Re: pwdInHistory question

[Buchan Milne <bgmilne@staff.telkomsa.net>]

On Friday, 6 May 2011 00:11:32 Bidwell, Matt wrote:
> I'm running OpenLDAP 2.5.24 on 2 servers.  I'm trying to enforce some
> security rules on client machines through the ppolicy overlay.  All the
> lockout stuff works fine.  I understand that pwdMinLength will not work by
> design because the password is hashed.

This statement isn't true. If OpenLDAP receives the clear text password, 
length/content enforcements can be made. However, if your clients are sending 
the password hashed, it obviously can't.

You can either get your clients to use the Password Modify extended operation 
(e.g. with pam_ldap use 'pam_password exop'), or if your clients can send a 
modify with the userPassword unhashed, then you can use 
'ppolicy_hash_cleartext yes' in slapd.conf.

> I can't get pwdInHistory to work.
> If I set it to 5 I clearly see 5 pwdHistory entries, all hashed {crypt},
> but I can go back and forth between two passwords without it rejecting
> them for being reused.  My current theory is that it's not looking at the
> actual password to prevent reuse, but the hashed password, which is not
> going to be the same.  Should it be working? Follow up question, shouldn't
> the password be stored {SSHA} and not {CRYPT} by default?

It will be hashed with whatever you have set with 'password-hash', which 
defaults to SSHA, *if* the server receives a password modify extended 
operation, or if the server receives the cleartext and has 
'ppolicy_hash_cleartext'. If password-hash is not {CRYPT}, then most likely 
your clients are sending operations with pre-hashed passwords.

> Just to be
> clear, the password is being set on the client machine using passwd, not
> on the servers running OpenLDAP.

*Where* they are being set isn't that relevant, what software is doing it, and 
how it is configured, is more ...

Regards,
Buchan