gnome-screensaver, kerberos password expiration problem on 10.04.3 LTS

Ian John Locke II · 06-27-2012, 05:43 PM

I was recently hired to manage a network of Ubuntu 10.04.3. We use kerberos for authentication and have a password expiration policy of 6 months. One of the users locked their screen (using gnome-screensaver) and while it was locked (over the weekend) his password expired. When he went to log back in, gnome-screensaver told him his password had expired but wouldn't let him change his password (as it should).

Upon Googling, I tested adding:

Code:

[appdefaults]
   pam = {
      chpw_prompt = gnome-screensaver gdm kscreensaver kdm
   }

to our krb5 configuration file on a test machine. This didn't help the problem and I was hoping someone else here might have experienced/solved this problem as well. Also, using SSH and regular logins (i.e. from gdm) a user can change their password.

Thanks in advance

Slackyman · 06-27-2012, 07:01 PM

I'm not an expert of gnome-things so I searched the web.
I found this entry in launchpad.
Gnome-screensaver doesn't seem to handle password expiration.

Ian John Locke II · 06-28-2012, 08:08 AM

Quote:

Originally Posted by Slackyman

I'm not an expert of gnome-things so I searched the web.
I found this entry in launchpad.
Gnome-screensaver doesn't seem to handle password expiration.

That's extraordinarily bizarre. I hadn't seen that but other places seemed to indicate that it did and what was necessary was what I posted above. I guess I'll have to do a lot more digging on this. Thanks!

Also, I added a plus one for fixing the bug on gnome's tracker. Thanks again.