<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
Out of curiosity, is it working with md5?<br><br><pre>In /etc/ldap.conf:
pam_password md5
pam_lookup_policy yes
<br></pre>Thanks,<br>Joe<br><br><div><hr id="stopSpelling">Date: Thu, 29 Sep 2011 15:54:01 +0200<br>Subject: Re: dirsrv, SSH and forcing password change at first login<br>From: claudio.di.nardo@gmail.com<br>To: pam-list@redhat.com<br><br>Hi all, (and hi Joe :P),<br><br>I finally got it working! <br>Setting password policy on a subtree or on a particular user is not enough to make it active: you have to enable that even on cn=config of your LDAP tree.<br>In particular, in my configuration I have set those parameters on cn=config<br>
<br>----------------------------------------------------------<br>passwordCheckSyntax: on<br>passwordExp: on<br>passwordInHistory: 10<br>passwordisglobalpolicy: off<br>passwordLockout: on<br>passwordStorageScheme: SHA512<br>
passwordMustChange: on<br>----------------------------------------------------------<br><br>Then, I leave to each "per sub-tree" or "per user" setting the duty to set all others in-deep policies, (e.g.: min password length 8 chars, min alpha chars, min digits, min caps...), which are requested.<br>
Plus, I updated the nss_ldap package to the latest release: apparently, in fact, RHEL 5.4 default package of nss_ldap suffers of a bug in passwords expiring, as explained here - <a href="http://rhn.redhat.com/errata/RHBA-2011-0097.html" target="_blank">http://rhn.redhat.com/errata/RHBA-2011-0097.html</a>.<br>
Now I got correctly those messages<br><br>user@ldap-client:[/root]# ssh ldap-user@ldap-client<br>Password: <br>Your LDAP password will expire in 1 hour.<br>Last login: Thu Sep 29 15:21:58 2011 from xxx.xxx.xxx.xxx<br><br>
Remote kickstart on 2011-03-07<br><br>ldap-user@ldap-client:[/home/ldap-user]#<br><br>as well as<br><br>user@ldap-client:[/root]# ssh ldap-user@ldap-client<br>Password: <br>You are required to change your LDAP password immediately.<br>
Enter login(LDAP) password:<br><br>Hope this could be useful for others.<br>Cheers! :)<br><br>Claudio<br>
<br>_______________________________________________
Pam-list mailing list
Pam-list@redhat.com
https://www.redhat.com/mailman/listinfo/pam-list</div> </div></body>
</html>