5

I'm a "backup" sysadmin for a small team, and the primary sysadmin is unavailable. The lab setup is a little bit new to me, and I'm not familiar with everything about how it's setup yet (and my Linux sysadmin skills are probably a little out of date). I was asked to reset a password for a user, and I thought "great, that's just passwd -e username". Unfortunately, this gives me:

# /usr/bin/passwd jdoe
Changing password for user jdoe.
Password reset by root is not supported.
passwd: Authentication token manipulation error

At first I thought I just need to use ldappasswd instead, but apparently it's not using LDAP (/usr/bin/ldappasswd does not exist and the command is not found on the system). Finally, I checked /etc/nsswitch.conf, and saw this:

passwd:     files sss
shadow:     files sss
group:      files sss

Additional info: This system (and most of my lab network) is running on CentOS release 6.6.

Ok, I guess my Linux skills are a little bit inadequate or rusty. What is "sss"? And how do I accomplish a simple password reset on this system?

Updated Information: I am attempting to reset the password as the root user (yeah, not the best security setup that we have root login enabled and not sudo for the lab admins, but I'm just the backup guy...I can only try to influence). What appear to be the relevant lines from /etc/sssd/sssd.conf are (best guess, as I said, I'm rusty on some things, like IPA):

ipa_domain = sub.domain.mycompany.com
id_provider = ipa
auth_provider = ipa
ldap_autofs_entry_object_class = automount
access_provider = ipa
ipa_hostname = node6.sub.domain.mycompany.com
chpass_provider = ipa
ldap_autofs_entry_key = automountKey
ipa_server = ipa1.sub.domain.mycompany.com, ipa2.sub.domain.mycompany.com
4
  • Was your username granted sudo rights?
    – Ramhound
    May 15, 2017 at 23:48
  • Provide us the contents of nslcd.conf
    – Ramhound
    May 15, 2017 at 23:56
  • Did you try man sssd? Do you have an sssd.conf file somewhere in /etc? May 16, 2017 at 0:24
  • I can't find an nslcd.conf file, but I did post what appeared to be the relevant contents of the /etc/sssd/sssd.conf file. The server ipa1 has all the expected LDAP commands installed, and I might be able to figure it out from here. But I'll let one of you fine folks post an answer to claim credit if you wish. May 16, 2017 at 12:28

1 Answer 1

6

The clues start with knowing that the /etc/nsswitch.conf file on the system is used to configure the Name Service Switch facility in Linux. From wikipedia:

The Name Service Switch (NSS) is a facility in Unix-like operating systems that provides a variety of sources for common configuration databases and name resolution mechanisms. These sources include local operating system files (such as /etc/passwd, /etc/group, and /etc/hosts), the Domain Name System (DNS), the Network Information Service (NIS), and LDAP.

This line from the /etc/nsswitch.conf file lets us know that the Linux "System Security Services" (sss) is the provider for user passwords and related functions.

passwd:     files sss

The next clue comes from the contents of /etc/sssd/sssd.conf. The man page for this configuration file tells us about the chpass_provider entry, and for me that is ipa:

chpass_provider = ipa

And this line lets us know what server(s) are responsible for running the ipa services:

ipa_server = ipa1.sub.domain.mycompany.com, ipa2.sub.domain.mycompany.com

Finally, I just had to log on to ipa1.sub.domain.mycompany.com, where I see that ipa is indeed installed, as well as LDAP. A couple judicious internet searches led me to this Redhat page pertaining to managing passwords via IPA, that gave me these helpful steps:

$ kinit admin
$ ipa user-mod jsmith --password

Voila, done! Lesson learned: My lab system is kind of a hodge-podge of servers configured in a (perhaps) non-standard way, but a couple knowledgeable people can give you some clues to point you in the right direction, and following the bread crumbs and doing some Internet searches will hopefully reveal the answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .