Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a ldap server on CentOS, 389-ds. I configured the client, ubuntu 12.04, to authenticate on that base and it works very well. But it don't gets the password policies from server. For example, if i set the policy to force user to change the password on first login, ubuntu ignores it and logs him in, always.

How can i setup the client to get the policies?

Here are the client files:

/etc/nsswitch.conf

passwd: files ldap 
group: files ldap
shadow: files ldap
hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup: nis
sudoers: ldap files

common-auth

auth    [success=2 default=ignore]  pam_unix.so nullok_secure
auth    [success=1 default=ignore]  pam_ldap.so use_first_pass
auth    requisite           pam_deny.so
auth    required            pam_permit.so
auth    optional            pam_cap.so

common-account

account [success=2 new_authtok_reqd=done default=ignore]    pam_unix.so 
account [success=1 default=ignore]  pam_ldap.so 
account requisite           pam_deny.so
account required

        pam_permit.so

common-password

password    requisite           pam_cracklib.so retry=3 minlen=8 difok=3
password    [success=2 default=ignore]  pam_unix.so obscure use_authtok try_first_pass sha512
password    [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
password    requisite           pam_deny.so
password    required            pam_permit.so
password    optional    pam_gnome_keyring.so

common-session

session [default=1]         pam_permit.so
session requisite           pam_deny.so
session required            pam_permit.so
session optional            pam_umask.so
session required    pam_unix.so 
session optional            pam_ldap.so 
session optional            pam_ck_connector.so nox11
session optional pam_mkhomedir.so skel=/etc/skel umask=0022

/etc/ldap.conf

base dc=a,dc=b,dc=c
uri ldaps://a.b.c/
ldap_version 3
rootbinddn cn=directory manager
pam_password md5
sudoers_base ou=SUDOers,dc=a,dc=b,dc=c
pam_lookup_policy yes
pam_check_host_attr yes
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data

/etc/ldap/ldap.conf

BASE    dc=a,dc=b,dc=c
URI ldaps://a.b.c/
ssl on
use_sasl no
tls_checkpeer no
sudoers_base ou=SUDOers,dc=a,dc=b,dc=c
sudoers_debug 2
pam_lookup_policy yes
pam_check_host_attr yes
pam_lookup_policy yes
pam_check_host_attr yes
TLS_CACERT  /etc/ssl/certs/ca-certificates.crt
TLS_REQCERT never

share|improve this question

2 Answers 2

Make sure you have installed all the libldap related libraries - for eg., libnss-ldap, libpam-ldap, libkrb53. Post that try imposing the policies once again.

share|improve this answer

If what you are trying to do requires setuid binaries you probably are encountering this:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658896

http://www.bebt.de/blog/debian/archives/2011/02/20/T13_14_34/index.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.