After setting up ldap authentication with pam in debian, evertything works fine. Using the passwd command change the ldap password of the current user.
The problem is my ldap has been set up with an "admin" account and a "root" account with admin rights. For historical reasons I cannot change this.
How can I make passwd change only the local password for root, and not the ldap one ?
Here is the pam config:
account sufficient pam_ldap.so
account sufficient pam_unix.so try_first_pass
account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
account [success=1 default=ignore] pam_ldap.so
account requisite pam_deny.so
account required pam_permit.so
auth sufficient pam_ldap.so
auth required pam_unix.so nullok_secure try_first_pass
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_ldap.so use_first_pass
auth requisite pam_deny.so
auth required pam_permit.so
password sufficient pam_ldap.so
password required pam_unix.so nullok obscure min=4 max=8 md5 try_first_pass
password [success=2 default=ignore] pam_unix.so obscure sha512
password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
password requisite pam_deny.so
password required pam_permit.so
session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session required pam_unix.so
session optional pam_ldap.so
session optional pam_ck_connector.so nox11
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session required pam_unix.so
session optional pam_ldap.so
passwd
would seem to indicate that you might be able to change your pam setup to allow for this.