Your password has expired, and a new one must be chosen.

The problem remains, is there nobody who can take a look on this very nasty bug ?

I had to do a workaround now by adding a link that appair when the bug comes up telling people to change password through another selfmade webside.

Hello Jamie!

I have tried to add passwd_cmd=passwd, today it did not help.

passwd from command line as logged in user works offcourse.

More information) In the /var/log/secure you find pam_unix complaining about the user does not exits i /etc/passwd.

I did change back the /etc/usermin/changepass/config and then I did a custom usermin.pam file removing all references to pam_unix only keeping pam_ldap and belonging.

Still same errors and same logfile errors.

It works to change password when logged in to usermin as a user, then there is no complainments or errors.

I will try tomorrow removing all things saying usermin should use pam and see if something is missing.

I am very sorry I do not know perl, if I could find it.

(Also I have noticed this problem on many other open source web-based interfaces and webmail system)

Hello Jamie!

The password change script is somewhat complicated for a beginner in perl :-)

This is my discovery's so far in the environment)

/etc/usermin/changepass/config: . . passwd_cmd=passwd . . smbpasswd=smbldap-passwd . . md5=1

Logfile output is this /var/log/secure: Sep 20 20:58:25 marble xec/usermin/password_change.cgi: pam_unix(passwd:chauthtok): user "kitaro" does not exist in /etc/passwd

It indicates that either pam_ldap was supplied with wrong user and/or password information so it did fall through in PAM to pam_unix. I did however remove all pam_unix in usermin pam file, it did not help, still same problem and log entry.

Also PAM_TALLY indicates something goes wrong when someone login with expired password, directly after the submitting the old + new password page arrives;

pam_tally2 --reset Login Failures Latest failure From kitaro 1 09/20/10 21:05:24 unknown

Hello Jamie!

Yes it does and all other kind of password changes work when password is expired.

Okey, pam.d/passwd calls system-auth:

auth include system-auth account include system-auth password include system-auth

And system.auth contains pam_ldap:

auth required pam_env.so auth required pam_tally2.so deny=5 onerr=fail unlock_time=300 auth sufficient pam_ldap.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet

account sufficient pam_ldap.so account required pam_unix.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_tally2.so

password requisite pam_cracklib.so try_first_pass retry=3 minlen=8 dcredit=0 lcredit=0 ocredit=0 password sufficient pam_ldap.so use_first_pass password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=10

session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session sufficient pam_ldap.so auth required pam_deny.so account required pam_permit.so session required pam_unix.so password required pam_deny.so

Hello Jamie!

Okey, almost there very close to final working solution now! :-)

FYI. when we are done and have this working we will as next step buy the virtualmin-pro for our business!

This time the password was successfully changed in LDAP.

BUT it did NOT change the user IMAP password stored in inbox.imap so it still fails, neither did it change the smbldap password.

I assume I have to wrap the passwd command to make it work fully, question then comes what arguments is sent from usermin "passwd_cmd=/usr/bin/passwd" ?

This is how I did the wrapping, and it works in lab at least, but feels somewhat unsafe and lacks a lot of normal passwd command functions:

/etc/usermin/config: . . passwd_cmd=/usr/local/scripts/wpass.sh . .

/usr/local/scripts/wpass.sh:

echo -ne "New old password:" read -s p echo -ne "\nNew UNIX password:" read -s p1 echo -ne "\nEnter New password again:" read -s p2

/usr/local/bin/smbldap-passwd-script $1 $p2 if [ $? -gt 0 ]; then echo -e "\nPassword change failed" exit 1; else

    /usr/local/scripts/upass.sh $1 $p2
    echo -e "\nPassword successfully changed"

fi

/usr/local/scripts/upass.sh:

U=echo $(eval echo ~$1); PASS=grep pass $U/.usermin/mailbox/inbox.imap cat $U/.usermin/mailbox/inbox.imap | sed "s/$PASS/pass=$2/g" >$U/.usermin/mailbox/inbox.imap.tmp mv $U/.usermin/mailbox/inbox.imap.tmp $U/.usermin/mailbox/inbox.imap G=id -gn $1; chown $1:$G $U/.usermin/mailbox/inbox.imap chmod og-rw $U/.usermin/mailbox/inbox.imap

The /usr/local/bin/smbldap-passwd-script is a hacked variant of smbldap-tool similar command, but this takes username and password as attribute to change password for both ldap unix logins and samba.

If I have been clever enough to coding in perl or c, I would make a much better wrapper.

Big question is now, is there a predefined way to do this without all the wrapping, I prefere standard solutions and this is what we call a quick and dirty hack ?

Yes! passwd command works ok.

I had to wrap the passwd command in order to add function to also change the $HOME/.usermin/mailbox/inbox.imap file to reflect th IMAP password for mail.

If there is another way to do that part it would be nice.

In any cases my wrapping works, it emulates passwd questions and pass the parameters to smbldap-passwd and some unix commands fixing inbox.imap file.

I did some more checkouts.

It works yes, but there are some nasty things.I tested both using unix passwd commands and the wrapped variant.

For both unix passwd command and the wrapped variant)

1. Password complexity rules is put fully aside, you can enter 123456 and it is accepted!
2. If you skip old pssword and ether only new password it works anyway

Something must be missing here, I guess it is because root runs the passwd command, and all rules are overrided.

Password complexy rules must work when users login and change passwords.

Hello again!

No, the wrapper script does not call passwd command in ent, it has to do all the checkouts and in end calling a modified version of smbldap-passwd plus a script who modifies also inbox.imap.

Also I have successfully been using slappasswd, if you enable and configure ldap ppolicy it also respect that, but you still have to wrap it. But there was other problems with ppolicy and other appliations.

And yes, it works with passwd command only to, but with the following issues: 1. It does not respect password complexity rules at all, you can enter 123456 as password. 2. It does not change the password in $HOME/.usermin/mailbox/inbox.imap

The passwd command from command line works to, it respects password complexity etc.

So I guess I am stuck with the wrapper script until someone nice person do something about it.

I think we did misunderstand eachother.

In comment 9 above. I did wrote passwd changes correctly if doing as you say in comment 9. (passwd_cmd=/usr/bin/passwd line - did you add it to /etc/usermin/config)

There are one known big issue with that:

It does not respect password policy from PAM, any password willl do, most likely cause is that the passwd command is executed as root, not the user himself!!

A minor issue is that it does not change the POP3 password stored in $HOME/.usermin/mailbox/inbox.imap

I could live with the minor issue, but not the big issue.