Prevent root password change in ldap - debian

Question

After setting up ldap authentication with pam in debian, evertything works fine. Using the passwd command change the ldap password of the current user.

The problem is my ldap has been set up with an "admin" account and a "root" account with admin rights. For historical reasons I cannot change this.

How can I make passwd change only the local password for root, and not the ldap one ?

Here is the pam config:

account sufficient pam_ldap.so
account sufficient pam_unix.so try_first_pass
account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.so
account [success=1 default=ignore]      pam_ldap.so
account requisite                       pam_deny.so
account required                        pam_permit.so
auth sufficient pam_ldap.so
auth required pam_unix.so nullok_secure try_first_pass

auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
password sufficient pam_ldap.so
password required pam_unix.so nullok obscure min=4 max=8 md5 try_first_pass
password        [success=2 default=ignore]      pam_unix.so obscure sha512
password        [success=1 user_unknown=ignore default=die]     pam_ldap.so use_authtok try_first_pass
password        requisite                       pam_deny.so
password        required                        pam_permit.so

session [default=1]                     pam_permit.so
session requisite                       pam_deny.so
session required                        pam_permit.so
session required        pam_unix.so
session optional                        pam_ldap.so
session optional                        pam_ck_connector.so nox11
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

session [default=1]                     pam_permit.so
session requisite                       pam_deny.so
session required                        pam_permit.so
session required        pam_unix.so
session optional                        pam_ldap.so

Answer 1

There are probably better ways, but as a stopgap you can always edit the /etc/shadow file (as root). Just replace the part between the first and second : with a new, encrypted, password:

1. using passwd, set your own password to the new root password that you want to have (this also sets your ldap password, you are going to set that back at the end)

2. sudo -s -H, keep this terminal open until change was verified!

3. make a backup of /etc/shadow to /etc/shadow.org

4. edit /etc/shadow as root and copy the second 'field' (between :) from your account name to the one for root

5. test if you can login as root with the new password. If things don't work copy /etc/shadow.org back in the terminal you are logged in as root

6. only after testing remove /etc/shadow.org and log out

7. put your own password back to the orginal with passwd

Answer 2

Ok, so after some lobbying, I modified the root account:

dn: uid=root,ou=people,dc=nope,dc=com
changetype: modrdn
newrdn: uid=administrator
deleteoldrdn: 1

Now I don't have any problem anymore.