Newsgroup: it.comp.os.linux.sys
Titolo: openldap + pam + cambio password con "passwd"

salve,
ho messo su un piccolo server openLDAP (debian testing) e configurato i
miei client per autenticare via PAM.
Tutto funziona alla perfezione eccetto passwd, che non permette ad un
utente di cambiare la password:
pallotron@maciste:/var/log$ passwd 
Changing password for pallotron
(current) UNIX password: 
passwd: Authentication service cannot retrieve authentication info.
se sbaglio di proposito a inserire la password corrente
pallotron@maciste:/root$ passwd 
Changing password for pallotron
(current) UNIX password: 
passwd: Authentication failure
getent passwd e getent shadow tornano come output quello che mi aspetto
(riesco a vedere le shadow password), ma allora perche' non posso
cambiarle?
ho impostato i client per avere come binddn un utente chiamato
cn=authuser,dc=miodominio,dc=local e impostato le ACL di slapd cosi':
access to *
       by dn="cn=admin,dc=agencyuzeda,dc=local" write
       by dn="cn=authuser,dc=agencyuzeda,dc=local" read
       by users read
       by * read
access to attribute=userPassword
       by dn="cn=admin,dc=agencyuzeda,dc=local" write
       by dn="cn=authuser,dc=agencyuzeda,dc=local" write
       by anonymous auth
       by users read
       by self write
       by * none

aggiungo i log di slapd, come vedete entro con il cd admin, che dovrebbe
essere in grado di fare tutto no (vedere le ACL di sopra).
qualche idea? che sia un problema di libnss_ldap?
sembra un problema collegato ad ottenere i campi di un account
infatti mi dice che non puo' prelevare le info di autenticazione:
maciste:~# passwd pallotron
passwd: Authentication service cannot retrieve authentication info.
ecco i log:
Jan 24 10:24:20 maciste slapd[29412]: conn=0 fd=12 ACCEPT from 
IP=
127.0.0.1:4261
 
(IP=
0.0.0.0:389
)
Jan 24 10:24:20 maciste slapd[29412]: conn=0 op=0 BIND 
dn="cn=admin,dc=agencyuzeda,dc=local" method=128
Jan 24 10:24:20 maciste slapd[29412]: conn=0 op=0 BIND 
dn="cn=admin,dc=agencyuzeda,dc=local" mech=simple ssf=0
Jan 24 10:24:20 maciste slapd[29412]: conn=0 op=0 RESULT tag=97 err=0 text=
Jan 24 10:24:20 maciste slapd[29412]: conn=0 op=1 SRCH
base="ou=People,dc=agencyuzeda,dc=local" scope=1
filter="(&(objectClass=posixAccount)(uid=pallotron))" Jan 24 10:24:20
maciste slapd[29412]: conn=0 op=1 SRCH attr=uid userPassword uid      
Number gidNumber cn homeDirectory loginShell gecos description objectClass
Jan 24 10:24:20 maciste slapd[29412]: <= bdb_equality_candidates: (uid)
index_pa       ram failed (18) Jan 24 10:24:20 maciste slapd[29412]:
conn=0 op=1 SEARCH RESULT tag=101 err=0 ne       ntries=1 text= Jan 24
10:24:20 maciste slapd[29412]: conn=1 fd=14 ACCEPT from IP=
127.0.0.1:4262
 
(IP=
0.0.0.0:389
) Jan 24 10:24:20 maciste slapd[29412]: conn=1 fd=14
closed Jan 24 10:24:20 maciste slapd[29412]: conn=0 op=2 SRCH
base="ou=People,dc=agency       uzeda,dc=local" scope=1
filter="(&(objectClass=posixAccount)(uid=pallotron))" Jan 24 10:24:20
maciste slapd[29412]: conn=0 op=2 SRCH attr=uid userPassword uid      
Number gidNumber cn homeDirectory loginShell gecos description objectClass
Jan 24 10:24:20 maciste slapd[29412]: <= bdb_equality_candidates: (uid)
index_pa       ram failed (18) Jan 24 10:24:20 maciste slapd[29412]:
conn=0 op=2 SEARCH RESULT tag=101 err=0 ne       ntries=1 text= Jan 24
10:24:20 maciste slapd[29412]: conn=0 op=3 SRCH base="ou=People,dc=agency 
uzeda,dc=local" scope=1
filter="(&(objectClass=shadowAccount)(uid=pallotron))" Jan 24 10:24:20
maciste slapd[29412]: conn=0 op=3 SRCH attr=uid userPassword sha      
dowLastChange shadowMax shadowMin shadowWarning shadowInactive
shadowExpire shad       owFlag Jan 24 10:24:20 maciste slapd[29412]: <=
bdb_equality_candidates: (uid) index_pa       ram failed (18) Jan 24
10:24:20 maciste slapd[29412]: conn=0 op=3 SEARCH RESULT tag=101 err=0 ne 
ntries=1 text= Jan 24 10:24:20 maciste slapd[29412]: conn=0 fd=12
closed

 
Hai configurato sia /etc/openldap/ldap.conf che /etc/ldap.conf ?
 Gio'
-- 
/**************************************************
 * 
http://www.snb.it
 - Solutions for New Business *
 **************************************************/