We've installed CentOS Directory Server (389 DS) and have Samba using it as a backend. This works great except that when enabling password syncing in the
smb.conf it is only synced one way. I could sync the ldap/samba password when using
smbpasswd -a but not
passwd. To fix this I added a line to my PAM system-auth settings to update the smb password file when changing my password. Again this works, but I'm getting the following error.
Changing password for user testuser1. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Invalid credentials passwd: Authentication failure
This error isn't correct because both the LDAP and Samba passwords change successfully. Does any one have a clue why I'm getting the error at all?
The line I added to PAM is in bold:
password requisite pam_cracklib.so try_first_pass retry=3
password optional pam_smbpass.so use_authtok use_first_pass
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
smb.conf file has the following:
[global] workgroup = MyGroup security = user passdb backend = ldapsam:ldaps://192.168.124.89/ ldap admin dn = cn=Directory Manager ldap suffix = dc=example,dc=com ldap user suffix = ou=People ldap group suffix = ou=Groups ldap passwd sync = yes ldap delete dn = no wins support = yes
As I stated previously, everything is working as it should. I just don't want users freaking out when they see that nasty error message and I want it to go away.