Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a ldap server on CentOS, 389-ds. I configured the client, ubuntu 12.04, to authenticate on that base and it works very well. But it don't gets the password policies from server. For example, if i set the policy to force user to change the password on first login, ubuntu ignores it and logs him in, always.

How can i setup the client to get the policies?

Here are the client files:


passwd: files ldap 
group: files ldap
shadow: files ldap
hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup: nis
sudoers: ldap files


auth    [success=2 default=ignore] nullok_secure
auth    [success=1 default=ignore] use_first_pass
auth    requisite 
auth    required  
auth    optional  


account [success=2 new_authtok_reqd=done default=ignore] 
account [success=1 default=ignore] 
account requisite 
account required


password    requisite  retry=3 minlen=8 difok=3
password    [success=2 default=ignore] obscure use_authtok try_first_pass sha512
password    [success=1 user_unknown=ignore default=die] use_authtok try_first_pass
password    requisite 
password    required  
password    optional


session [default=1]
session requisite 
session required  
session optional  
session required 
session optional   
session optional   nox11
session optional skel=/etc/skel umask=0022


base dc=a,dc=b,dc=c
uri ldaps://a.b.c/
ldap_version 3
rootbinddn cn=directory manager
pam_password md5
sudoers_base ou=SUDOers,dc=a,dc=b,dc=c
pam_lookup_policy yes
pam_check_host_attr yes
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data


BASE    dc=a,dc=b,dc=c
URI ldaps://a.b.c/
ssl on
use_sasl no
tls_checkpeer no
sudoers_base ou=SUDOers,dc=a,dc=b,dc=c
sudoers_debug 2
pam_lookup_policy yes
pam_check_host_attr yes
pam_lookup_policy yes
pam_check_host_attr yes
TLS_CACERT  /etc/ssl/certs/ca-certificates.crt

share|improve this question

Make sure you have installed all the libldap related libraries - for eg., libnss-ldap, libpam-ldap, libkrb53. Post that try imposing the policies once again.

share|improve this answer

If what you are trying to do requires setuid binaries you probably are encountering this:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.