Account lockout error code/message differences for correct and incorrect password

Hi, 

I am doing some experiements with account lockout password policy. The account is locked
out after many wrong password tries.

Then
If bind with correct password, the result is
#<OpenStruct extended_response=nil, code=19, error_message="Exceed password retry
limit. Please try later.", matched_dn="", message="Constraint
Violation">

if bind with wrong password, the result is 
#<OpenStruct extended_response=nil, code=49, error_message="",
matched_dn="", message="Invalid Credentials">

So attacker can still continue to try/guess different passwords until he get the result of
: code=19, error_message="Exceed password retry limit. Please try later.".

Thank you.

[William Brown]

On Fri, 2017-07-28 at 18:49 +0000, albert.luo(a)uwindsor.ca wrote:
>  Hi, 
>  
>  I am doing some experiements with account lockout password policy. The account is locked
> out after many wrong password tries.
>  
>  Then
>  If bind with correct password, the result is
>  #<OpenStruct extended_response=nil, code=19, error_message="Exceed password retry
> limit. Please try later.", matched_dn="", message="Constraint
> Violation">
>  
>  if bind with wrong password, the result is 
>  #<OpenStruct extended_response=nil, code=49, error_message="",
> matched_dn="", message="Invalid Credentials">
>  
>  So attacker can still continue to try/guess different passwords until he get the result
> of : code=19, error_message="Exceed password retry limit. Please try later.".
>   

When you say "account lockout" you are referring to the setting:

dn: cn=config
passwordMaxFailure: 4
passwordLockoutDuration: 600

Correct?

If so this may be a security issue. Please confirm the settings you are
referring to here,

Thanks, 

-- 
Sincerely,

William Brown
Software Engineer
Red Hat, Australia/Brisbane

[William Brown]

On Mon, 2017-07-31 at 12:51 +1000, William Brown wrote:
>  On Fri, 2017-07-28 at 18:49 +0000, albert.luo(a)uwindsor.ca wrote:
>  > Hi, 
>  > 
>  > I am doing some experiements with account lockout password policy. The account is
> locked out after many wrong password tries.
>  > 
>  > Then
>  > If bind with correct password, the result is
>  > #<OpenStruct extended_response=nil, code=19, error_message="Exceed password
> retry limit. Please try later.", matched_dn="", message="Constraint
> Violation">
>  > 
>  > if bind with wrong password, the result is 
>  > #<OpenStruct extended_response=nil, code=49, error_message="",
> matched_dn="", message="Invalid Credentials">
>  > 
>  > So attacker can still continue to try/guess different passwords until he get the
> result of : code=19, error_message="Exceed password retry limit. Please try
> later.".
>  > 
>  
>  
>  When you say "account lockout" you are referring to the setting:
>  
>  dn: cn=config
>  passwordMaxFailure: 4
>  passwordLockoutDuration: 600
>  
>  Correct?
>  
>  If so this may be a security issue. Please confirm the settings you are
>  referring to here, 
Ahh, indeed. I can produce this issue:

ldapwhoami -H ldap://localhost -x -D 'uid=testuser,dc=example,dc=com' -w
password
dn: uid=testuser,dc=example,dc=com

Bind with invalid credentials a number of times to trigger the lockout:

ldapwhoami -H ldap://localhost -x -D 'uid=testuser,dc=example,dc=com' -w
passworda
ldap_bind: Invalid credentials (49)

Then bind with valid crendentials while the lockout is in effect:

ldapwhoami -H ldap://localhost -x -D 'uid=testuser,dc=example,dc=com' -w
password 
ldap_bind: Constraint violation (19)
	additional info: Exceed password retry limit. Please try later.

You are correct that this is likely a security issue as it allows an
attacker to bypass the rate limit and account lockout mechanism.

I will report this and have it dealt with appropriately.

Thanks for your report,

-- 
Sincerely,

William Brown
Software Engineer
Red Hat, Australia/Brisbane

[William Brown]

>  
>  You are correct that this is likely a security issue as it allows an
>  attacker to bypass the rate limit and account lockout mechanism.
>  
>  I will report this and have it dealt with appropriately.
>   
A patch has been developed on 389-devel. It is awaiting review:

https://pagure.io/389-ds-base/issue/49336

Thanks again,

-- 
Sincerely,

William Brown
Software Engineer
Red Hat, Australia/Brisbane

[Lalit Choudhary]

Hello,

Can any body please help me to join windows machine(Client) with 389
directory server?
or if there any steps requesting you to please share with me.

Thanks,
Lalit

On Mon, Jul 31, 2017 at 1:14 PM, William Brown <wibrown(a)redhat.com&gt; wrote:

>  >
>  > You are correct that this is likely a security issue as it allows an
>  > attacker to bypass the rate limit and account lockout mechanism.
>  >
>  > I will report this and have it dealt with appropriately.
>  >
>
>  A patch has been developed on 389-devel. It is awaiting review:
>
>  https://pagure.io/389-ds-base/issue/49336
>
>  Thanks again,
>
>  --
>  Sincerely,
>
>  William Brown
>  Software Engineer
>  Red Hat, Australia/Brisbane
>
>
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org
>  To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>
>  

-- 
Your Sincerely
Lalit Choudhary

[William Brown]

On Mon, 2017-07-31 at 14:37 +0530, Lalit Choudhary wrote:
>  Hello,
>  
>  Can any body please help me to join windows machine(Client) with 389
>  directory server?
>  or if there any steps requesting you to please share with me.
>   
Hi,

If you have a question it's good to open a new thread - it makes it
easier to follow.

There are a few ways to approach this. Windows cannot directly "Join" to
389ds. Windows relies on AD to do this (which is kerberos driven).

However there are some other solutions.

* 389 and AD can replicate with winsync
* FreeIPA (which uses 389) can AD trust with a DC
* You can add a pgina module to windows that uses native ldap.

I hope that helps you,


-- 
Sincerely,

William Brown
Software Engineer
Red Hat, Australia/Brisbane

[Lalit Choudhary]

Hello William,

Very much help full I will open a new thread for my question.

Thanks,
Lalit

On Mon, Jul 31, 2017 at 2:43 PM, William Brown <wibrown(a)redhat.com&gt; wrote:

>  On Mon, 2017-07-31 at 14:37 +0530, Lalit Choudhary wrote:
>  > Hello,
>  >
>  > Can any body please help me to join windows machine(Client) with 389
>  > directory server?
>  > or if there any steps requesting you to please share with me.
>  >
>
>  Hi,
>
>  If you have a question it's good to open a new thread - it makes it
>  easier to follow.
>
>  There are a few ways to approach this. Windows cannot directly "Join" to
>  389ds. Windows relies on AD to do this (which is kerberos driven).
>
>  However there are some other solutions.
>
>  * 389 and AD can replicate with winsync
>  * FreeIPA (which uses 389) can AD trust with a DC
>  * You can add a pgina module to windows that uses native ldap.
>
>  I hope that helps you,
>
>
>  --
>  Sincerely,
>
>  William Brown
>  Software Engineer
>  Red Hat, Australia/Brisbane
>
>
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org
>  To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>
>  

-- 
Your Sincerely
Lalit Choudhary