Hello List,
I am still troubled with the issue of a users password expiring, they get the
messages to change, successfully change password. Then the next time that
they login, the password loop begins again.
I searched the archives and didn't really find a solution, but could have
sworn that I had seen it solved some time back. The setup I am working with
is RHEL4 servers and FDS fedora-ds-1.0.2-1.RHEL4. The clients are mix of
fedora versions and RHEL4 machines. Everything works great(authentication,
netgroups, autofs, etc...) other than this one issue.
Here are the relevant entries(I think!) from ldap.conf on a client(rhel4):
ssl start_tls
ssl on
tls_checkpeer no
tls_reqcert never
tls_cacertfile /usr/share/ssl/certs/ca-bundle.crt
tls_cacertdir /usr/share/ssl/certs
pam_password crypt
pam_lookup_policy yes
The pam.d/system-auth is:
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required /lib/security/$ISA/pam_env.so
auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass
auth required /lib/security/$ISA/pam_deny.so
account required /lib/security/$ISA/pam_unix.so broken_shadow
account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account [default=bad success=ok user_unknown=ignore]
/lib/security/$ISA/pam_ldap.so
account required /lib/security/$ISA/pam_permit.so
password required /lib/security/$ISA/pam_cracklib.so retry=3
password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok
md5 shadow
password sufficient /lib/security/$ISA/pam_ldap.so use_authtok
password required /lib/security/$ISA/pam_deny.so
session required /lib/security/$ISA/pam_limits.so
session required /lib/security/$ISA/pam_unix.so
session optional /lib/security/$ISA/pam_ldap.so
and the log entry when using ssh to login with shows:
sshd(pam_unix)[4227]: session opened for user
but if I fumble the password it shows:
passwd[4222]: pam_ldap: error trying to bind as user ....
So, like I was several months ago, still stumped on what I have overlooked.
Any ideas or suggestions on what I have overlooked?
Can I find some log entries in the ldap server that may point to what I have
mis-configured or not configured?
Many Thanks
--
Jim Summers
School of Computer Science-University of Oklahoma
-------------------------------------------------
--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users
