现在，如果我尝试添加一个非系统用户而不是在大学的Kerberos领域，无论如何我都会提示inputKerberos密码。 显然没有密码input，所以我只是按回车，看看：

passwd: Authentication token manipulation error passwd: password unchanged 

键入passwd newuser与同一个消息有相同的问题。

我试图使用pwconv ，希望只需要一个影子入口，但它没有改变。

我想能够添加一个本地用户不在领域，给他们一个本地的密码，而不用担心Kerberos。

• 与Apache和Kerberos问题的SSO
• 如何在2008服务器上启用Kerberos身份validation服务审核
• kinit：获取初始凭证时，无法联系任何KDC进行领域“UBUNTU”
• 我怎样才能按组限制kerberos服务门票？
• 为Linux KDC Realm设置Windows 10客户端

我在Ubuntu 10.04上。 这里是我的/etc/pam.d/common-*文件（Ubuntu的pam-auth-update软件包生成的默认文件）：

将/etc/pam.d/common-account

 # here are the per-package modules (the "Primary" block) account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so # here's the fallback if no module succeeds account requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around account required pam_permit.so # and here are more per-package modules (the "Additional" block) account required pam_krb5.so minimum_uid=1000 # end of pam-auth-update config 

将/etc/pam.d/common-auth

 # here are the per-package modules (the "Primary" block) auth [success=2 default=ignore] pam_krb5.so minimum_uid=1000 auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass # here's the fallback if no module succeeds auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config 

/etc/pam.d/common-password

 # here are the per-package modules (the "Primary" block) password requisite pam_krb5.so minimum_uid=1000 password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512 # here's the fallback if no module succeeds password requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around password required pam_permit.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config 

/etc/pam.d/common-session

 # here are the per-package modules (the "Primary" block) session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # and here are more per-package modules (the "Additional" block) session optional pam_krb5.so minimum_uid=1000 session required pam_unix.so # end of pam-auth-update config