<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Philip Kime wrote:
<blockquote
cite="mid9C0091F428E697439E7A773FFD083427435B92@szexchange.Shopzilla.inc"
type="cite">
<blockquote type="cite">
<pre wrap="">Effective policy is determined by new_passwdPolicy() which considers
</pre>
</blockquote>
<pre wrap=""><!---->the modification
</pre>
<blockquote type="cite">
<pre wrap="">initiated by the password change extop to be internal and local policy
</pre>
</blockquote>
<pre wrap=""><!---->is not
</pre>
<blockquote type="cite">
<pre wrap="">retrieved.
</pre>
</blockquote>
<pre wrap=""><!---->
I suspected as much - this should probably go in the password policy
section of the documentation as there are all sorts of recommendations
flying round the Web for setting pam_password to "exop" to allow
password changes to work properly. It does indeed work but as you say,
it bypasses all password policies (except global ones it seems).
</pre>
</blockquote>
I didn't mean to imply that it's intentional or that it should be this
way, just giving you a hand with the analysis. I have some changes
around this area of password policy that aren't committed and might
complicate a potential fix, I've filed a bug for you to keep track:<br>
<a class="moz-txt-link-freetext" href="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=216522">https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=216522</a><br>
<br>
</body>
</html>