Hello,<div><br></div><div>I have configured openldap server on RHEL 5.4</div><div>I also want to enforce strong password policies for my ldap users.</div><div>for which i configured pam module on each ldap client in following way.</div>

<div><br></div><div>(/etc/pam.d/system-auth)</div><div><div>#%PAM-1.0</div><div># This file is auto-generated.</div><div># User changes will be destroyed the next time authconfig is run.</div><div>auth        required      pam_tally.so onerr=fail deny=5 unlock_time=300</div>

<div>auth        required      pam_env.so</div><div>auth        sufficient    pam_unix.so nullok try_first_pass</div><div>auth        requisite     pam_succeed_if.so uid &gt;= 500 quiet</div><div>auth        sufficient    pam_ldap.so use_first_pass</div>

<div>auth        required      pam_deny.so</div><div><br></div><div>account     required      pam_unix.so broken_shadow</div><div>account     sufficient    pam_succeed_if.so uid &lt; 500 quiet</div><div>account     [default=bad success=ok user_unknown=ignore] pam_ldap.so</div>

<div>account     required      pam_permit.so</div><div><br></div><div>password    requisite     pam_cracklib.so try_first_pass retry=3 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8 \</div><div>                                reject_username </div>

<div>password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=5</div><div>password    sufficient    pam_ldap.so use_authtok</div><div>password    required      pam_deny.so</div><div><br>

</div><div>session     optional      pam_keyinit.so revoke</div><div>session     required      pam_limits.so</div><div>session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid</div><div>session     required      pam_unix.so</div>

<div>session     optional      pam_ldap.so</div><div>session     optional      pam_mkhomedir.so skel=/etc/skel umask=0066</div><div><br></div>I am having following problems with my configuration.</div><div><br></div><div>

1. Although configured password history (pam_unix.so remember =5) is not working for ldap users, while other password policies (pam_cracklib,pam_tally) are working fine.</div><div>2. I also observed that I can&#39;t change/set any users password as root user (using passwd username).</div>

<div><br></div><div>Following is my ldap client configuration file (ldap.conf).</div><div><br></div><div><div>base dc=mycomp,dc=com</div><div>bind_timelimit 120</div><div>idle_timelimit 3600</div><div>nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm</div>

<div>pam_check_host_attr</div><div>pam_password md5</div><div>ssl no</div><div>timelimit 120</div><div>tls_cacertdir /etc/openldap/cacerts</div><div>uri ldap://<a href="http://10.0.119.36">10.0.119.36</a></div><div><br></div>

<div>For further troubleshooting I observer my /var/log/secure file while changing ldap user&#39;s passwod.</div><div><br></div><div>passwd: pam_unix(passwd:chauthtok): user &quot;username&quot; does not exist in /etc/passwd</div>

<div><br></div><div>but #getent passwd show me the username.</div><div><br></div><div>Thanks in advance.</div><div><br></div>-- <br>Regards,<br>Meghanand N. Acharekar<br>&quot; A proud GNU\Linux User &quot;<br>Reg Linux User  #397975<br>

------------------------------------------<br>I was born free! No Gates and Windows can restrict my Freedom !!!<br><br><br>
</div>