Bug 667758

Description of problem:
When a user is authenticated (PAM auth), if it is found that their password has expired, they will be asked to change their password (PAM password PAM_CHANGE_EXPIRED_AUTHTOK).
If pam_cracklib is part of the PAM password stack, it will be used to ensure that the user chooses and adequately strong password per a configurable policy.
First, it will be checked against cracklib.
Next, it will be checked for further strength (using _pam_unix_approve_pass) _but_ only if pam_cracklib can obtain the old password (PAM_OLDAUTHTOK) for the user.
These further strength checks are what enforce most of the pam_cracklib configurable policy and a simple check to make sure the new password is different than the old one.

This all works well for UNIX accounts (handled by pam_unix) but not for LDAP accounts (handled by pam_ldap) because pam_ldap does not authenticate the user (set PAM_OLDAUTHTOK for pam_cracklib).

The difference between pam_unix and pam_ldap in this regard is that pam_unix will force an authentication of root (getuid() == 0) if the password is being changed as part of a PAM_CHANGE_EXPIRED_AUTHTOK operation.

Version-Release number of selected component (if applicable):
RHEL 4.5 nss_ldap-226-18
RHEL 5.5 nss_ldap-253-25.el5
and, I suppose everything between and earlier.

How reproducible:
Every time


Steps to Reproduce:
1. Start with RHEL default PAM configuration (/etc/pam.d/) 
2. Configure PAM with authconfig --enableldap
3. Expire your pam_ldap/LDAP based account
4. Login to the console tty
5. Change password by reusing the same old password
6. pam_cracklib should not allow reuse of the same old password
  
Actual results:
Password: 
You are required to change your password immediately (password aged)
You are required to change your LDAP password immediately.
New password: 
Retype new password: 
LDAP password information changed

Expected results:
Password: 
You are required to change your password immediately (password aged)
You are required to change your LDAP password immediately.
Enter login(LDAP) password: 
New password: 
Password unchanged
New password:

Additional info:
RHEL 4.5
/etc/pam.d/system-auth

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/$ISA/pam_unix.so broken_shadow
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid < 10000 quiet
account     [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_ldap.so
account     required      /lib/security/$ISA/pam_permit.so

password    requisite     /lib/security/$ISA/pam_cracklib.so debug retry=3 type= lcredit=-2 ucredit=-2 dcredit=-2 ocredit=-2 minlen=15
password    sufficient    /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow remember=5
password    sufficient    /lib/security/$ISA/pam_ldap.so debug use_authtok
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_ldap.so

----

Find simple patch for (RHEL 4.5 nss_ldap-226-18) pam_ldap.c attached.