1

I have a RHEL 6.6 Server that I am seeing odd behavior with. When I change a password using the passwd command, the /etc/passwd file gets updated without issue (confirmed with timestamp check). However, it takes approximately 6 minutes before I can use that new password. This delay exists whether I am using login, sshd, or su.

I inherited this system but I can't find anything customized that is different from other servers that don't show this behavior. AD Bridging is turned on, but the entries are set up to use the files first before winbind.

To answer the questions: There is no ncsd service. sssd is stopped. The users I am changing are local users, not AD (including the root user).

  • 1
    Is this a local user or AD user that's changed a password? Are you running sssd or some other caching service? – roaima Jun 3 '15 at 16:10
  • No, sssd is not running, nor is ncsd. – Dan Jun 3 '15 at 17:02
2

Check your PAM configuration, specifically I believe that the issue is that the local users also have kerberos passwords, and that the kerberos check comes before unix in the pam files and that you have more than one kdc (implemented by your AD domain controllers) and that you are using a different kdc for updating the password than the kdc you are checking the password with resulting in the delay as the password is distributed across the multiple controllers.

0

The password should be stored in /etc/shadow if the are stored locally, right?

On RHEL, this is likely due to caching. Is either nscd or sssd running?

You can try service nscd status or service sssd status. If you don't need either of these and they are running, try restarting or stopping them with service nscd/sssd restart/stop.

You can then use chkconfig SERVICE off if you don't need them and don't want them starting on boot.

  • It seems that /etc/shadow is unused on this box. The hashed passwords are in /etc/passwd – Dan Jun 3 '15 at 17:06
  • @Dan is this machine using NIS by any chance does ypwhich return anything? You said the users are local, but what if those users are shared over NIS? It sounds like you already looked at /etc/nsswitch.conf and said that files comes before winbind, but is anything before files? – zje Jun 3 '15 at 18:19
  • NIS is not being used on this box. Instead, we use Kerberos with winbind to authenticate to a Windows 2008 Domain Controller. You are correct, we did check /etc/nsswitch.conf and there is nothing before files. – Dan Jun 3 '15 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.