<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7226.0"> <TITLE>RE: Synchronizing unix and kerberos passwords.</TITLE> </HEAD> <BODY>  You might also want to look at simply running MIT Kerberos, which Windows systems *can* authenticate against. Or you could use a MIT Kerberos - Windows AD password synching solution (there are supposedly a few commercial products out there or you can take a look at some homegrown code we developed at UT Arlington: <A HREF="http://www.uta.edu/cedar/dev/prs.php">http://www.uta.edu/cedar/dev/prs.php</A>). -- DK -----Original Message----- From: pam-list-bounces@redhat.com on behalf of Ian Mortimer Sent: Mon 2/21/2005 6:30 PM To: pam-list@redhat.com Subject: Synchronizing unix and kerberos passwords. To simplify our account creation and management we're synchronizing our unix accounts with kerberos accounts in active directory. The authentication part of this is working fine but password changing is proving a bit more difficult. What we're aiming for is: 1 Accounts which exist in Unix and Kerberos and have the same password should be able to change both (to the same) and only get prompted once for the current password. 2 Accounts which exist in Unix and Kerberos but with different passwords should be able to change both (to the same) and get prompted for both current passwords. 3 Accounts which exist only in Unix or for which the Kerberos password is unset or unknown should be able to change the unix password (and ignore the kerberos password prompt). Testing on Fedora Core 3 with this configuration seems to work: password requisite pam_cracklib.so retry=3 password requisite pam_unix.so nullok use_authtok md5 shadow password optional pam_krb5.so use_authtok try_first_pass #password required pam_deny.so But I had to comment out pam_deny.so to get it to work in case 3. (A simpler solution would be to reverse the order of the pam_unix and pam_krb5 entries but unfortunately pam_unix doesn't accept try_first_pass in password context). What problems will removing pam_deny from the password module cause? Thanks -- Ian _______________________________________________ Pam-list mailing list Pam-list@redhat.com <A HREF="https://www.redhat.com/mailman/listinfo/pam-list">https://www.redhat.com/mailman/listinfo/pam-list</A> </BODY> </HTML>