[SSSD-users] Need help configuring fine grained password policy enforcement on RHEL6 using sssd
Jakub Hrozek
jhrozek at redhat.com
Wed Sep 11 18:34:48 UTC 2013
On Wed, Sep 11, 2013 at 06:25:25PM +0000, Bright, Daniel wrote:
> I was told by the good folks at the 389-users mailing list to instead redirect my question to the sssd-users list so here goes, thanks in advance!
>
> All,
>
> I am in the process of moving away from pam_ldap and on to pam_sss. The basic sssd setup is working just fine, user authentication works, getent passwd works, caching is great, everything looks like it's working fine except for password policy enforcement. I am wondering if there is some sort of password policy overlay I need to use, or a special setup of sssd.conf, I tried using "ldap_pwd_policy=shadow" however this doesn't allow me to change passwords, I instead get this error:
>
> [user1 at someserver ~]$ passwd
> Changing password for user user1.
> Current Password:
> New password:
> Retype new password:
> Password change failed. Server message: Failed to update password
> (3 second delay here)
> passwd: Authentication token is no longer valid; new one required
>
> As soon as I comment out ldap_pwd_policy=shadow this error goes away, however so does my password policy enfocement.
>
> If anyone could help it would be greatly appreciated, I will post a working config on my blog after this is done so we can help others too.
>
> Thanks!
> Daniel B.
>
Hi Daniel,
what kind of password policy do you use on the server, if any? Is it
anything like
https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server/9.0/html/Deployment_Guide/Designing_a_Secure_Directory.html#Password_Policy_Attributes-Password_Max_Failure
?
Can you post the sanitized version of your pam_ldap configuration so we
can suggest the best SSSD alternative?
More information about the sssd-users
mailing list