Re: Password lockout policy max failure.

[Mark Reynolds]

On 9/24/21 9:23 AM, Michael Starling wrote:
> Hello.
>
> I'm having an issue where we have passwordMaxFailure set to "5" in the 
> global policy but users are getting locked out after 3 attempts.

This is because you have a mix of global and local policies. Local 
policies override the global policy.

In the local policy you did NOT set passwordMaxFailure, so it uses the 
default of 3.  If you don't need separate policies then just use the 
global policy for everything and remove he local policies.

On a side note, if you are using dsconf on the same system as the 
directory server you can simplify the cli usage to use LDAPI, and it's 
much less to type:

dsconf -W -D cn=manager ldaps://dsa101.mydomain.com:636 pwpolicy get

This can become:

# dsconf slapd-YOUR_INSTANCE_NAME pwpolicy get

This only works if you run dsconf on the DS machine, and you need to run 
it as root.  This works for all the CLI tools (dsidm, dsctl, and dsconf)

HTH,

Mark
> Right now, when a user is locked out the only way I can tell is by 
> looking at the attributes below.
> One is likely to assume that once the "accountUnlockTime" attribute 
> has been set on an account, the account is indeed locked out. 
> accountUnlockTime: 20210920190503Z *passwordRetryCount: 3 
> *retryCountResetTime: 20210920181413Z
>
> [mstarling@dsa101 ~]$ dsconf -W -D cn=manager 
> ldaps://dsa101.mydomain.com:636 pwpolicy get
> Global Password Policy: cn=config
>
> nsslapd-pwpolicy-local: on
> passwordstoragescheme: SSHA512
> passwordchange: on
> passwordmustchange: off
> passwordhistory: on
> passwordinhistory: 10
> passwordadmindn: 
> cn=Generic_PasswordPolicy_Override,ou=LDAPadmin,dc=mydomain,dc=com
> passwordtrackupdatetime: on
> passwordwarning: 86400
> passwordisglobalpolicy: on
> passwordexp: on
> passwordmaxage: 7776000
> passwordminage: 86400
> passwordgracelimit: 0
> passwordsendexpiringtime: off
> passwordlockout: on
> passwordunlock: on
> passwordlockoutduration: 600
> *passwordmaxfailure: 5*
> passwordresetfailurecount: 600
> passwordchecksyntax: off
> passwordminlength: 48
> passwordmindigits: 0
> passwordminalphas: 0
> passwordminuppers: 0
> passwordminlowers: 0
> passwordminspecials: 0
> passwordmin8bit: 0
> passwordmaxrepeats: 0
> passwordpalindrome: off
> passwordmaxsequence: 0
> passwordmaxseqsets: 0
> passwordmaxclasschars: 0
> passwordmincategories: 5
> passwordmintokenlength: 3
> passwordbadwords: athena health interface
> passworduserattributes: cn uid sn givenName mail gecos homeDirectory
> passworddictcheck: on
> passworddictpath: /usr/lib64/security/pam_cracklib.so
> nsslapd-allow-hashed-passwords: on
> nsslapd-pwpolicy-inherit-global: on
>
> dsconf -W -D cn=manager ldaps://dsa101.mydomain.com:636 localpwp get 
> "ou=People,dc=mydomain,dc=com"
> Local Subtree Policy Policy for "ou=People,dc=mydomain,dc=com": 
> cn=cn\3DnsPwPolicyEntry_subtree\2Cou\3DPeople\2Cdc\3Dmydomain\2Cdc\3Dcom,cn=nsPwPolicyContainer,ou=People,dc=mydomain,dc=com
>
> passwordstoragescheme: SSHA512
> passwordmustchange: off
> passwordhistory: on
> passwordtrackupdatetime: on
> passwordexp: on
> passwordmaxage: 7776000
> passwordlockout: on
> passwordchecksyntax: on
> passwordminlength: 14
> passwordmincategories: 4
> passworddictcheck: on
>
> 389-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]....
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

Password lockout policy max failure.

[Michael Starling]

________________________________
From: Mark Reynolds 
Sent: Friday, September 24, 2021 9:38 AM
To: General discussion list for the 389 Directory server project. ; Michael Starling 
Subject: Re: [389-users] Password lockout policy max failure.

On 9/24/21 9:23 AM, Michael Starling wrote:
Hello.

I'm having an issue where we have passwordMaxFailure set to "5" in the global policy but users are getting locked out after 3 attempts.

This is because you have a mix of global and local policies.  Local policies override the global policy.

In the local policy you did NOT set passwordMaxFailure, so it uses the default of 3.  If you don't need separate policies then just use the global policy for everything and remove he local policies.

On a side note, if you are using dsconf on the same system as the directory server you can simplify the cli usage to use LDAPI, and it's much less to type:

dsconf -W -D cn=manager ldaps://dsa101.mydomain.com:636 pwpolicy get

This can become:

# dsconf slapd-YOUR_INSTANCE_NAME pwpolicy get

This only works if you run dsconf on the DS machine, and you need to run it as root.  This works for all the CLI tools (dsidm, dsctl, and dsconf)

HTH,

Mark

Once again, great information Mark.

So essentially, I need to set passw​ordMaxFailure 5 in the local policy as well?

Thanks

Right now, when a user is locked out the only way I can tell is by looking at the attributes below.

One is likely to assume that once the "accountUnlockTime" attribute has been set on an account, the account is indeed locked out.

accountUnlockTime: 20210920190503Z
passwordRetryCount: 3
retryCountResetTime: 20210920181413Z

[mstarling@dsa101 ~]$ dsconf -W -D cn=manager ldaps://dsa101.mydomain.com:636 pwpolicy get
Global Password Policy: cn=config
------------------------------------
nsslapd-pwpolicy-local: on
passwordstoragescheme: SSHA512
passwordchange: on
passwordmustchange: off
passwordhistory: on
passwordinhistory: 10
passwordadmindn: cn=Generic_PasswordPolicy_Override,ou=LDAPadmin,dc=mydomain,dc=com
passwordtrackupdatetime: on
passwordwarning: 86400
passwordisglobalpolicy: on
passwordexp: on
passwordmaxage: 7776000
passwordminage: 86400
passwordgracelimit: 0
passwordsendexpiringtime: off
passwordlockout: on
passwordunlock: on
passwordlockoutduration: 600
passwordmaxfailure: 5
passwordresetfailurecount: 600
passwordchecksyntax: off
passwordminlength: 48
passwordmindigits: 0
passwordminalphas: 0
passwordminuppers: 0
passwordminlowers: 0
passwordminspecials: 0
passwordmin8bit: 0
passwordmaxrepeats: 0
passwordpalindrome: off
passwordmaxsequence: 0
passwordmaxseqsets: 0
passwordmaxclasschars: 0
passwordmincategories: 5
passwordmintokenlength: 3
passwordbadwords: athena health interface
passworduserattributes: cn uid sn givenName mail gecos homeDirectory
passworddictcheck: on
passworddictpath: /usr/lib64/security/pam_cracklib.so
nsslapd-allow-hashed-passwords: on
nsslapd-pwpolicy-inherit-global: on

dsconf -W -D cn=manager ldaps://dsa101.mydomain.com:636 localpwp get "ou=People,dc=mydomain,dc=com"
Local Subtree Policy Policy for "ou=People,dc=mydomain,dc=com": cn=cn\3DnsPwPolicyEntry_subtree\2Cou\3DPeople\2Cdc\3Dmydomain\2Cdc\3Dcom,cn=nsPwPolicyContainer,ou=People,dc=mydomain,dc=com
------------------------------------
passwordstoragescheme: SSHA512
passwordmustchange: off
passwordhistory: on
passwordtrackupdatetime: on
passwordexp: on
passwordmaxage: 7776000
passwordlockout: on
passwordchecksyntax: on
passwordminlength: 14
passwordmincategories: 4
passworddictcheck: on

_______________________________________________
389-users mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]....
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

--
Directory Server Development Team