1

I have created posix group and posix account also able to successfully authenticate client but client unable to change the password. The error is password change failed: Confidentiality required``passwd: Authentication token manipulation error.

/var/log/secure


Aug 23 05:08:13 RHELQA passwd: pam_ldap(passwd:chauthtok): password change failed: password change failed: Confidentiality required; user=johanp
Aug 23 05:08:34 RHELQA passwd: pam_unix(passwd:chauthtok): user "johanp" does not exist in /etc/passwd
Aug 23 05:09:11 RHELQA passwd: pam_unix(passwd:chauthtok): user "johanp" does not exist in /etc/passwd
Aug 23 05:09:11 RHELQA passwd: pam_ldap(passwd:chauthtok): password change failed: password change failed: Confidentiality required; user=johanp
Aug 23 05:10:29 RHELQA passwd: pam_unix(passwd:chauthtok): user "johanp" does not exist in /etc/passwd
Aug 23 05:10:40 RHELQA passwd: pam_unix(passwd:chauthtok): user "johanp" does not exist in /etc/passwd
Aug 23 05:10:40 RHELQA passwd: pam_ldap(passwd:chauthtok): password change failed: password change failed: Confidentiality required; user=johanp
Aug 23 06:28:28 RHELQA sshd[3224]: Accepted publickey for ec2-user from x.x.x.x port 5466 ssh2: RSA SHA256:OqK/b0ailCh32//NbcWAgGtzZK35fOVuvqY0xtnNIPI
Aug 23 06:28:28 RHELQA sshd[3224]: pam_unix(sshd:session): session opened for user ec2-user by (uid=0)
Aug 23 06:28:30 RHELQA sudo: ec2-user : TTY=pts/2 ; PWD=/home/ec2-user ; USER=root ; COMMAND=/bin/bash
Aug 23 06:29:07 RHELQA sshd[3257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=johanp
Aug 23 06:29:07 RHELQA sshd[3257]: Accepted password for johanp from x.x.x.x port 5474 ssh2
Aug 23 06:29:07 RHELQA sshd[3257]: pam_unix(sshd:session): session opened for user johanp by (uid=0)
Aug 23 06:29:12 RHELQA passwd: pam_unix(passwd:chauthtok): user "johanp" does not exist in /etc/passwd
Aug 23 06:29:23 RHELQA passwd: pam_unix(passwd:chauthtok): user "johanp" does not exist in /etc/passwd
Aug 23 06:29:23 RHELQA passwd: pam_ldap(passwd:chauthtok): password change failed: password change failed: Confidentiality required; user=johanp

/etc/pam.d/system-auth


#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so


account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_ldap.so
account required pam_permit.so


password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so use_authtok
password required pam_deny.so


session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_ldap.so

/etc/pam.d/password-auth


#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so


account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_ldap.so
account required pam_permit.so


password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so use_authtok


password required pam_deny.so


session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_ldap.so

/etc/openldap/ldap.conf


#
# LDAP Defaults
#


# See ldap.conf(5) for details
# This file should be world readable but not world writable.


#BASE dc=example,dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666


#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never


TLS_CACERTDIR /etc/openldap/cacerts


# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON on
URI ldap://backup.abc.xyz.local/
BASE dc=abc,dc=xyz,dc=local

  • Why do you have both pam_sss and pam_ldap entries in the password-auth file, but in system-auth the pam_ldap entries are commented out? – roaima Aug 22 '17 at 12:07
  • If you're using sssd please include your sssd.conf file in your question. If you're using an LDAP connector please include the appropriate LDAP client configuration file. Ensure you redact any passwords you may be using. – roaima Aug 22 '17 at 12:46
  • @Roaima I have done fresh client setup again using PAM-LDAP (same method using before), update system-auth and password-auth file here, also add the LDAP.conf file here anything else requires please let me know. – Ankit Aug 23 '17 at 3:41
  • Now you've changed the configuration new error log please. The old one is now irrelevant. Please format the question. Two stars around a file title. Select a block of code and use the {} button top indent 4 spaces. – roaima Aug 23 '17 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.