diff -Nru heimdal-1.4.0+bzr26145+lorikeet26157~ppa25887+25884~maverick1/debian/bzr-builder.manifest heimdal-1.4.0+bzr26153+lorikeet26157~ppa25887+25884~maverick1/debian/bzr-builder.manifest
--- heimdal-1.4.0+bzr26145+lorikeet26157~ppa25887+25884~maverick1/debian/bzr-builder.manifest	2011-07-28 20:48:21.000000000 +0000
+++ heimdal-1.4.0+bzr26153+lorikeet26157~ppa25887+25884~maverick1/debian/bzr-builder.manifest	2011-07-30 20:51:22.000000000 +0000
@@ -1,5 +1,5 @@
-# bzr-builder format 0.3 deb-version 1.4.0+bzr26145+lorikeet26157~ppa25887+25884
-lp:heimdal revid:git-v1:c9d24dffde57a1f38f7d613044754fe9d1f25bcb
+# bzr-builder format 0.3 deb-version 1.4.0+bzr26153+lorikeet26157~ppa25887+25884
+lp:heimdal revid:git-v1:63672067ea1d5f2bde8533aa243aaf707ded00d1
 merge packaging lp:~vcs-imports/heimdal/experimental revid:git-v1:7c51118596b7052762df7faf58e99eb0f268900f
 merge ppa lp:~samba-team/heimdal/ppa-daily revid:jelmer@samba.org-20110102014211-avy7zb7drqoieufy
 merge lorikeet lp:~samba-team/heimdal/lorikeet revid:git-v1:0fdf11fa3cdb47df9f5393ebf36d9f5742243036
diff -Nru heimdal-1.4.0+bzr26145+lorikeet26157~ppa25887+25884~maverick1/debian/changelog heimdal-1.4.0+bzr26153+lorikeet26157~ppa25887+25884~maverick1/debian/changelog
--- heimdal-1.4.0+bzr26145+lorikeet26157~ppa25887+25884~maverick1/debian/changelog	2011-07-28 20:48:21.000000000 +0000
+++ heimdal-1.4.0+bzr26153+lorikeet26157~ppa25887+25884~maverick1/debian/changelog	2011-07-30 20:51:22.000000000 +0000
@@ -1,8 +1,8 @@
-heimdal (1.4.0+bzr26145+lorikeet26157~ppa25887+25884~maverick1) UNRELEASED; urgency=low
+heimdal (1.4.0+bzr26153+lorikeet26157~ppa25887+25884~maverick1) UNRELEASED; urgency=low
 
   * Auto build.
 
- -- Launchpad Package Builder <noreply@launchpad.net>  Thu, 28 Jul 2011 20:48:21 +0000
+ -- Launchpad Package Builder <noreply@launchpad.net>  Sat, 30 Jul 2011 20:51:22 +0000
 
 heimdal (1.4.0+git20101228.dfsg.1-2) UNRELEASED; urgency=low
 
diff -Nru heimdal-1.4.0+bzr26145+lorikeet26157~ppa25887+25884~maverick1/kadmin/server.c heimdal-1.4.0+bzr26153+lorikeet26157~ppa25887+25884~maverick1/kadmin/server.c
--- heimdal-1.4.0+bzr26145+lorikeet26157~ppa25887+25884~maverick1/kadmin/server.c	2011-07-28 20:47:56.000000000 +0000
+++ heimdal-1.4.0+bzr26153+lorikeet26157~ppa25887+25884~maverick1/kadmin/server.c	2011-07-30 20:50:58.000000000 +0000
@@ -235,14 +235,17 @@
 
 	/*
 	 * The change is allowed if at least one of:
-
-	 * a) it's for the principal him/herself and this was an
+	 *
+	 * a) allowed by sysadmin
+	 * b) it's for the principal him/herself and this was an
 	 *    initial ticket, but then, check with the password quality
 	 *    function.
-	 * b) the user is on the CPW ACL.
+	 * c) the user is on the CPW ACL.
 	 */
 
-	if (initial
+	if (krb5_config_get_bool_default(contextp->context, NULL, TRUE,
+					 "kadmin", "allow_self_change_password", NULL)
+	    && initial
 	    && krb5_principal_compare (contextp->context, contextp->caller,
 				       princ))
 	{
diff -Nru heimdal-1.4.0+bzr26145+lorikeet26157~ppa25887+25884~maverick1/lib/krb5/context.c heimdal-1.4.0+bzr26153+lorikeet26157~ppa25887+25884~maverick1/lib/krb5/context.c
--- heimdal-1.4.0+bzr26145+lorikeet26157~ppa25887+25884~maverick1/lib/krb5/context.c	2011-07-28 20:47:56.000000000 +0000
+++ heimdal-1.4.0+bzr26153+lorikeet26157~ppa25887+25884~maverick1/lib/krb5/context.c	2011-07-30 20:50:58.000000000 +0000
@@ -882,11 +882,7 @@
 	ETYPE_AES256_CTS_HMAC_SHA1_96,
 	ETYPE_AES128_CTS_HMAC_SHA1_96,
 	ETYPE_DES3_CBC_SHA1,
-	ETYPE_DES3_CBC_MD5,
 	ETYPE_ARCFOUR_HMAC_MD5,
-	ETYPE_DES_CBC_MD5,
-	ETYPE_DES_CBC_MD4,
-	ETYPE_DES_CBC_CRC,
 	ETYPE_NULL
     };
     return p;