1

I have a RHEL 6.6 Server that I am seeing odd behavior with. When I change a password using the passwd command, the /etc/passwd file gets updated without issue (confirmed with timestamp check). However, it takes approximately 6 minutes before I can use that new password. This delay exists whether I am using login, sshd, or su.

I inherited this system but I can't find anything customized that is different from other servers that don't show this behavior. AD Bridging is turned on, but the entries are set up to use the files first before winbind.

To answer the questions: There is no ncsd service. sssd is stopped. The users I am changing are local users, not AD (including the root user).

Improve this question
2
  • 1
    Is this a local user or AD user that's changed a password? Are you running sssd or some other caching service?
    – Chris Davies
    Jun 3, 2015 at 16:10
  • No, sssd is not running, nor is ncsd.
    – Dan
    Jun 3, 2015 at 17:02

2 Answers 2

Reset to default
2

Check your PAM configuration, specifically I believe that the issue is that the local users also have kerberos passwords, and that the kerberos check comes before unix in the pam files and that you have more than one kdc (implemented by your AD domain controllers) and that you are using a different kdc for updating the password than the kdc you are checking the password with resulting in the delay as the password is distributed across the multiple controllers.

Improve this answer
0

The password should be stored in /etc/shadow if the are stored locally, right?

On RHEL, this is likely due to caching. Is either nscd or sssd running?

You can try service nscd status or service sssd status. If you don't need either of these and they are running, try restarting or stopping them with service nscd/sssd restart/stop.

You can then use chkconfig SERVICE off if you don't need them and don't want them starting on boot.

Improve this answer
3
  • It seems that /etc/shadow is unused on this box. The hashed passwords are in /etc/passwd
    – Dan
    Jun 3, 2015 at 17:06
  • @Dan is this machine using NIS by any chance does ypwhich return anything? You said the users are local, but what if those users are shared over NIS? It sounds like you already looked at /etc/nsswitch.conf and said that files comes before winbind, but is anything before files?
    – zje
    Jun 3, 2015 at 18:19
  • NIS is not being used on this box. Instead, we use Kerberos with winbind to authenticate to a Windows 2008 Domain Controller. You are correct, we did check /etc/nsswitch.conf and there is nothing before files.
    – Dan
    Jun 3, 2015 at 18:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .