	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

6.2

SSH users unable to change passwords upon expiration

Asked by CCBIL in Linux Network Security, Red Hat Linux, Linux

Tags: CentOS 5.3, RHEL 5.3, PAM, OpenSSH

Environment overview:
OS: CentOS 5.3
Kernel: 2.6.18-128.4.1.el5 #1 SMP
OpenSSH 4.3p2

Summary of Problem

Users connecting to the server via SSH are unable to change their passwords if they have expired (see code sample for details). This issue affects SSH users only, console and telnet users do not experience the issue.

What I have looked at:

/etc/ssh/sshd_config file:
#StrictModes yes
#PermitEmptyPasswords no
PasswordAuthentication yes
UsePAM yes

/etc/pam.d/sshd/

#%PAM-1.0
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so

/etc/pam.d/system-auth

auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so

account required pam_unix.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so

password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so

gut feeling tells me this is an issue with PAM.

View the Solution FREE for 30 Days

         
             login as: user
user@hosts password: 
You are required to change your password immediately (password aged)
Last login: Mon Sep 21 14:02:41 2009 from workstation.net
 
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user user.
Changing password for user
(current) UNIX password: 
passwd: Authentication token manipulation error

20091111-EE-VQP-92 - Hierarchy / EE_QW_3_20080625

Hall of Fame

1. fosiul0132,475
2. Blaz31,566
3. KeremE27,463
4. noci20,606
5. omarfarid15,452
6. DaveHowe12,150
7. Tintin10,750
8. woolmilkp...10,725
9. uetian170710,415
10. oklit10,100
11. ahoffmann9,500
12. small_stu...9,394
13. giltjr8,500
14. fmarzocca8,000
15. it4soho6,775
16. rsivanandan6,500
16. rcflyr6,500
16. MiLLeNNiuM6,500
19. ai_ja_nai6,300
20. WizRd-Li...6,275
21. gheist5,825
22. jools5,800
23. _jesper_5,600
24. mwecom...5,575
25. Redimido5,500

1. ahoffmann200,276
2. ravenpl110,775
3. jlevie95,810
4. Blaz73,571
5. Redimido71,848
6. noci67,844
7. kblack0565,801
8. omarfarid48,131
9. fosiul0147,936
10. shakoush...47,887
11. KeremE39,963
12. Nopius36,400
13. Tintin35,905
14. xDamox32,605
15. wesly_c...31,085
16. decoleur29,587
17. XoF28,530
18. Mysidia25,470
19. DaveHowe23,514
20. slyong21,932
21. pjedmond21,733
22. giltjr19,930
23. chris_cal...19,816
24. uetian170717,515
25. rindi16,950

SSH users unable to change passwords upon expiration

Asked by CCBIL in Linux Network Security, Red Hat Linux, Linux

Tags: CentOS 5.3, RHEL 5.3, PAM, OpenSSH

About this solution