Hi,
I am trying to get password expiration to work on FC5/FDS 1.0.2
and having mixed results. I have set a user's shadowAccount attributes
as expired using the following values (with today being 13452):
shadowFlag: 0
shadowExpire: -1
shadowInactive: -1
shadowWarning: 0
shadowMax: 1
shadowMin: 1
shadowLastChange: 13452
All seems well when I log in.
You are required to change your LDAP password immediately.
Last login: Wed Nov 1 07:51:14 2006 from lin1000
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user fjones.
Enter login(LDAP) password:
New UNIX password:
Retype new UNIX password:
LDAP password information changed for fjones
passwd: all authentication tokens updated successfully.
Connection to lin2600 closed.
Except I get booted off and this is the /var/log/secure
Nov 1 07:55:18 lin2600 passwd: pam_unix(passwd:chauthtok): user "fjones" does not exist in /etc/passwd
Nov 1 07:55:29 lin2600 passwd: pam_unix(passwd:chauthtok): user "fjones" does not exist in /etc/passwd
Nov 1 07:55:29 lin2600 sshd[17557]: pam_unix(sshd:session): session closed for user fjones
Attempts to log in again accept the new password, which has changed in LDAP,
but I am asked to go through the same loop of changing the password again.
The shadow* attributes are NOT changed however. So that's either my culprit
or maybe the PAM password entries are not right. That looks like this:
password requisite pam_cracklib.so try_first_pass retry=3 password
sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so use_authtok
password required pam_deny.so
Finally, at the end of this document:
(http://directory.fedora.redhat.com/wiki/Howto:PAM)
It says to add the following to enable password expirations.
dn: cn=config
changetype: modify
add: passwordExp
passwordExp: on
-
add: passwordMaxAge
passwordMaxAge: 8640000
But my other tests seem to indicate some parts of expiration in fact
work. Is the above entry neccessary?
Thanks so much.
--
- Kyle
---------------------------------------------
kylet at panix.com http://www.panix.com/~kylet
---------------------------------------------
