possible issue with pam

[KC Somaratne]

On Tue, Dec 02, 2003 at 11:17:41PM -0500, Barry Hawkins wrote:
>> List,
>>      Hello.  I have recently begun to encounter an issue with changing
>> passwords on my 5.1 installation.  I haven't touched anything on it for
>> a few months, and the last change-related activity I had were some
>> portupgrade tasks to rid myself of the libintl.so.4 issue solved with
>> "portupgrade -R gettext" back around September 2003.  I am wondering if
>> anyone has experienced an issue similar to mine.
>>      When I attempt to use passwd to change my password, I get the
>> following upon successfully re-typing the password:
>>
>> passwd: entry inconsistent
>> passwd: pam_chauthtok(): error in service module
>>
>>      If anyone has insight on this I would be grateful.  A search of the
>> list for pam_chauthtok only revealed one person asking a similar
>> question related to yppasswd.
>
> Compare your /etc/pam.d configuration against the sources in
> /usr/src/etc/pam.d to make sure you have not damaged your pam
> configuration by mis-merging changes.  Also make sure you have no
> /etc/pam.conf file, which was removed a long time ago.
>
> Kris

Hi,

I've had a similar issue with a FreeBSD 5.2.1-RELEASE box for an
account belonging to the 'wheel' group. I last changed the password
for this account successfully roughly two months ago and since then I
haven't changed anything at all (AFAIK..!).

Now when I try to change the password for this account using root, it
prompts me with the below error message.

 root:/etc#passwd <user_name>
 Changing local password for <user_name>
 New Password:
 Retype New Password:
 passwd: entry inconsistent
 passwd: pam_chauthtok(): error in service module

I get the same error message when trying to change the password after
logging in using
the same user account as well.

I have carefully verified that I did indeed enter the same string for
the password verification. I have also done the checks being recommended
in the above mail.

The only differences are the /etc/pam.d has an additional file 'ftp'.
The /usr/src/etc/pam.d contain two additional files Makefile &
convert.pl.

Appreciate any suggestions on what might be causing this behaviour and
how I might be able to resolve the problem. Also, is this at all any
sign of my system being compromised?

Thanks in advance,
-kc,