<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Yeah the posix schemas are loaded and I have my ACLs working. I changed
my /etc/ldap.conf and set pam_password to exop. Everything work find with
changing the password using passwd but now password history and check_password
that was borrowed from the ltb-project is not working. I think it has something
to do with the format the passwords are stored in. Thanks for the input.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><b><i><span style='font-size:10.5pt;font-family:Consolas;
color:#0070C0'>John Allgood<o:p></o:p></span></i></b></p>
<p class=MsoNormal><b><i><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Senior Systems Administrator<o:p></o:p></span></i></b></p>
<p class=MsoNormal><i><span style='font-size:14.0pt;font-family:Consolas;
color:#1F497D'>OHL Transportation Services<o:p></o:p></span></i></p>
<p class=MsoNormal><i><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>2251 Jesse Jewell Pky. NE<o:p></o:p></span></i></p>
<p class=MsoNormal><i><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Gainesville, GA 30507<o:p></o:p></span></i></p>
<p class=MsoNormal><i><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>tel: (678) 989-3051 fax: (770) 531-7878<o:p></o:p></span></i></p>
<p class=MsoNormal><i><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'><o:p> </o:p></span></i></p>
<p class=MsoNormal><i><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'><a href="mailto:jallgood@ohl.com"><span style='color:#1F497D'>jallgood@ohl.com</span></a><o:p></o:p></span></i></p>
<p class=MsoNormal><i><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'><a href="http://www.ohl.com"><span style='color:#1F497D'>www.ohl.com</span></a><o:p></o:p></span></i></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> ale-bounces@ale.org
[mailto:ale-bounces@ale.org] <b>On Behalf Of </b>Jerald Sheets<br>
<b>Sent:</b> Wednesday, June 23, 2010 11:27 AM<br>
<b>To:</b> Atlanta Linux Enthusiasts - Yes! We run Linux!<br>
<b>Subject:</b> Re: [ale] LDAP Experts<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<div>
<p class=MsoNormal>On Wed, Jun 23, 2010 at 11:05 AM, Allgood, John <<a
href="mailto:jallgood@ohl.com">jallgood@ohl.com</a>> wrote:<o:p></o:p></p>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Hey
Guys<o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Anyone
here using ldap? I have built openldap 2.4.21 on Centos 5.5 and have setup
ppolicy and smbk5. <o:p></o:p></p>
</div>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>openldap 2.3.27-8.el5_1.3 over RHEL 5.2 with no ppolicy or
smbk5<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
<blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;
margin-left:4.8pt;margin-right:0in'>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Everything
works fine when using ldappasswd to set the password. When I force a pwdReset
the system forces me to use the passwd program which does not update everything
in ldap correctly nor adhere to my ppolicy. <o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>Did you load the POSIX schemas?<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>Does your slapd credentials stuff look sorta like this:<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<div>
<p class=MsoNormal>##################################<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>#<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal># Grant access to Change Password<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>#<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>##################################<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>access to attrs=userPassword<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> by self write<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> by anonymous auth<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> by
dn.base="cn=admin,,dc=your,dc=domain" write<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> by * none<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>access to *<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> by self write<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> by
dn.base="cn=admin,dc=your,dc=domain" write<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> by * read<o:p></o:p></p>
</div>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>have you tried using something like Apache's Directory
Studio to do password changes instead? Most of my management gets done
through there.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;
margin-left:4.8pt;margin-right:0in'>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I
assume it is something in /etc/pam.d/system-auth but not much familiar with
pam. I thought about creating a script and linking the passwd program to that
script but not sure how that would behave when forced to change the password
via GDM.<o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><o:p> </o:p></p>
</div>
</div>
</blockquote>
<div>
<p class=MsoNormal> The only thing I use in system-auth is <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>session required
pam_mkhomedir.so<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>to automagically create user directories on first login.
Everything else is DIST.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>Sorry if the issues are being introduced through the ppolicy
or smbk5, as I have no help for you there.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>--jms<o:p></o:p></p>
</div>
</div>
</div>
</div>
<BR>
______________________________________________________<BR>
<BR>
This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.<BR>
</body>
</html>