I'm in the process of testing out sssd on a CentOS 6 install using Active Directory for user authentication via sssd
All appears to be working fine - however, when I change a user password using 'passwd' (or at login when the account has expired etc), it appears pam_cracklib is being over-zealous with the new password requirements
Active Directory is set up with a password policy - but pam_cracklib (and may be other PAM modules?) have stronger password policies
So, I would like passwd to use the AD password requirements - and ignore any pam_cracklib requirements
The password settings in the system-auth and password-auth PAM config files are (as generated by authconfig):
password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so
If I comment out the pam_cracklib line (and remove 'use_authtok' from the other lines) - it appears to do what I want - but doesn't seem 'correct' to me - i.e. what would happen if there were any local users defined on the system?
Does anyone have any suggestions on how PAM should be configured to allow password changes to 'honour' the Active Directory password policy requirements - but still impose requirements on non-AD users?
Thanks
James Pearson