After setting up ldap authentication with pam in debian, evertything works fine.Using the passwd command change the ldap password of the current user.The problem is my ldap has been set up with an admin account and a root account with admin rights. For historical reasons I cannot change this.How can I make passwd change only the local password for root, and not the ldap one ?Here is the pam config:account sufficient pam_ldap.soaccount sufficient pam_unix.so try_first_passaccount [success=2 new_authtok_reqd=done default=ignore]        pam_unix.soaccount [success=1 default=ignore]      pam_ldap.soaccount requisite                       pam_deny.soaccount required                        pam_permit.soauth sufficient pam_ldap.soauth required pam_unix.so nullok_secure try_first_passauth    [success=2 default=ignore]      pam_unix.so nullok_secureauth    [success=1 default=ignore]      pam_ldap.so use_first_passauth    requisite                       pam_deny.soauth    required                        pam_permit.sopassword sufficient pam_ldap.sopassword required pam_unix.so nullok obscure min=4 max=8 md5 try_first_passpassword        [success=2 default=ignore]      pam_unix.so obscure sha512password        [success=1 user_unknown=ignore default=die]     pam_ldap.so use_authtok try_first_passpassword        requisite                       pam_deny.sopassword        required                        pam_permit.sosession [default=1]                     pam_permit.sosession requisite                       pam_deny.sosession required                        pam_permit.sosession required        pam_unix.sosession optional                        pam_ldap.sosession optional                        pam_ck_connector.so nox11session required pam_mkhomedir.so skel=/etc/skel/ umask=0022session [default=1]                     pam_permit.sosession requisite                       pam_deny.sosession required                        pam_permit.sosession required        pam_unix.sosession optional                        pam_ldap.so
Prevent root password change in ldap - debian
root;pam;ldap
Ok, so after some lobbying, I modified the root account:dn: uid=root,ou=people,dc=nope,dc=comchangetype: modrdnnewrdn: uid=administratordeleteoldrdn: 1Now I don't have any problem anymore.