Re: [389-users] sshd/pam_ldap not honoring passwordMustChange

2011-06-20 Thread David Barr
passwordExpirationTime might be the root of the problem. 1) Set the user's password in the Console via right-click and "Properties." Click "Okay." 2) Open Advanced Properties and note that passwordExpirationTime is 1970010101Z. 3) Log in as the test user with the reset password. The login is

Re: [389-users] sshd/pam_ldap not honoring passwordMustChange

2011-06-15 Thread Aaron Hagopian
I have not seen or used the passwordMustChange attribute before but I can tell you that if you set the passwordExpirationTime as following: passwordExpirationTime: 1970010100Z It should force the user to change their password on their next login. Keep in mind you will not get a prompt if us

[389-users] sshd/pam_ldap not honoring passwordMustChange

2011-06-14 Thread David Barr
I know this is outside the scope of the 389 list, but my Google-fu is failing me on this one. If I change the password to the account on the LDAP server and verify "passwordmustchange: on," I can ssh in to the test host with the new password all day long, and never get asked to change it. I'm hop