Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We've installed CentOS Directory Server (389 DS) and have Samba using it as a backend. This works great except that when enabling password syncing in the smb.conf it is only synced one way. I could sync the ldap/samba password when using smbpasswd -a but not passwd. To fix this I added a line to my PAM system-auth settings to update the smb password file when changing my password. Again this works, but I'm getting the following error.

Changing password for user testuser1.
Enter login(LDAP) password:
New UNIX password:
Retype new UNIX password:
LDAP password information update failed: Invalid credentials

passwd: Authentication failure

This error isn't correct because both the LDAP and Samba passwords change successfully. Does any one have a clue why I'm getting the error at all?

The line I added to PAM is in bold:

password requisite pam_cracklib.so try_first_pass retry=3
password optional pam_smbpass.so use_authtok use_first_pass
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok

My smb.conf file has the following:

workgroup = MyGroup
security = user
passdb backend = ldapsam:ldaps://
ldap admin dn = cn=Directory Manager
ldap suffix = dc=example,dc=com
ldap user suffix = ou=People
ldap group suffix = ou=Groups
ldap passwd sync = yes
ldap delete dn = no
wins support = yes

As I stated previously, everything is working as it should. I just don't want users freaking out when they see that nasty error message and I want it to go away.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.