> This are the tested passwd chats: > > passwd program = /usr/bin/passwd %u > ; passwd chat = *Password:* %o\n *Enter\snew\sUNIX\spassword:* %n\n > *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* . > passwd chat = *Password:* %o\n *"Enter new password:"* %n\n *"Enter > it again:"* %n\n *"passwd: password updated successfully"* . > pam password change = yes
I don't understand why you define "pam password change" and "passwd program" with "passwd chat". You want "pam password change" or "unix password sync" with ( "passwd program" and "passwd chat" ). I have it this way: unix password sync = yes passwd program = /usr/kerberos/sbin/kadmin.local -q 'cpw %u' passwd chat = "Authenticating as principal*"\n"Enter password for principal *"%u"*:*" %n\n \n"Re-enter password for principal *"%u"*:*" %n\n \n"Password for *"%u"@* changed."\n I have kdc on the same machine as samba PDC. I think there are more ways where kdc is running on another machine then samba PDC. I don't know if kerberos needs original password when it change password for user as root throught pam (but I think it needs some password). I have never used it this way. Regards, Luf -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba