Presence of comments in pam-configs/ file cause several warnings when
invoking command `pam-auth-updates` (use of uninitialized value), and
then later the PAM configuration is broken:
- SSH login fails immediately (connection closed)
- opening a session with `sudo su -` is impossible (authorisation refused)
- and maybe more...
Without comments in /usr/share/pam-configs/yourdev, everything works as
expected, no warnings in `pam-auth-updates`, no authentication problems.
Properties 'Password:' and 'Password-Initial:' are intentionally removed
from /usr/share/pam-configs/yourdev because changing a remote password
from the host using standard commands does not work in the Orange
environment : it changes the password in the Active Directory backend,
but not in the Gassi backend (they are not synchronized), and you end
up with two active passwords: the new one for kinit, IMAP, SMTP, SMB,
etc. and the old one for all websites from MonSI ...
With this configuration, you must use first the 'mot de passe attitude'
website to change your AD/Gassi password, and then the command `passwd`
to synchronize your local password.
With default priority (128), pam-auth-update put module pam_sss after
module pam_unix in /etc/pam.d/common-auth, and then a user with a
local account and local password synchronized with AD password will
never be granted a Kerberos TGT on session opening.
