Using the "change password" feature of pam_sss modules always lead to a
bad situation where AD password and Gassi password are not synchronyzed
anymore. To avoid this, we disable the feature in SSSD configuration.
The network password can still be changed using the command `kpasswd`
provided by package `krb5-user`.
Properties 'Password:' and 'Password-Initial:' are intentionally removed
from /usr/share/pam-configs/yourdev because changing a remote password
from the host using standard commands does not work in the Orange
environment : it changes the password in the Active Directory backend,
but not in the Gassi backend (they are not synchronized), and you end
up with two active passwords: the new one for kinit, IMAP, SMTP, SMB,
etc. and the old one for all websites from MonSI ...
With this configuration, you must use first the 'mot de passe attitude'
website to change your AD/Gassi password, and then the command `passwd`
to synchronize your local password.
I would have preferred something shorter like "trespassers will be shot",
but it seems that it is better to quote an article of the criminal code.
Note: the text of the banner is automatically wrapped by GDM, the use
of line breaks is not required.
With default priority (128), pam-auth-update put module pam_sss after
module pam_unix in /etc/pam.d/common-auth, and then a user with a
local account and local password synchronized with AD password will
never be granted a Kerberos TGT on session opening.
According to pam-auth-update(8), it is an error to use option --force
in postinst script:
This option must not be used by package maintainer scripts;
it is intended for use by administrators only.
