LDAP and Trusted system (TCB) issue

[Johannes Kamentz_3]

Hi folks,

SOX got us and we need to enable some more security functions for the satisfaction of the auditors ;-)

For the following issue maybe someone has good idea for us:

We have LDAP clients running on our HPUX 11.11 systems together with a Netscape directory server, which runs quite fine in Untrusted environments. Now after migrating our servers to TCB in order to enable password shadowing and password aging for the local users in the /etc/passwd this is fine also except one item... :

When LDAP expires an account after our default 90day period, the LDAP user is not able to modify his password and gets a dialog as follows:

Last successful login for aldapu: Thu May 11 16:13:02 MET-1METDST 2006 on pts/1
Last unsuccessful login for aldapu: Thu May 11 15:18:58 MET-1METDST 2006 on pts/1
Your password has expired.
Old password:
New password:
Re-enter new password:
Password:
System Password:
Password:
Connection closed by UNKNOWN

Changing the password before this 90day timeframe does not lead to any problems. In this situation the user can also change his password when logging in from another - untrusted - system. Local users does not have any problems anyways.

So it seems TCB and LDAP conflict somehow in this situation.

Anybody any idea about that ?

In order to give You a better picture here is what we have:

LDAP client on HPUX 11.11
LDAP Client Version : J4269AA B.04.00.02 LDAP-UX Integration

LDAP server
LDAP Server Version : J4258CA B.06.21.10 Netscape Directory Server v6 for HP-UX

pam.conf attached

Every input is highly welcomed.

best regards
Johannes

[Johannes Kamentz_3]

here the mentioned pam.conf

[SGUX]

Johannes,
i'm pretty busy with this LDAP-stuff myself at the moment and i think there is a PHCO-patch which solves this issue. Check the latest PAM-patches.

[Darrel Louis]

Hi Johannes,

Have you checked the following:
Defect Description:
PHCO_33214:
( SR:8606398952 CR:JAGaf58917 )
Changing a password does not work as expected under some conditions.

Resolution:
The passwd command now works as expected

Darrel