[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: OLC ppolicy

Hi,
ppolicy is the right name, however it is invoked two times in your olcModuleLoad param, keep only one.
According reported configuration, only three params of password policy are defined: 

1/ olcPPolicyHashCleartext: TRUE
2/ olcPPolicyUseLockout: FALSE
3/ pwdMinLength: 12

what you should check to test:

1/ Password is hashed (SSHA by default) when it's provided as cleartext
2/ ldap entry never locked after several failed attempt to bind
3/ Password modification rejected with error message when length of new one is less than 12 characters. 

That's what "empirically these commands do".

*Important*
Be careful, rootdn bypass passwored policy.

Hope this help

Cheers.


Le 20/08/2015 16:57, Jeremy Trammell - DLA a écrit :

On 08/20/2015 07:50 AM, Dieter Klünter wrote:

Am Wed, 19 Aug 2015 13:07:11 -0700
schrieb Jeremy Trammell - DLA <jtrammell@deeplearninganalytics.com>:


Greetings,

I'm trying to set up a very simple LDAP server using OpenLDAP (via
OLC) and it seems hopeless.  The sticking point is ppolicy.  I have
followed several online guides
(http://www.ryanfrantz.com/posts/openldap-implementing-the-password-policy-overlay/,

https://www.oostergo.net/node/85, to name a few), all of which seem
to essentially detail the same procedure, and have met with no
success. Whilst following those instructions, I receive no error
messages.  All commands complete successfully and do not indicate
failures of any kind.  Looking at the cn=config and target DITs, all
data seems to have been imported as expected.  Despite that fact,
passwd follows a "mystery policy" which bears no resemblance to the
policy that I have specified, and ldappasswd follows "no policy at
all you can do whatever you want". Is there some way for me to
empirically determine what these commands are doing, and why my
policy does nothing?  Thanks in advance...

cn=module{0},cn=config

objectClass: olcModuleList
cn: module{0}
olcModuleLoad: {0}ppolicy.la
olcModuleLoad: {1}back_hdb
olcModuleLoad: {2}ppolicy
olcModulePath: /usr/lib/ldap

The module names are not correct.
Hint: check /usr/lib/ldap for correct module names.

-Dieter


Okay, so what is the correct module name?  It's listed as ppolicy in
/usr/lib/ldap:

lrwxrwxrwx   1 root root     20 May 25 10:09 ppolicy-2.4.so.2 ->
ppolicy-2.4.so.2.8.3
-rw-r--r--   1 root root  39328 May 25 10:09 ppolicy-2.4.so.2.8.3
-rw-r--r--   1 root root    954 May 25 10:08 ppolicy.la
lrwxrwxrwx   1 root root     20 May 25 10:09 ppolicy.so ->
ppolicy-2.4.so.2.8.3






--
*Abdelhamid Meddeb*
http://www.meddeb.net

Attachment: smime.p7s
Description: Signature cryptographique S/MIME