<HTML dir=ltr><HEAD> <META http-equiv=Content-Type content="text/html; charset=unicode"> <META content="MSHTML 6.00.2800.1589" name=GENERATOR></HEAD> <BODY> <DIV><FONT face=Arial color=#000000 size=3>I have a centralized OpenLdap instance with one master and several slaves.</FONT></DIV> <DIV><FONT face=Arial color=#000000 size=3></FONT> </DIV> <DIV><FONT face=Arial color=#000000 size=3>I also have a large number of hosts that use Ldap for user authentication. All systems look to one of the slaves for all authentication, but when the user needs to change his password the slaves send a referral to the client redirecting them to the master. </FONT></DIV> <DIV><FONT face=Arial color=#000000 size=3></FONT> </DIV> <DIV><FONT face=Arial color=#000000 size=3>This all works well, but now I must keep password history.</FONT></DIV> <DIV><FONT face=Arial color=#000000 size=3></FONT> </DIV> <DIV><FONT face=Arial color=#000000 size=3>I have found references for modifying the /etc/pam.d/system-auth file to make the system remember some number of past passwords by adding remember=X to the pam_unix line, but it states the history will be kept in the /etc/security/opasswd file.</FONT></DIV> <DIV><FONT face=Arial color=#000000 size=3></FONT> </DIV> <DIV><FONT face=Arial color=#000000 size=3>This sounds like the history will be kept on the system where the password was changed. If that is the case, then the next time that user changes his password and happens to be on a different system, his history will not be correct.</FONT></DIV> <DIV><FONT face=Arial></FONT> </DIV> <DIV><FONT face=Arial>Is it possible to have them history maintained on the Ldap master server, where the password changes is really happening? Does the pam_ldap module support password history? If so, where in the Ldap database will this information be saved? Do I need to modify my schemas?</FONT></DIV> <DIV><FONT face=Arial></FONT> </DIV> <DIV><FONT face=Arial>Kevin</FONT></DIV></BODY></HTML>