Alexander Skwar wrote:
> Douglas E. Engert wrote:
>


>
>> the getpw.c program I sent yesterday should return (assuming the username
>> is not also in the local /etc/passwd file):
>> useranme:x:...
>> username:crypted-password:...

>
> Ah!
>
> --($:~/Source/pamtest)-- sudo ./getpw askwar
> STDC = __STDC__
> askwar:x:10001:10:Alexander Skwar,alexander.skwar@Exampleauto.com:/export/home/askwar:/opt/csw/bin/bash
> askwar:cd9--------psA:13503:-1:-1-1:-1:-1:0
>
> --($:~/Source/pamtest)-- sudo ./getpw testing
> STDC = __STDC__
> testing:x:54321:10:Alexander Skwar,alexander.skwar@Exampleauto.com:/export/home/testing:/opt/csw/bin/bash
> testing:*NP*:-1:-1:-1-1:-1:-1:0
>
> *NP* for testing? Why's that? Why's there a difference?



This could be the problem. NP is used for OK to login if you can
authenticate some other way. *NP* may be considered locked,
as * is not a valid crypt character.

Try using ldapmodify to change the password to {crypt}NP

See of you can get the phpLdapAdmin to add NP rather then *NP*
Or set some valid password.



>
> Hmm....
>
> --($:~/Source/pamtest)-- sudo grep test /etc/shadow
>
> --($:~/Source/pamtest)-- sudo grep askwar /etc/shadow
> askwar:cd,,,,,,QkpsA:13503::::::
>
> Ah. askwar is in shadow.
>
> Now I removed askwar from /etc/shadow. And, lo and behold, I'm no longer
> able to do a password-less login to the system. Great! Just the way it
> is documented! Excellent! Also good to see, that it really didn't have
> anything to do with LDAP.
>
> Now I just got to curse at Sun for requiring a password. I guess I need
> to have a look at lpk, OpenSSH LDAP Public Key.
>
> Douglas, and others, thanks a million for bearing with me and helping
> me to finally find the difference! I very much appreciate it!
>
> Alexander Skwar
>
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev@mindrot.org
> https://lists.mindrot.org/mailman/li...enssh-unix-dev
>
>


--

Douglas E. Engert
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/li...enssh-unix-dev