Re: LDAP and PAM: account is expired, but pam_ldap allows authentification

2011-01-13 Thread Howard Chu
Indexer wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 shadowExpire shadowLastChange shadowMin shadowMax to make the account expired (OpenLDAP used to run NT domain), but when I ssh to a server using pam_ldap authentication, it is still allowed to login. This look to be a question

Re: LDAP and PAM: account is expired, but pam_ldap allows authentification

2011-01-13 Thread Indexer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 It was obvious that he was not asking why doesn't my pam_ldap talk to my OpenLDAP server. Missing elements from the user objects is a *data* problem, it is not an interoperability problem. He would have the same issue whether the server was

LDAP and PAM: account is expired, but pam_ldap allows authentification

2011-01-12 Thread Konstantin Boyandin
Hello, Could someone direct me to the source of wisdom to solve this: I have set correctly the fields (attributes) shadowExpire shadowLastChange shadowMin shadowMax to make the account expired (OpenLDAP used to run NT domain), but when I ssh to a server using pam_ldap authentication, it is

Re: LDAP and PAM: account is expired, but pam_ldap allows authentification

2011-01-12 Thread Indexer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 13/01/2011, at 17:45, Konstantin Boyandin wrote: Hello, Could someone direct me to the source of wisdom to solve this: I have set correctly the fields (attributes) shadowExpire shadowLastChange shadowMin shadowMax to make the

Re: LDAP and PAM: account is expired, but pam_ldap allows authentification

2011-01-12 Thread Howard Chu
Konstantin Boyandin wrote: Hello, Could someone direct me to the source of wisdom to solve this: I have set correctly the fields (attributes) shadowExpire shadowLastChange shadowMin shadowMax to make the account expired (OpenLDAP used to run NT domain), but when I ssh to a server using

Re: LDAP and PAM: account is expired, but pam_ldap allows authentification

2011-01-12 Thread Chris Jacobs
I was thinking along the same lines: * is pam_password exop in your /etc/ldap.conf? * And passwd entry for nsswitch contains ldap? * Ditto for /etc/pam.d/system-auth-ac? - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA

Re: LDAP and PAM: account is expired, but pam_ldap allows authentification

2011-01-12 Thread Howard Chu
Indexer wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 13/01/2011, at 17:45, Konstantin Boyandin wrote: Hello, Could someone direct me to the source of wisdom to solve this: I have set correctly the fields (attributes) shadowExpire shadowLastChange shadowMin shadowMax to make the

Re: LDAP and PAM: account is expired, but pam_ldap allows authentification

2011-01-12 Thread Indexer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 shadowExpire shadowLastChange shadowMin shadowMax to make the account expired (OpenLDAP used to run NT domain), but when I ssh to a server using pam_ldap authentication, it is still allowed to login. This look to be a question where the