[29442] in Kerberos
Re: password change after expiry
daemon@ATHENA.MIT.EDU (Marcin N)
Tue Mar 11 04:00:19 2008
From: Marcin N <nichu@nospam.onet.pl>
Date: Tue, 11 Mar 2008 08:52:06 +0100
Message-ID: <fr5dmq$mg3$1@news.onet.pl>
Mime-Version: 1.0
X-Complaints-To: usenet@news.onet.pl
In-Reply-To: <mailman.8.1205167204.3372.kerberos@mit.edu>
To: kerberos@mit.edu
Content-Type: text/plain; charset="utf-8"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Russ Allbery wrote:> Marcin Ni�kiewicz <mniskiewicz@o2.pl> writes:> >> When password of any user expires there is a notice during login that>> "Password expired. You must change it now" but there is no prompt to>> change it - login procedure simply stops.>>>> How should i configure kerberos/pam to have possibility to change>> expired password after typing valid login informations?> > Which operating system, authentication mechanism, and Kerberos> implementation are you using?>
Oh yeah I forgot to write about it :/
I'm using mit-krb5 on gentoo - it's on clientsserver is on debian (krb5-kdc and krb5-admin-server 1.4.4-7etch4) but probably will be on solaris
on clients in /etc/pam.d/system-auth i have:auth required pam_env.soauth sufficient pam_unix.so likeauth nullokauth sufficient pam_krb5.so use_first_passauth required pam_deny.so
account required pam_unix.soaccount [default=bad success=ok user_unknown=ignore service_err=ignore system_err=ignore] pam_krb5.so
password required pam_cracklib.so retry=3 type=password sufficient pam_unix.so nullok use_authtok md5 shadowpassword sufficient pam_krb5.so use_authtokpassword required pam_deny.so
session required pam_mkhomedir.so skel=/etc/skelsession required pam_limits.sosession required pam_unix.sosession optional pam_krb5.s
/etc/krb5.conf
[libdefaults] default_realm = DOMAIN.COM krb4_config = /etc/krb.conf krb4_realms = /etc/krb.realms kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true
[realms] DOMAIN.COM = { admin_server = marcin.domain.com kdc = marcin.domain.com master_kdc = marcin.domain.com }
[domain_realm] .domain.com = DOMAIN.COM domain.com = DOMAIN.COM
[logging] default = FILE:/var/log/kerberos
on server/etc/krb5kdc/kdc.conf[kdcdefaults] kdc_ports = 750,88
[realms] DC.TECH = { database_name = /var/lib/krb5kdc/principal admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab acl_file = /etc/krb5kdc/kadm5.acl key_stash_file = /etc/krb5kdc/stash kdc_ports = 750,88 max_life = 10h 0m 0s max_renewable_life = 7d 0h 0m 0s master_key_type = des3-hmac-sha1 supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3 default_principal_flags = +preauth }
Regardsnichu________________________________________________Kerberos mailing list Kerberos@mit.eduhttps://mailman.mit.edu/mailman/listinfo/kerberos
