Jakub,

Thank you for your response!

I was checking what was happening when SSSD was down. So when I ran into this case, SSSD was not running. The problem was that it doesn't handle things as gracefully as I had hoped.

What seems to happen is that I am prompted for my current password, and then my new password, and then my new password again. Once I submit all three, the password change operation fails with 'passd: Authentication token manipulation error'. I see this in /var/log/secure:

Apr 25 16:01:21 localhost passwd: pam_sss(passwd:chauthtok): Request to sssd failed. Connection refused
Apr 25 16:01:21 localhost passwd: pam_unix(passwd:chauthtok): username [user] obtained
Apr 25 16:01:28 localhost passwd: pam_sss(passwd:chauthtok): Request to sssd failed. Connection refused
Apr 25 16:01:28 localhost passwd: pam_unix(passwd:chauthtok): username [user] obtained
Apr 25 16:01:28 localhost passwd: pam_unix(passwd:chauthtok): password - new password not obtained
Apr 25 16:01:28 localhost passwd: gkr-pam: couldn't update the 'login' keyring password: no old password was entered 

Since SSSD isn't running, I don't see anything in the SSSD logs. Is there a way I can check the return value of pam?

I was assuming that pam_sss wasn't forwarding the password through the pam stack because it has a 'forward_pass' option and because pam_unix was complaining about not receiving the password. But I may not understand pam as well as I should, so feel free to correct me if I am wrong.

Thanks,

Kevin


On Mon, Apr 28, 2014 at 3:12 PM, Jakub Hrozek <jhrozek@redhat.com> wrote:
On Fri, Apr 25, 2014 at 04:39:49PM -0400, kevin sullivan wrote:
> I am seeing an issue when I try to change a local user's password when SSSD
> (1.9.2-82.el6) is not running. I have two sets of users: users stored in
> ldap and users stored locally on my RHEL 6.4 machine. When able, I want to
> login as the ldap users and only fallback to the local users when I can't
> contact the ldap server. This is why I have pam configured like this:
>
> password    requisite     pam_cracklib.so retry=3 minlen=10
> password    sufficient    pam_sss.so forward_pass use_authtok
> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
> use_authtok
> password    required      pam_deny.so
>
> When SSSD is running, I can change the password of local users and ldap
> users. However, when I try to change the password of a local user when SSSD
> is not running, I see this error:
>
> Changing password for user.
> passd: Authentication token manipulation error.
>
> I then added 'audit' and 'debug' options to the pam_unix module and saw
> this output in /var/log/secure:
>
> Apr 25 16:01:21 localhost passwd: pam_sss(passwd:chauthtok): Request to
> sssd failed. Connection refused
> Apr 25 16:01:21 localhost passwd: pam_unix(passwd:chauthtok): username
> [user] obtained
> Apr 25 16:01:28 localhost passwd: pam_sss(passwd:chauthtok): Request to
> sssd failed. Connection refused

Are you sure SSSD was running at this point?

Connection refused sounds an awful lot like the deamon was not up at
all.

Can you check if sssd was running (service sssd start, service sssd
status) and paste if the error code pam_sss returns is the same as you
pasted above?
_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users