). Not sure whether this demon is capable to use the Password Modify extended operation like what ldappasswd is doing (see RFC 3062).