I have a ldap server on CentOS, 389-ds. I configured the client, ubuntu 12.04, to authenticate on that base and it works very well. But it don't gets the password policies from server. For example, if i set the policy to force user to change the password on first login, ubuntu ignores it and logs him in, always.

How can i setup the client to get the policies?

Here are the client files:


passwd: files ldap 
group: files ldap
shadow: files ldap
hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup: nis
sudoers: ldap files


auth    [success=2 default=ignore]  pam_unix.so nullok_secure
auth    [success=1 default=ignore]  pam_ldap.so use_first_pass
auth    requisite           pam_deny.so
auth    required            pam_permit.so
auth    optional            pam_cap.so


account [success=2 new_authtok_reqd=done default=ignore]    pam_unix.so 
account [success=1 default=ignore]  pam_ldap.so 
account requisite           pam_deny.so
account required



password    requisite           pam_cracklib.so retry=3 minlen=8 difok=3
password    [success=2 default=ignore]  pam_unix.so obscure use_authtok try_first_pass sha512
password    [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
password    requisite           pam_deny.so
password    required            pam_permit.so
password    optional    pam_gnome_keyring.so


session [default=1]         pam_permit.so
session requisite           pam_deny.so
session required            pam_permit.so
session optional            pam_umask.so
session required    pam_unix.so 
session optional            pam_ldap.so 
session optional            pam_ck_connector.so nox11
session optional pam_mkhomedir.so skel=/etc/skel umask=0022


base dc=a,dc=b,dc=c
uri ldaps://a.b.c/
ldap_version 3
rootbinddn cn=directory manager
pam_password md5
sudoers_base ou=SUDOers,dc=a,dc=b,dc=c
pam_lookup_policy yes
pam_check_host_attr yes
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data


BASE    dc=a,dc=b,dc=c
URI ldaps://a.b.c/
ssl on
use_sasl no
tls_checkpeer no
sudoers_base ou=SUDOers,dc=a,dc=b,dc=c
sudoers_debug 2
pam_lookup_policy yes
pam_check_host_attr yes
pam_lookup_policy yes
pam_check_host_attr yes
TLS_CACERT  /etc/ssl/certs/ca-certificates.crt


Make sure you have installed all the libldap related libraries - for eg., libnss-ldap, libpam-ldap, libkrb53. Post that try imposing the policies once again.


If what you are trying to do requires setuid binaries you probably are encountering this:



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.