Managing user password policy problem

[xinhuan zheng]

Hi All,

I am having difficulty to make managing user password policy working. I want to use local per-user based password policy. Here is the configuration I use:

containter configuration -
dn: cn=nsPwPolicyContainer,ou=people,dc=christianbook,dc=com
objectClass: top
objectClass: nsContainer
cn: nsPwPolicyContainer

entry configuration -
dn: cn=userPasswordPolicy,cn=nsPwPolicyContainer,ou=people,dc=christianbook,dc=com
cn: userPasswordPolicy
objectclass: top
objectclass: extensibleObject
objectclass: ldapsubentry
objectclass: passwordpolicy
passwordGraceLimit: 3
passwordMustChange: on
passwordChange: on
passwordExp: on
passwordMaxAge: 2
passwordHistory: on
passwordCheckSyntax: on

nsslapd-pwpolicy-local -
dn: cn=config
changetype: modify
replace: nsslapd-pwpolicy-local
nsslapd-pwpolicy-local: on

per-user password policy configuration -
dn: uid=xinhuan,ou=people,dc=christianbook,dc=com
changetype: modify
add: pwdpolicysubentry
pwdpolicysubentry: cn=userPasswordPolicy,cn=nsPwPolicyContainer,ou=people,dc=christianbook,dc=com

However, when I did my userpassword reset using ldapmodify command, I am able to login from the remote client that authenticates with my 389 directory server, without prompting to change my password the first time I login, which is against the 'passwordMustChange' policy.

The second thing is that I tried to expire my password so I can test 'passwordExp'. However, when I did 'passwd -e xinhuan' on LDAP client, I got error:

Expiring password for user xinhuan.
passwd: Error

What's going on?

Thanks,
- xinhuan

[xinhuan zheng]

Later on I used command:

/usr/lib64/dirsrv/slapd-cbdds1/ns-newpwpolicy.pl -D "cn=directory manager" -w - -U "uid=xinhuan,ou=people,dc=christianbook,dc=com"

The script works fine with below output:

adding new entry "cn=nsPwPolicyContainer,ou=people,dc=christianbook,dc=com"

adding new entry "cn=cn=nsPwPolicyEntry,uid=xinhuan,ou=people,dc=christianbook,dc=com,cn=nsPwPolicyContainer,ou=people,dc=christianbook,dc=com"

modifying entry "uid=xinhuan,ou=people,dc=christianbook,dc=com"

modifying entry "cn=config"

However, none of the password policy I set into nsPwPolicyEntry worked.

- xinhuan

[William Brown]

On Mon, 2016-06-13 at 21:17 +0000, xinhuan zheng wrote:
> Later on I used command:
>
> /usr/lib64/dirsrv/slapd-cbdds1/ns-newpwpolicy.pl -D "cn=directory manager" -w - -U
> "uid=xinhuan,ou=people,dc=christianbook,dc=com"
>
> The script works fine with below output:
>
> adding new entry "cn=nsPwPolicyContainer,ou=people,dc=christianbook,dc=com"
>
> adding new entry
> "cn=cn=nsPwPolicyEntry,uid=xinhuan,ou=people,dc=christianbook,dc=com,cn=nsPwPolicyContainer,ou=people,dc=christianboo
> k,dc=com"
>
> modifying entry "uid=xinhuan,ou=people,dc=christianbook,dc=com"
>
> modifying entry "cn=config"
>
> However, none of the password policy I set into nsPwPolicyEntry worked.

Another user on this list has recently had the same issue. I am investigating.

[xinhuan zheng]

Good Afternoon William,

I have more ideas today although I still don't know the how to get it to work. On a ldap client, I use sssd as caching service. sssd.conf domain section configuration has a parameter - ldap_access_order, if not giving a value, by default, it'll be 'permit', which means permits access even though password has expired. I have seen below in my /var/log/secure log file:

Jun 13 23:10:07 dclientdev1 sshd[5337]: pam_sss(sshd:auth): received for user xinhuan: 12 (Authentication token is no longer valid; new one required)

Immediately after:

Jun 13 23:10:07 dclientdev1 sshd[5337]: Accepted password for xinhuan from ::1 port 41315 ssh2

I changed it to 'ldap_access_order = expire' and add another parameter "ldap_pwd_policy = shadow". However, it can't authenticate at all since the shadow line means the LDAP client needs to access shadowAccount information, like:

shadowLastChange
shadowExpire
shadowMin
shadowMax
...

My LDAP entry is configured with "shadowAccount". I added those attributes too. However, the LDAP client can't see my shadow information. If I ran 'getent shadow root', I got output just like the entry in /etc/shadow file, when I ran 'getent shadow xinhuan', I get nothing.

I am not sure if that's the right direction to diagnose problems.

- xinhuan

[xinhuan zheng]

I found more information today.

Frist -

I found https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/9.0/h..., so I have added aci to the oid.

dn: oid=1.3.6.1.4.1.42.2.27.9.5.8,cn=features,cn=config
changetype: modify
add: aci
aci: (targetattr != "aci")(version 3.0; acl "Account Usable"; allow (read, search, compare, proxy)(groupdn = "ldap:///cn=groupname,ou=group,dc=christianbook,dc=com");)

Next -

I can set my password from 389 console. Once it's set, the passwordexpiration becomes '1970...', which means it is expired.

Then if I do bind using myself from client:

ldapsearch -x -Z  -D "uid=xinhuan,ou=people,dc=christianbook,dc=com"  -W - -b 'dc=christianbook,dc=com'  pwdpolicysubentry

Below is the response:

# search result
search: 3
result: 53 Server is unwilling to perform
control: 2.16.840.1.113730.3.4.4 false MA==

It appears ldapsearch sees my password has expired so server unwilling to respond. However, I can proceed login using ssh, despite the /var/log/secure message as mentioned before:

Jun 15 12:11:48 dclientdev1 sshd[7894]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=xinhuan
Jun 15 12:11:48 dclientdev1 sshd[7894]: pam_sss(sshd:auth): received for user xinhuan: 12 (Authentication token is no longer valid; new one required)  <---- pam_sss(sshd:auth) got password invalid response from directory server already
Jun 15 12:11:48 dclientdev1 sshd[7894]: Accepted password for xinhuan from ::1 port 41588 ssh2 <---- proceed login

Next -

I change passwordMaxAge to 1 in policy. Once I login, I use 'passwd' command to change my password:

$ passwd
Changing password for user xinhuan.
Current Password:
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

Since the passwordMaxAge is set to 1, the next time when I login, I got prompt:

Your password has expired. You have 2 grace login(s) remaining.

below is from /var/log/secure:

Jun 15 12:28:07 dclientdev1 sshd[8000]: pam_sss(sshd:auth): User info message: Your password has expired. You have 2 grace login(s) remaining.
Jun 15 12:28:07 dclientdev1 sshd[8000]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=xinhuan

After consuming all grace login(s), I am able to login using the expired password. Still /var/log/secure will show up it's expired password but I can login.

[xinhuan zheng]

I finally found my problem. Our uid starts with a lower number so I have to change system-auth and password-auth the uid number from 500 to ours. Password policy worked as expected then.