chrisspenblog

knowledge through programming

I was doing some work with an inherited Kerberos setup, when I noticed my Kerberos-based SVN login suddenly stopped working. Attempting to ssh into the machine revealed the cause:

WARNING: Your password has expired.
You must change your password now and login again!

Fair enough. I personally find password expiration a huge annoyance that provides no real security, but sure, why not. So I proceed with the default prompts, only to encounter:

Changing password for user myuser.
Kerberos 5 Password:
New password:
Retype new password:
passwd: Authentication token manipulation error

Fortunately (or unfortunately), this is a common if unhelpfully ambiguous error. Several people have posted theories for the underlying cause as well as fixes. Of course, none of the solutions worked for me. Having done a little maintenance work on the system before, I had root access to the machine, so one solution I found was to login as root and run `kpasswd myuser`. Apparently, even though it’s Kerberos detecting that my password has expired, it was using the default Linux `passwd` tool, and not the Kerberos-equivalent `kpasswd`.

Filed under: Linux