Red Hat Bugzilla – Bug 1089250
Expired shadow policy user(shadowLastChange=0) is not prompted for password change
Last modified: 2015-03-05 05:27:47 EST
Description of problem: User with expired shadow policy is not prompted for password change when shadowLastChange is 0 Version-Release number of selected component (if applicable): sssd-1.11.2-65.el7 How reproducible: Always Steps to Reproduce: 1. Disable any server side password policies. 2. Set ldap_pwd_policy = shadow in sssd.conf [domain/LDAP] debug_level = 0xFFF0 id_provider = ldap ldap_uri = ldap://<ldapserver> ldap_tls_cacert = /etc/openldap/certs/cacert.asc ldap_search_base = dc=example,dc=com ldap_pwd_policy = shadow 3. Set shadowLastChange to 0 in the user ldap attribute. # ldapsearch -x -LLL -h <ldapserver> -b "dc=example,dc=com" uid=shadowuser1 dn: uid=shadowuser1,ou=People,dc=example,dc=com uid: shadowuser1 cn: shadowuser1 objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 0 shadowMin: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 9901 gidNumber: 9901 homeDirectory: /home/shadowuser1 4. Auth as the user # ssh -l shadowuser1 localhost shadowuser1@localhost's password: Permission denied, please try again. shadowuser1@localhost's password: Actual results: Password change prompt does not appear. /var/log/sssd/sssd_LDAP.log shows: (Fri Apr 18 06:35:22 2014) [sssd[be[LDAP]]] [find_password_expiration_attributes] (0x4000): Found shadow password expiration attributes. .. (Fri Apr 18 06:35:22 2014) [sssd[be[LDAP]]] [check_pwexpire_shadow] (0x0100): Last change day is not set, new password needed. (Fri Apr 18 06:35:22 2014) [sssd[be[LDAP]]] [sdap_pam_auth_done] (0x0020): check_pwexpire_shadow failed. /var/log/secure shows: Apr 18 06:35:22 beast sshd[18105]: pam_sss(sshd:auth): received for user shadowuser1: 4 (System error) Expected results: Password change prompt should appear. Additional info: With server side password policies enabled, the following is seen: # ssh -l shadowuser1 localhost shadowuser1@localhost's password: Your password has expired. You have 1 grace login(s) remaining. [shadowuser1@ibm-z10-51 ~]$
Upstream ticket: https://fedorahosted.org/sssd/ticket/2323
This looks like a regression in 1.11 version of sssd. I tried this on rhel6.5 and saw the password prompt appearing: # ssh -l shadowuser1 localhost shadowuser1@localhost's password: Password expired. Change your password now. WARNING: Your password has expired. You must change your password now and login again! Changing password for user shadowuser1. Current Password:
master: 06ba69972e6728f97f5adbcc3cc4df811a831f53 sssd-1-11: 7454855b9b5117a13fe86fb93b9cc870323ccd20
Verified with version 1.12.2-12.el7 Output from beaker automation run: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: shadow7: bz 1089250 Account expired :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: modifying entry "uid=shadowuser1,ou=Users,dc=example,dc=com" Redirecting to /bin/systemctl stop sssd.service Redirecting to /bin/systemctl start sssd.service spawn ssh -o StrictHostKeyChecking=no -l shadowuser1 localhost shadowuser1@localhost's password: Password expired. Change your password now. WARNING: Your password has expired. You must change your password now and login again! Changing password for user shadowuser1. Current Password: New password: Retype new password: :: [ PASS ] :: File '/var/log/sssd/sssd_LDAP.log' should contain 'Found shadow password expiration attributes' :: [ PASS ] :: File '/var/log/sssd/sssd_LDAP.log' should contain 'Last change day is not set, new password needed' :: [ PASS ] :: File '/var/log/sssd/sssd_LDAP.log' should contain 'Initial authentication for change password operation successful' modifying entry "uid=shadowuser1,ou=Users,dc=example,dc=com" modifying entry "uid=shadowuser1,ou=Users,dc=example,dc=com" shadow7 result: PASS
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0441.html