Re: Pam password authentication

[Siddhartha Jain <sjain@silverspringnet.com>]

Title: Re: Pam password authentication

I came across a similar bug where enabling chaining between a master and slave allows invalid passwords to be accepted by pam_ldap. Unfortunately, no word from OpenLDAP or pam_ldap maintainers on the issue. I have been looking at pam_ldap source code but haven’t been able to pinpoint the issue. In my case, it has something to do with password policy not being handled properly when chaining is enabled. I suggest try tweaking those “pam_password” statements and see if you can deduce anything.

I will update the list if I find anything conclusive about this bug.

Thanks,

Siddhartha


On 6/5/10 7:00 AM, "Indexer" <indexer@internode.on.net> wrote:

> Recently, i have hit a rather unique, and annoying, error with ldap. it seems that using pam with ldap, allows *any* password as valid. Im not really sure what i have done here, and any help would be apprecitaed. find my /etc/ldap.conf attached, as well as pam.d/ssh
>
> etc/ldap.conf
>
> base dc=chocolate,dc=lan
> suffix dc=chocolate,dc=lan
> uri ldap://ldap.chocolate.lan
> ldap_version 3
> scope sub
> timelimit 3
> bind_timelimit 3
> bind_policy soft
> pam_filter objectclass=posixAccount
> pam_login_attribute uid
> pam_groupdn cn=login,ou=Nemo,ou=Group,dc=chocolate,dc=lan
> pam_member_attribute memberUid
> pam_password clear
> pam_password exop
> nss_base_passwd         ou=Users,dc=chocolate,dc=lan?sub
> nss_base_shadow         ou=Users,dc=chocolate,dc=lan?sub
> nss_base_group          ou=Nemo,ou=Group,dc=chocolate,dc=lan?sub
> ssl on
> ssl start_tls
> tls_cacert /usr/local/etc/openldap/keys/cacert.crt
>
> tls_checkpeer no
>
>
> pam.d/sshd
>
> auth            sufficient      pam_opie.so             no_warn no_fake_prompts
> auth            requisite       pam_opieaccess.so       no_warn allow_local
> auth           sufficient      /usr/local/lib/pam_ldap.so no_warn use_first_pass
> auth            sufficient      pam_unix.so             no_warn try_first_pass
>
> account         required        pam_nologin.so
> account         required        pam_login_access.so
> account         optional        pam_unix.so
> account         optional        /usr/local/lib/pam_ldap.so
>
> session         required        pam_permit.so
> session         optional      /usr/local/lib/pam_ldap.so
>
> password        sufficient      /usr/local/lib/pam_ldap.so      no_warn    use_athtok   use_first_pass
> password        sufficient      pam_unix.so             no_warn try_first_pass