password change over LDAP works only if TLS is disabled

cyrilrip · 05-30-2005, 12:09 PM

I try to setup a linux server (fedora core 2, kernel 2.6.10) to use LDAP as
the password repository.
The LDAP server is local to the server, and I manage to authenticate any
user or change their password with the following /etc/ldap.conf file:

host 127.0.0.1
base ou=people,dc=.......
port 2389
pam_password clear
sslpath /var/db/cert7.db
ssl off

But when enabling TLS (I have "ssl start_tls" as the last line above instead
of "ssl off"), I can still authenticate any user (that is I can telnet to the server
and see the authentication occuring on the LDAP server) but trying to change their password (as root, with the passwd command) always fails with this error message:

Authentication token manipulation error

I don't think the problem is on the directory side since I can bind or search over
TLS using at least 2 different LDAP clients/browsers.
I don't think the problem is in the PAM configuration since it works with TLS disabled,
so I don't know where to search anymore, it looks like a bug to me.

Any help would be greatly appreciated .

securehack · 06-01-2005, 01:10 PM

Didn't know much about your problem but googled it.

TAKEN FROM:
http://info.ccone.at/INFO/Mail-Archi.../msg00059.html

Quote:

> Gerhard,
>
> I have solved a problem I reported a long time ago about
> the following (user cannot change own password):
>
> passwd: Authentication token manipulation error
>
> The solution was simply to chmod +s /usr/bin/passwd

You can try that but I am not sure.

--Abid Kazmi

-=-EDIT-=-

Quote:

but trying to change their password (as root, with the passwd command) always fails

Didn't notice the root there. That seems to be a serious error with your passd and shdw files. Will go indepth later. At school and bell has rung.

cyrilrip · 06-02-2005, 01:26 AM

Hello Abid,

See my answers to your reply inlines ..

Quote:

Originally posted by securehack
Didn't know much about your problem but googled it.

TAKEN FROM:
http://info.ccone.at/INFO/Mail-Archi.../msg00059.html

You can try that but I am not sure.

I'd already googled a lot before posting that question, and thus I had already seen this
solution but since my /usr/bin/passwd file rights and ownership look OK (-r-s--x--x root root),
it's not the right solution in my case.

Moreover, in such a case, I think I would also have troubles changing the passwd over LDAP
without TLS enabled, which is not the case: just by adding a # at the beginning of the
"ssl start_tls line" in /etc/ldap.conf makes the whole thing works, while over TLS, I can't change
any passwd but can still authenticate (??!!...) .

Good luck at school anyway !

--Abid Kazmi

-=-EDIT-=-

Didn't notice the root there. That seems to be a serious error with your passd and shdw files. Will go indepth later. At school and bell has rung.