I've implemented an Open LDAP server in OpenSuSE 11.2 via the YaST GUI. I'm having success logging in from the local machine and other machines via LDAP. I am able to change LDAP user passwords via


on the command line. However, I cannot do anything else through the command line, such as passwd -e username.
I get the following error

Authentication failure. LDAP information update failed: Operations error Error while changing password expiry information.

The same goes for any other arguments regarding password expiry or for locking accounts via -l. Is this simply a limitation of the LDAP server, or do I have an incorrect configuration?

2 Answers 2


passwd just uses PAM. Configure PAM to send password changes to LDAP.

Add the following to /etc/pam.d/common-password

password   sufficient pam_ldap.so try_first_pass
password   required   pam_unix.so nullok obscure min=4 max=8 md5 try_first_pass

This assumes that you've already configured LDAP to allow the necessary writes and the only thing lacking is the PAM set up.


I don't think the passwd command has plug-ins to manage anything other than the local password database (/etc/passwd or /etc/shadow). You need to use a separate tools like yppasswd for NIS or ldappasswd for LDAP.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .