wt., 11 maj 2021 o 18:09 Sumit Bose <sbose@redhat.com> napisał(a):
Am Tue, May 11, 2021 at 03:31:22PM +0200 schrieb Paweł Szafer:
> Hi, sure.
> My auth files are based on this:
> - https://wiki.archlinux.org/title/LDAP_authentication#PAM_Configuration_2
> - and this: https://sssd.io/docs/ad/ad-provider-manual.html#id6
>
> but sssd.io docs are based on Debian/Ubuntu common-auth so I had to
> improvise...
>
> passwd file:
>
> password        include         system-auth
>
> system-auth file:
>
> auth      sufficient  pam_unix.so     try_first_pass nullok
> auth      sufficient pam_sss.so forward_pass
> auth      optional    pam_permit.so
> auth      required    pam_env.so
> auth      requisite    pam_deny.so
>
> account   required    pam_unix.so
> account   [default=bad success=ok user_unknown=ignore]  pam_sss.so
> account   optional    pam_permit.so
> account   required    pam_time.so
>
> password  sufficient  pam_unix.so     try_first_pass nullok sha512 shadow
> use_authtok
> password  sufficient  pam_sss.so use_authtok

Hi,

with use_authtok both pam_unix.so and pam_sss.so expect that another
module is prompting for the new password, e.g.

password    requisite  pam_pwquality.so try_first_pass local_users_only
password    sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient pam_sss.so use_authtok
password    required   pam_deny.so

HTH

bye,
Sumit

Hi, it's working now!
Thank you for your help!

bye,
Pawel