2

After setting up ldap authentication with pam in debian, evertything works fine. Using the passwd command change the ldap password of the current user.

The problem is my ldap has been set up with an "admin" account and a "root" account with admin rights. For historical reasons I cannot change this.

How can I make passwd change only the local password for root, and not the ldap one ?

Here is the pam config:

account sufficient pam_ldap.so
account sufficient pam_unix.so try_first_pass
account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.so
account [success=1 default=ignore]      pam_ldap.so
account requisite                       pam_deny.so
account required                        pam_permit.so
auth sufficient pam_ldap.so
auth required pam_unix.so nullok_secure try_first_pass

auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
password sufficient pam_ldap.so
password required pam_unix.so nullok obscure min=4 max=8 md5 try_first_pass
password        [success=2 default=ignore]      pam_unix.so obscure sha512
password        [success=1 user_unknown=ignore default=die]     pam_ldap.so use_authtok try_first_pass
password        requisite                       pam_deny.so
password        required                        pam_permit.so

session [default=1]                     pam_permit.so
session requisite                       pam_deny.so
session required                        pam_permit.so
session required        pam_unix.so
session optional                        pam_ldap.so
session optional                        pam_ck_connector.so nox11
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

session [default=1]                     pam_permit.so
session requisite                       pam_deny.so
session required                        pam_permit.so
session required        pam_unix.so
session optional                        pam_ldap.so
Improve this question
2
  • Can you share your pam setup? Looking at the man page for the passwd would seem to indicate that you might be able to change your pam setup to allow for this.
    – slm ♦
    Jun 11, 2013 at 10:17
  • yep, it's done :)
    – Lio A.
    Jun 11, 2013 at 13:16

2 Answers 2

Reset to default
2

There are probably better ways, but as a stopgap you can always edit the /etc/shadow file (as root). Just replace the part between the first and second : with a new, encrypted, password:

  1. using passwd, set your own password to the new root password that you want to have (this also sets your ldap password, you are going to set that back at the end)

  2. sudo -s -H, keep this terminal open until change was verified!

  3. make a backup of /etc/shadow to /etc/shadow.org

  4. edit /etc/shadow as root and copy the second 'field' (between :) from your account name to the one for root

  5. test if you can login as root with the new password. If things don't work copy /etc/shadow.org back in the terminal you are logged in as root

  6. only after testing remove /etc/shadow.org and log out

  7. put your own password back to the orginal with passwd

Improve this answer
1
  • I was thinking to something like that, but the problem is for security reasons, we need to activate ldap on every server, even dev ones. And I don't want to be interrupted to make a rollback on ldap root password everytime someone changes root password of his server. Now I'm thinking to push strongly to make change this "root" account to "administrator" to resolve this problem.
    – Lio A.
    Jun 11, 2013 at 13:12
2

Ok, so after some lobbying, I modified the root account:

dn: uid=root,ou=people,dc=nope,dc=com
changetype: modrdn
newrdn: uid=administrator
deleteoldrdn: 1

Now I don't have any problem anymore.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .