Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

After setting up ldap authentication with pam in debian, evertything works fine. Using the passwd command change the ldap password of the current user.

The problem is my ldap has been set up with an "admin" account and a "root" account with admin rights. For historical reasons I cannot change this.

How can I make passwd change only the local password for root, and not the ldap one ?

Here is the pam config:

account sufficient
account sufficient try_first_pass
account [success=2 new_authtok_reqd=done default=ignore]
account [success=1 default=ignore]
account requisite             
account required              
auth sufficient
auth required nullok_secure try_first_pass

auth    [success=2 default=ignore] nullok_secure
auth    [success=1 default=ignore] use_first_pass
auth    requisite             
auth    required              
password sufficient
password required nullok obscure min=4 max=8 md5 try_first_pass
password        [success=2 default=ignore] obscure sha512
password        [success=1 user_unknown=ignore default=die] use_authtok try_first_pass
password        requisite             
password        required              

session [default=1]           
session requisite             
session required              
session required
session optional              
session optional               nox11
session required skel=/etc/skel/ umask=0022

session [default=1]           
session requisite             
session required              
session required
session optional              
share|improve this question
Can you share your pam setup? Looking at the man page for the passwd would seem to indicate that you might be able to change your pam setup to allow for this. – slm Jun 11 '13 at 10:17
yep, it's done :) – Lio A. Jun 11 '13 at 13:16

2 Answers 2

There are probably better ways, but as a stopgap you can always edit the /etc/shadow file (as root). Just replace the part between the first and second : with a new, encrypted, password:

  1. using passwd, set your own password to the new root password that you want to have (this also sets your ldap password, you are going to set that back at the end)

  2. sudo -s -H, keep this terminal open until change was verified!

  3. make a backup of /etc/shadow to /etc/

  4. edit /etc/shadow as root and copy the second 'field' (between :) from your account name to the one for root

  5. test if you can login as root with the new password. If things don't work copy /etc/ back in the terminal you are logged in as root

  6. only after testing remove /etc/ and log out

  7. put your own password back to the orginal with passwd

share|improve this answer
I was thinking to something like that, but the problem is for security reasons, we need to activate ldap on every server, even dev ones. And I don't want to be interrupted to make a rollback on ldap root password everytime someone changes root password of his server. Now I'm thinking to push strongly to make change this "root" account to "administrator" to resolve this problem. – Lio A. Jun 11 '13 at 13:12
up vote 1 down vote accepted

Ok, so after some lobbying, I modified the root account:

dn: uid=root,ou=people,dc=nope,dc=com
changetype: modrdn
newrdn: uid=administrator
deleteoldrdn: 1

Now I don't have any problem anymore.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.