Desultory remarks about everything that comes across.

• Home
• About

Flagword.net

36 Responses

Subscribe to comments via RSS

1. Written by Flagword.net » How to setup Solaris 10 ldap client and glue it with ssh
   on July 11, 2013 at 8:58 pm
   Reply · Permalink

   […] I wrote a post about configuring OpenLDAP server with TLS support using RHEL available here. In that post I also mentioned how to setup Linux OPenLDAP client to authenticate using LDAP […]

2. Written by Greg
   on February 11, 2014 at 12:18 am
   Reply · Permalink

   Hi:
   I follow your guideline to load module.ldif, ppolicy_overlay.ldif and ppolicy.ldif, but somehow the account is not locked even the pwdAccountLockedTime does show the timestamp in it. Any help how to debug it?
   Thank for the help.

   • Written by sergeyt
     on February 11, 2014 at 8:54 am
     Reply · Permalink

     Hi Greg,

     If you see that pwAccountLockedTIme was set then from the OpenLDAP server’s point of view everything works just fine an account has been locked indeed.
     From “man slapo-ppolicy”:

     pwdAccountLockedTime
     This attribute contains the time that the user’s account was locked.

     You just need to enforce the password policy from the client’s side – a server where a user tries to log into – by updating /etc/ldap.conf (if you run RHEL5 or any other distro which uses pam_ldap) and adding “pam_lookup_policy yes” and “pam_password exop”. The latter option is required to specify a password change protocol to use.
     For RHEL6, which uses sssd to manage access to remote directories and authentication mechanisms, no extra actions are required since it respects pwdAccountLockedTime attribute: – [SSSD] Support for pwdAccountLockedTime
     For password expiration “ldap_pwd_policy” option could be added to [domain/LDAP] section in /etc/sssd/sssd.conf which is set to “none” by default. From “man sssd-ldap”:

     ldap_pwd_policy
     ldap_pwd_policy (string)
     Select the policy to evaluate the password expiration on the client side. The following values are allowed:

     none – No evaluation on the client side. This option cannot disable server-side password policies.
     shadow – Use shadow(5) style attributes to evaluate if the password has expired.
     mit_kerberos – Use the attributes used by MIT Kerberos to determine if the password has expired. Use chpass_provider=krb5 to
     update these attributes when the password is changed.

     Default: none

     Hope that helps.

     Kind regards,
     Sergey

     Thank you.

3. Written by Greg
   on February 12, 2014 at 1:59 am
   Reply · Permalink

   Hi:
   Thanks for the reply. I will try it on the client. I am running CentOS 6.4 and using /etc/pam_ldap.conf and /etc/nslcd.conf, but not using sssd. Will that make any difference? Also, how to delete module.ldif inside cn=config directory. I use ldapadd multiple times and create multiple duplicate. I also create multiple duplicate ppolicy.ldif inside olcDatabase={1}bdb directory. Can I just rm those files without creating error or I have to use other ldap command to delete them? Thank you.

4. Written by Greg
   on February 12, 2014 at 3:56 am
   Reply · Permalink

   Hi:
   One more problem. When I test the failures login, the timestamp is around 20140211153648, but it shows pwdAccountLockedTime 20140211233648Z which is 8 more hours later. Which setting causes that? The slapd also hung after it finds the ppolicy_bind: Setting warning for password expiry for cn=……,dc=com = 0 seconds. Thank you for the help.

   • Written by sergeyt
     on February 12, 2014 at 9:35 am
     Reply · Permalink

     Hi Greg,

     I am running CentOS 6.4 and using /etc/pam_ldap.conf and /etc/nslcd.conf, but not using sssd. Will that make any difference?

     No, definitely not as it should work with both good old pam_ldap and sssd.

     Also, how to delete module.ldif inside cn=config directory. I use ldapadd multiple times and create multiple duplicate. I also create multiple duplicate ppolicy.ldif inside olcDatabase={1}bdb directory. Can I just rm those files without creating error or I have to use other ldap command to delete them?

     Frankly speaking I’ve never done that before but think you should be able to remove all the duplicates simply by using “rm”. Note that by doing so, a server restart might be required to force it to re-read its configuration. Personally, I’d prefer to use ldapmodify instead.
     Run the following two commands to get a list of all ppolicy overlays and olcModuleList:

     ldapsearch -x -H ldaps://your_ldap_server -b "cn=config" -D "cn=config" -LLL -w your_password "objectClass=olcModuleList"
     ldapsearch -x -H ldaps://your_ldap_server -b "cn=config" -D "cn=config" -LLL -w your_password "objectClass=olcPPolicyConfig"
     

     From the output pick DNs you’d like to remove, e.g:

     dn: cn=module{1},cn=config
     dn: olcOverlay={0}ppolicy,olcDatabase={2}bdb,cn=config
     

     Create a simple text file, lets say rmduplicates.ldif, with the following content:

     dn: cn=module{1},cn=config
     changetype: delete
     
     dn: olcOverlay={0}ppolicy,olcDatabase={2}bdb,cn=config
     changetype: delete
     

     And run ldapmodify:

     ldapmodify -H ldaps://your_ldap_server -x -W -D "cn=manager,dc=...,dc=..." -f ./rmduplicates.ldif
     

     After that run ldapsearch as mentioned previously to confirm that there are no more duplicates.

     it shows pwdAccountLockedTime 20140211233648Z which is 8 more hours later.

     Short answer – it’s UTC which is 8 hours ahead of your local time zone.
     pwdAccountLockedTime stores time in a generalizedtime format which “…consists of a string value representing the calendar date, as defined in ISO 8601..” (from wikipedia). ISO 8601 defines time zone designators and that capital “Z” at the end means UTC.

     The slapd also hung after it finds the ppolicy_bind: Setting warning for password expiry for cn=……,dc=com = 0 seconds.

     Do you run multiple LDAP servers in a mirror mode or just a single LDAP server? Are there any error messages in the LDAP server’s log file.
     You migh need to setup a syslog and forward local4 syslog facility (used by OpenLDAP by default) to a local file:

     local4.*        /var/log/slapd/slapd.log
     

     Anyway, lets clean all the duplicates first and configure log output if that hasn’t been already done.

     Cheers.

     BR,
     Sergey

5. Written by Greg
   on February 12, 2014 at 11:17 am
   Reply · Permalink

   Hi:
   Thanks for the help. Is there a way to change the time not 8 hours later? I will like to see the immediate effect. Also, thanks for the help on rm the duplicate ppolicy. I think I am close to make this work. Thank you for the help.

   • Written by sergeyt
     on February 12, 2014 at 11:56 am
     Reply · Permalink

     Hi Greg,

     You’re absolutely welcome.

     Is there a way to change the time not 8 hours later? I will like to see the immediate effect.

     The net result is immediate, meaning that an account is locked without an 8 hours delay, it’s just because pwdAccountLockedTime is stored in a generalizedtime format (and OpenLDAP uses UTC) you see it as 8 hours ahead and you can’t change that since this is how it’s defined in a ppolicy schema:

      (  1.3.6.1.4.1.42.2.27.8.1.17
                   NAME ’pwdAccountLockedTime’
                   DESC ’The time an user account was locked’
                   SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
                   EQUALITY generalizedTimeMatch
                   ORDERING generalizedTimeOrderingMatch
                   SINGLE-VALUE
                   NO-USER-MODIFICATION
                   USAGE directoryOperation)
     

     Cheers.

     BR,
     Sergey

6. Written by Greg
   on February 13, 2014 at 1:06 am
   Reply · Permalink

   Hi:
   I saw this log in the server side
   ppolicy_bind: Setting warning for password expiry for cn=someuser,ou=People,dc=example,=com = 0 seconds
   and I add these two lines in /etc/pam_ldap.conf
   pam_password exop
   pam_lookup_policy yes

   But the client side is not enforced to lock the user account.
   pwdAccountLockedTime and pwdFailureTime all shows timestamp on it. Do I have to chance other client file?
   Thank you for the help.

7. Written by Greg
   on February 13, 2014 at 6:05 am
   Reply · Permalink

   dn: cn=module{2}{1},cn=config

   dn: cn=module{4}{2},cn=config

   dn: cn=module{3},cn=config

   dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config

   dn: olcOverlay={2}ppolicy,olcDatabase={1}bdb,cn=config

   dn: olcOverlay={3}ppolicy,olcDatabase={1}bdb,cn=config

   I have those duplicates and I try your suggestion to delete, but run into this error.

   Enter LDAP Password:
   deleting entry “cn=module{2}{1},cn=config”
   ldap_delete: Server is unwilling to perform (53)

   Sorry that I have so many errors that I don’t know how to solve. Really thank you for your help.

   • Written by sergeyt
     on February 13, 2014 at 10:05 am
     Reply · Permalink

     Hi Greg,

     deleting entry “cn=module{2}{1},cn=config”
     ldap_delete: Server is unwilling to perform (53)

     Didn’t know myself that deleting from cn=config is not supported until OpenLDAP 2.5. See here and here.
     So the only way for you to delete the duplicates would be to stop slapd and manually delete them from /etc/openldap/slapd.d/cn\=config directory.
     Regarding the problem with password policy not being enforced, could, please, email the content of the following files to sergeyt at flagword.net:

     • /etc/pam_ldap.conf
     • /etc/pam.d/sshd
     • /etc/pam.d/password-auth
     • /etc/nsswitch.conf

     Don’t forget to strip out sensitive information from pam_ldap.conf, i.e. binddn and bindpw.

     Cheer.

     BR,
     Sergey

8. Written by Greg
   on February 15, 2014 at 7:42 am
   Reply · Permalink

   Hi:
   I finally make the ppolicy working in my openldap 2.4.23 on centos 6.4. I use sssd instead of pam_ldap and nslcd and modify the schemas, and then voila it works. But I still have one minor thing that needs to be done, which is the automount in sssd.conf. The automount worked when I use pam_ldap and nslcd. Can you help a little bit on this? This is my autofs.ldif that worked in pam_ldap/ nslcd.

   dn: ou=autofs,ou=Services,dc=lux,dc=com
   description: Automount maps
   objectClass: top
   objectClass: organizationalUnit
   ou: AutoFS

   dn: ou=auto.home,ou=autofs,ou=Services,dc=lux,dc=com
   objectClass: top
   objectClass: automountMap
   ou: auto.home

   dn: cn=/,ou=auto.home,ou=autofs,ou=Services,dc=lux,dc=com
   automountinformation: filer:/export/home/&
   cn: /
   objectClass: automount

   dn: ou=auto.master,ou=autofs,ou=Services,dc=lux,dc=com
   objectClass: top
   objectClass: automountMap
   ou: auto.master

   dn: cn=/home,ou=auto.master,ou=autofs,ou=Services,dc=lux
   ,dc=com
   automountinformation: ldap:filer:ou=auto.home
   cn: /home
   objectClass: top
   objectClass: automount

   I appreciate it for your help. This automount is my final piece to make it work. Thank you.

   • Written by sergeyt
     on February 15, 2014 at 2:58 pm
     Reply · Permalink

     Hi Greg,

     I finally make the ppolicy working in my openldap 2.4.23 on centos 6.4.

     Great to hear that! Don’t forget to add pam_sss.so to /etc/pam.d/password-auth if you want to enforce password policy for ssh logins.

     But I still have one minor thing that needs to be done, which is the automount in sssd.conf

     Frankly speaking, I’ve never configured autofs with sssd myself but from what I’ve googled out it seems pretty easy and explained in details on RedHat’s portal.

     Cheers.

     BR,
     Sergey

9. Written by Greg
   on February 18, 2014 at 12:16 am
   Reply · Permalink

   Hi:
   I also manage the automount to work through sssd.conf now. But it seems that I still have a little problem using su when ldapuser login and try su – ldapuser2, the error is like this pam_sss(sshd:auth): received for user ldapuser2: 9 (Authentication service cannot retrieve authentication info). Have you seen this before? The automount and ppolicy all works now. Thank yu for the tips and hints.

   • Written by sergeyt
     on February 18, 2014 at 12:41 am
     Reply · Permalink

     Hi Greg,
     Good to know you’re making steady progress.
     Regarding your issue, (quick guess) it looks like pam_sss.so is missing in /etc/pam.d/su file. Could you please show its content?

     Thanks.

     BR,
     Sergey

10. Written by Greg
    on February 18, 2014 at 2:15 am
    Reply · Permalink

    Thanks
    cat /etc/pam.d/su
    #%PAM-1.0
    auth sufficient pam_rootok.so
    # Uncomment the following line to implicitly trust users in the “wheel” group.
    #auth sufficient pam_wheel.so trust use_uid
    # Uncomment the following line to require a user to be in the “wheel” group.
    #auth required pam_wheel.so use_uid
    auth include system-auth
    account sufficient pam_succeed_if.so uid = 0 use_uid quiet
    account include system-auth
    password include system-auth
    session include system-auth
    session optional pam_xauth.so

11. Written by Greg
    on February 18, 2014 at 4:34 am
    Reply · Permalink

    It seems ldapuser can’t use passwd to change password, either. There are two final pieces to make my openldap work. Thanks

12. Written by Greg
    on February 18, 2014 at 5:53 am
    Reply · Permalink

    I figure it out the su and passwd issue now. It was the /etc/pam.d/system-auth-ac file that I modified it wrong. Everything works well now. Thank you for this great blog that helps a lot.

    • Written by sergeyt
      on February 18, 2014 at 10:57 am
      Reply · Permalink

      Hi Greg,

      That’s very flattering to hear that this modest blog post helped you during OpenLdap setup. Keep up the good work.

      Thank you.
      BR,
      Sergey

13. Written by Greg
    on February 27, 2014 at 3:37 am
    Reply · Permalink

    Hi:
    How to make PAM display warning of password expiring or account being locked out when the user tries to log-in at the client side?
    Thank you.

    • Written by sergeyt
      on February 27, 2014 at 7:31 pm
      Reply · Permalink

      Hi Greg,

      You should define pwdExpireWarning in your LDAP ppolicy:

      pwdExpireWarning

      This attribute contains the maximum number of seconds before a password is due to expire that expiration warning messages will be
      returned to a user who is authenticating to the directory. If this attribute is not present, or if the value is zero (0), no warnings
      will be sent.

      ( 1.3.6.1.4.1.42.2.27.8.1.7
      NAME ’pwdExpireWarning’
      EQUALITY integerMatch
      SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
      SINGLE-VALUE )

      Cheers.

14. Written by Greg
    on February 28, 2014 at 2:55 am
    Reply · Permalink

    I did it and I also add pam_pwd_expiration_warning inside the sssd.conf, but nothing displays on the client side. Have you tried it before? Thanks for the suggestion.

15. Written by sergeyt
    on February 28, 2014 at 6:40 pm
    Reply · Permalink

    Hi Greg,

    Try to increase LDAP debug level in sssd.conf by adding debug_level = 10 in [domain/LDAP] section. After that try to authenticate using an account with soon to expire password, check /var/log/sssd/sssd_LDAP.log log file, search for “Password Policy Response” string and show its content.

    Thanks.

16. Written by OpenLDAP ppolicy problem
    on April 17, 2014 at 9:17 pm
    Reply · Permalink

    […] Hi, I am trying to make ppolicy work on openldap 2.4. I have found some good tutorials like this : http://www.flagword.net/2013/02/open…omment-page-1/ However it does not work for me till now. I need to know where does openldap stores information […]

17. Written by jameswhite
    on June 12, 2014 at 8:59 pm
    Reply · Permalink

    Why, when you load syncprov, do you use “olcModuleLoad: syncprov.la” and when you load ppolicy, you use “olcModuleLoad: ppolicy” (without the .la)?

    • Written by sergeyt
      on June 12, 2014 at 11:56 pm
      Reply · Permalink

      Hi James,

      Good catch. Somehow the missing .la extension when I load ppolicy slipped through my eyes and that certainly should be fixed.
      But what is more exciting, is that it seems the version of OpenLdap which I’m running is smart enough and loads the module properly even when the extensions is omitted. Will take a look at the source code to confirm this hunch.

      Thanks.

      • Written by sergeyt
        on June 16, 2014 at 5:59 pm
        Reply · Permalink

        As promised, I checked the source code and could confirm that .la part could be omitted when doing olcModuleLoad till OpenLDAP project uses lt_dlopenext and not lt_dlopen.

        A module is loaded by

        int module_load(const char* file_name, int argc, char *argv[])

        and its implementation could be found in module.c
        This function mostly does a number of sanity checks whilst the heavylifting is done by libltdl library from the GNU Portable Library Tool:

        if ((module->lib = lt_dlopenext(file)) == NULL) {
                        error = lt_dlerror();

        Function: lt_dlhandle lt_dlopenext (const char *filename)
        The same as lt_dlopen, except that it tries to append different file name extensions to the file name. If the file with the file name filename cannot be found libltdl tries to append the following extensions:
        1.the libtool archive extension .la
        2.the extension used for native dynamically loadable modules on the host platform, e.g., .so, .sl, etc.

        Cheers.

18. Written by Mahe
    on July 24, 2014 at 8:10 pm
    Reply · Permalink

    Hi Sergey,

    I used this document to setup an ldap server with password policy. It worked perfectly. Thank you very much for wonderful document.

    However when I try to add a user using Apache DS LDAP browser my password policy does not come in to effect. i.e. it creates user without considering parameters set in password policy. Can you please help?

    Thanks a lot
    Mahe

    • Written by sergeyt
      on July 25, 2014 at 7:25 pm
      Reply · Permalink

      Hi Mahe,

      Thank you very much for your generous comment – this is very rewarding.
      Regarding your question.

      it creates user without considering parameters set in password policy.

      How did you check that?
      Basically, if the default policy was configured there is nothing else that must be done and it will be applied to any LDAP user by default. But keep in mind that if you want to check ppolicy operational attributes for a certain user you must specify them deliberately in your ldapsearch query otherwise they will not be displayed, for example:

      ldapsearch -H ldaps://my_ldap_server:636 -b "dc=example,dc=com" -D "cn=Manager,dc=example,dc=com" -x -W uid=someuser pwdChangedTime
      

      And don’t forget that OS must also enforce the password policy from its side.

      Cheers.
      Sergey

19. Written by Shamjith Govindan
    on September 24, 2014 at 4:46 pm
    Reply · Permalink

    Hi,

    This document is perfect and i am able to configure the feature mentioned in the post. I see a small bug in the point no.12
    error
    cat ./bdb-repl.ldif
    olcDatabase={2}bdb,cn=config

    correct
    cat ./bdb-repl.ldif
    dn: olcDatabase={2}bdb,cn=config

    I have a query as well, where we can see the replication logs and where we are defining synchronizing frequency?

    • Written by sergeyt
      on September 25, 2014 at 10:00 pm
      Reply · Permalink

      Hi Shamjith,
      Thank you for spotting the misprint – this is fixed now.

      Regarding your questions. I haven’t done that myself but you could try to set olcLogLevel as described on this page – slapdconf2 (search for 16384).
      Regarding the frequency, as far as I know, you can’t change it with refreshAndPersist type of replication since it’s push based and all changed propagated immidiately from a provider to a consumer.
      From OpenLDAP Admin Guide:

      In its refreshAndPersist mode of synchronization, the provider uses a push-based synchronization. The provider keeps track of the consumer servers that have requested a persistent search and sends them necessary updates as the provider replication content gets modified.

      You could find more information here – http://www.openldap.org/doc/admin24/replication.html

      Cheers.

      WBR,
      Sergey

20. Written by iawes
    on January 12, 2015 at 9:05 am
    Reply · Permalink

    How can I do this on Ubuntu 14.04? I just did all this, but the ppolicy does not work .

    • Written by sergeyt
      on January 12, 2015 at 9:55 am
      Reply · Permalink

      Hi,
      Could you, please, confirm that ppolicy was properly configured? This could be easily done by running a simple ldapsearch query:

      ldapsearch -H ldaps://your_ldap_server:636 -b "dc=example,dc=com" -D "cn=Manager,dc=example,dc=com" -x -W uid=some_uid pwdChangedTime
      

      It should provide the output similar to the one listed below:

      # extended LDIF
      #
      # LDAPv3
      # base  with scope subtree
      # filter: uid=some_uid
      # requesting: pwdChangedTime
      #
      
      # some_uid, people, example.com
      dn: uid=some_uid,ou=people,dc=example,dc=com
      pwdChangedTime: 20141115164334Z
      
      # search result
      search: 2
      result: 0 Success
      
      # numResponses: 2
      # numEntries: 1
      

      Cheers.

21. Written by Manju
    on August 3, 2015 at 4:45 pm
    Reply · Permalink

    Hi Admin, Thanks for the detailed info. Can we make OpenLDAP to forward auth requests to Windows AD? any procedure will help us. Thanks.

    • Written by sergeyt
      on August 3, 2015 at 5:04 pm
      Reply · Permalink

      Hi Manju,

      I’ve never done that myself but there is an article on msdn.com that could potentially forward you in the right direction:
      http://blogs.msdn.com/b/alextch/archive/2012/04/25/configuring-openldap-pass-through-authentication-to-active-directory.aspx

      Cheers.
      Sergey

22. Written by Manju
    on August 5, 2015 at 4:12 pm
    Reply · Permalink

    Hi Sergey, Thanks for the link for auth forwarding. I have gone through setting up two ldap servers for my testing and configured everything till option 4… :-( But sorry to tell you the errors that I am getting tells me that there is some problem in setting up the TLS CA Certs. I am using the below link. If you know of any other link, please help me.

    http://www.openldap.org/lists/openldap-technical/201109/msg00231.html

Subscribe to comments via RSS