topic Re: unable to change passwd on linux in Operating System - Linux

unable to change passwd on linux

Anh-Thu Tran — Mon, 30 Jan 2006 16:53:19 GMT

My user tried to change passwd on linux box and did not get any errors:
==>passwd
Changing password for user lehanh.
Changing password for lehanh
(current) UNIX password:
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
However, the new passwd did not get changed. He still has to use the old passwd to login. Any ideas?

Re: unable to change passwd on linux

Steven E. Protter — Mon, 30 Jan 2006 18:48:49 GMT

Shalom Anh,

Several ideas:

1) The server uses NIS or LDAP and the actual password is changed elsewhere. This situation would also imply a loss of NIS/LDAP communication and would be evident in /var/log/messages

2) There is a space problem on the root filesystem.

3) There is a permissions problem or the /etc/shadow file is locked in some way.

In any chase check the time/date stamp on /etc/passwd and /etc/shadow and make sure the root filesystem is not too close to capacity.

SEP

Re: unable to change passwd on linux

Ivan Ferreira — Tue, 31 Jan 2006 07:30:13 GMT

I agree, there should be a problem with the configuration of the pam service. You should be using a directory service.

Ensure that you configured correctly the pam files and nsswitch.conf to use the directory service for user authentication.

Re: unable to change passwd on linux

Anh-Thu Tran — Tue, 31 Jan 2006 08:53:29 GMT

Hi,
Thank you for your reply, but I would like to clarify my problem. Actually, my user would like to change his passwd on NIS client (linux box). As testing, I (root) switched to his id and successfully changed his passwd with passwd command. However, later the user could not change his passwd and got the error:
passwd: Failed preliminary check by password service

Now I don't know what wrong. Is it related to passwd aging that does not allow you to change the passwd too soon?

Re: unable to change passwd on linux

Ivan Ferreira — Tue, 31 Jan 2006 09:10:00 GMT

Do you have any extra information in /var/log/messages or /var/log/secure?

Re: unable to change passwd on linux

Anh-Thu Tran — Tue, 31 Jan 2006 09:19:05 GMT

No, I could not find anything specific there. Do you expect what I should got on those files?

Re: unable to change passwd on linux

Ivan Ferreira — Tue, 31 Jan 2006 10:20:34 GMT

If you su again to the user, can you change the password (again)? It could be that when you run the passwd, for some reason the system still think that you are root, and root can bypass complexity check for the password.

When you try as the user, try selecting a complex password, like:

C*mplexP@ssw*rd (ComplexPassword)

Also try with yppasswd instead of passwd.

Re: unable to change passwd on linux

Anh-Thu Tran — Tue, 31 Jan 2006 10:35:01 GMT

The weird thing is after I reset the user passwd on NIS master, the user is able to change his passwd on NIS client with passwd command, but failed for the second time with the error message on the previous note. That's why I guess the passwd needs to be aged to change.

Re: unable to change passwd on linux

Ivan Ferreira — Tue, 31 Jan 2006 10:59:54 GMT

It could be, I never saw password aging with NIS, but post the ouput of the command:

chage username

To check the password aging options.

Re: unable to change passwd on linux

Anh-Thu Tran — Tue, 31 Jan 2006 12:00:02 GMT

You're right. There is no expire for passwd, so I don't know what's wrong.

Re: unable to change passwd on linux

Bill Thorsteinson — Tue, 31 Jan 2006 12:10:54 GMT

What is the pam stack for passwd?
Are you using pam_unix2 or pam_unix, and
another module to update NIS?

Look at the nss switch configuration.
Normal users need to be able to read
the nss configuration files or things may
break.

Re: unable to change passwd on linux

Anh-Thu Tran — Tue, 31 Jan 2006 12:32:13 GMT

On my /etc/pam.d/passwd, it shows:
password required pam_stack.so service=system-auth

Look like we are using pam_unix, not pam_unix2 on /etc/pam.d/system-auth:
password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow nis

All entries on /etc/nsswitch.conf has nis, except those:
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files

Should I add nis to them? I am not sure how to check about other modules you asked for. Thanks.

Re: unable to change passwd on linux

George Liu_4 — Thu, 09 Feb 2006 16:45:02 GMT

To change an NIS passwd, use
yppasswd
not
passwd
Also, The yp* package have bugs in some RHEL versions.

Re: unable to change passwd on linux

Anh-Thu Tran — Fri, 10 Feb 2006 16:04:42 GMT

Thank you for your reply, but even with yppasswd we still have problem. 1. Root can not change the user passwd with yppasswd command, only the user can do it . 2. If use yppasswd command to change root passwd on NIS client, it will change the root passwd on NIS server machine also. I tried to use passwd command to change root passwd only on NIS client machine, but failed. I thought passwd use to change local id (root) and yppasswd will change the NIS ids, but look like it doesn't work that way.