Changes between Initial Version and Version 1 of campuswifiandeduroam2023Agenda/pwden


Ignore:
Timestamp:
Jul 24, 2024, 5:05:45 PM (4 months ago)
Author:
tuwan
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • campuswifiandeduroam2023Agenda/pwden

    v1 v1  
     1===Configure OpenLDAP Password Expiry Email Notification===
     2
     3This tutorial will provide some basics steps to take to configure OpenLDAP to send out notifications via email to users mailbox informing them about the password expiration also system admins.
     4
     5The Script can be found at [https://github.com/ltb-project/ldap-scripts here]
     6
     7{{{
     8grep -Ev "^\s[#\;]|^\s$|^#" checkLdapPwdExpiration.sh
     9}}}
     10
     11{{{
     12MY_LDAP_HOSTURI="ldapi:///"
     13MY_LDAP_DEFAULTPWDPOLICYDN="cn=default,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com"
     14MY_LDAP_SEARCHBASE="ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com"
     15MY_LDAP_SEARCHFILTER="(&(uid=*)(objectClass=inetOrgPerson))"
     16MY_LDAP_SEARCHSCOPE="one"
     17MY_LDAP_SEARCHBIN="/usr/bin/ldapsearch"
     18MY_LDAP_NAME_ATTR=cn
     19MY_LDAP_LOGIN_ATTR=uid
     20MY_LDAP_MAIL_ATTR=mail
     21export LC_ALL=en_US.UTF-8
     22MY_MAIL_BODY="Hi %name,\n\n \
     23        Your password will expire in %expireDays days on %expireTimeTZ.\n\n \
     24        Visit Kifarunix-demo Self Service Password site, https://ldap-ssp.kifarunix-demo.com to reset your password.\n\n \
     25        As a reminder, ensure that your password conforms to the company outlined password policies.\n\n \
     26        Kifarunix-demo IT team,\n
     27        Regards."
     28EX_MAIL_BODY="Hi %name,\n\n \
     29        Your password expired on %expireTimeTZ.\n\n \
     30        Kindly contact Kifarunix-demo IT team to help reset the password.\n\n \
     31        Kifarunix-demo IT team,\n
     32        Regards."
     33MY_MAIL_SUBJECT="LDAP Account Password Expiry Status"
     34MY_MAIL_BIN="mail"
     35MY_LOG_HEADER="`date +\"%b %e,%Y %T\"`"
     36MY_GAWK_BIN="/usr/bin/gawk"
     37getTimeInSeconds() {
     38        date=0
     39        os=`uname -s`
     40        if [ "$1" ]; then
     41                date=`${MY_GAWK_BIN} 'BEGIN  { \
     42                        if (ARGC == 2) { \
     43                                print mktime(ARGV[1]) \
     44                        } \
     45                        exit 0 }' "$1"`
     46        else
     47                if [ "${os}" = "SunOS" ]; then
     48                        date=`/usr/bin/truss /usr/bin/date 2>&1 | nawk -F= \
     49                                '/^time\(\)/ {gsub(/ /,"",$2);print $2}'`
     50                else
     51                        now=`date +"%Y %m %d %H %M %S" -u`
     52                        date=`getTimeInSeconds "$now"`
     53                fi
     54        fi
     55        echo ${date}
     56}
     57tmp_dir="/tmp/$$.checkldap.tmp"
     58result_file="${tmp_dir}/res.tmp.1"
     59buffer_file="${tmp_dir}/buf.tmp.1"
     60tmp_dir_stats="/tmp/ldap-password-stats"
     61ldap_param="-Y EXTERNAL -H ${MY_LDAP_HOSTURI} -LLL -Q"
     62nb_users=0
     63nb_expired_users=0
     64nb_warning_users=0
     65if [ -d ${tmp_dir} ]; then
     66        echo "Error : temporary directory exists (${tmp_dir})"
     67        exit 1
     68fi
     69mkdir ${tmp_dir}
     70if [ ${MY_LDAP_ROOTDN} ]; then
     71        ldap_param="${ldap_param} -D ${MY_LDAP_ROOTDN} -w ${MY_LDAP_ROOTPW}"
     72fi
     73${MY_LDAP_SEARCHBIN} ${ldap_param} -s ${MY_LDAP_SEARCHSCOPE} \
     74        -b "${MY_LDAP_SEARCHBASE}" "${MY_LDAP_SEARCHFILTER}" \
     75        "dn" > ${result_file}
     76while read dnStr
     77do
     78        if [ ! "${dnStr}" ]; then
     79                continue
     80        fi
     81        dn=`echo ${dnStr} | cut -d : -f 2`
     82        nb_users=`expr ${nb_users} + 1`
     83        ${MY_LDAP_SEARCHBIN} ${ldap_param} -s base -b "${dn}" \
     84                ${MY_LDAP_NAME_ATTR} ${MY_LDAP_LOGIN_ATTR} ${MY_LDAP_MAIL_ATTR} pwdChangedTime pwdPolicySubentry \
     85                > ${buffer_file}
     86        login=`grep -w "${MY_LDAP_LOGIN_ATTR}:" ${buffer_file} | cut -d : -f 2 \
     87                | sed "s/^ *//;s/ *$//"`
     88        name=`grep -w "${MY_LDAP_NAME_ATTR}:" ${buffer_file} | cut -d : -f 2\
     89                | sed "s/^ *//;s/ *$//"`
     90        mail=`grep -w "${MY_LDAP_MAIL_ATTR}:" ${buffer_file} | cut -d : -f 2 \
     91                | sed "s/^ *//;s/ *$//"`
     92        pwdChangedTime=`grep -w "pwdChangedTime:" ${buffer_file} \
     93                | cut -d : -f 2 | cut -c 1-15 | sed "s/^ *//;s/ *$//"`
     94        pwdPolicySubentry=`grep -w "pwdPolicySubentry:" ${buffer_file} \
     95                | cut -d : -f 2 | sed "s/^ *//;s/ *$//"`
     96        if [ ! "${pwdChangedTime}" ]; then
     97                echo "No password change date for ${login} (${mail})" >> ${tmp_dir_stats}
     98                continue
     99        fi
     100        if [ ! "${pwdPolicySubentry}" -a ! "${MY_LDAP_DEFAULTPWDPOLICYDN}" ]; then
     101                echo "No password policy for ${login} (${mail})" >> ${tmp_dir_stats}
     102                continue
     103        fi
     104        ldap_search="${MY_LDAP_SEARCHBIN} ${ldap_param} -s base"
     105        if [ "${pwdPolicySubentry}" ]; then
     106                ldap_search="${ldap_search} -b ${pwdPolicySubentry}"
     107        else
     108                ldap_search="${ldap_search} -b ${MY_LDAP_DEFAULTPWDPOLICYDN}"
     109        fi
     110        ldap_search="$ldap_search pwdMaxAge pwdExpireWarning pwdMinLength pwdInHistory"
     111        pwdMaxAge=`${ldap_search} | grep -w "pwdMaxAge:" | cut -d : -f 2 \
     112                | sed "s/^ *//;s/ *$//"`
     113        pwdExpireWarning=`${ldap_search} | grep -w "pwdExpireWarning:" | cut -d : -f 2 \
     114                | sed "s/^ *//;s/ *$//"`
     115        pwdMinLength=`${ldap_search} | grep -w "pwdMinLength:" | cut -d : -f 2 \
     116                | sed "s/^ *//;s/ *$//"`
     117        pwdInHistory=`${ldap_search} | grep -w "pwdInHistory:" | cut -d : -f 2 \
     118                | sed "s/^ *//;s/ *$//"`
     119        if [ ! "${pwdMaxAge}" ]; then
     120                echo "No password expiration configured for ${login} (${mail})" >> ${tmp_dir_stats}
     121                continue
     122        fi
     123        MY_MAIL_DELAY=${MY_MAIL_DELAY:=$pwdExpireWarning}
     124        if [ "${pwdChangedTime}" ]; then
     125                s=`echo ${pwdChangedTime} | cut -c 13-14`
     126                m=`echo ${pwdChangedTime} | cut -c 11-12`
     127                h=`echo ${pwdChangedTime} | cut -c 9-10`
     128                d=`echo ${pwdChangedTime} | cut -c 7-8`
     129                M=`echo ${pwdChangedTime} | cut -c 5-6`
     130                y=`echo ${pwdChangedTime} | cut -c 1-4`
     131                currentTime=`getTimeInSeconds`
     132                pwdChangedTime=`getTimeInSeconds "$y $M $d $h $m $s"`
     133                diffTime=`expr ${currentTime} - ${pwdChangedTime}`
     134        fi
     135        expireTime=`expr ${pwdChangedTime} + ${pwdMaxAge}`
     136        if [ ${currentTime} -gt ${expireTime} ]; then
     137                nb_expired_users=`expr ${nb_expired_users} + 1`
     138                expireTime=`date -d @$expireTime "+%A %d, %B %Y at %T"`
     139                logmsg="${EX_MAIL_BODY}"
     140                logmsg=`echo -e ${logmsg} | sed "s/%name/${name}/; \
     141                        s/%login/${login}/; s/%expireTimeTZ/${expireTime}/; s/%pwdMinLength/${pwdMinLength}/; s/%pwdInHistory/${pwdInHistory}/; \
     142                        s/%expireDays/${expireDays}/"`
     143                echo "${logmsg}" | ${MY_MAIL_BIN} -s "${MY_MAIL_SUBJECT}" ${mail} >&2
     144                echo "Password expired for ${login} on ${expireTime}. Mail sent to ${mail}" >> ${tmp_dir_stats}
     145                continue
     146        fi
     147        expireTimeTZ=`date -d @$expireTime "+%A %d, %B %Y at %T"`
     148        expireTimeMail=`date -d @$expireTime "+%s"`
     149        now=`date +%s`
     150        expireDays=`echo $(( (${expireTimeMail} - ${now} )/(60*60*24) ))`
     151        if [ "${mail}" -a "${name}" \
     152                -a "${login}" -a "${diffTime}" -a "${pwdMaxAge}" ]
     153        then
     154                diffTime=`expr ${diffTime} + ${MY_MAIL_DELAY}`
     155                if [ ${diffTime} -gt ${pwdMaxAge} ]; then
     156                        logmsg="${MY_MAIL_BODY}"
     157                        logmsg=`echo -e ${logmsg} | sed "s/%name/${name}/; \
     158                                s/%login/${login}/; s/%expireTimeTZ/${expireTimeTZ}/; s/%pwdMinLength/${pwdMinLength}/; s/%pwdInHistory/${pwdInHistory}/; \
     159                                s/%expireDays/${expireDays}/"`
     160                        echo "${logmsg}" | ${MY_MAIL_BIN} -s "${MY_MAIL_SUBJECT}" ${mail} >&2
     161                        echo "Password warning for ${login} (expiry date, ${expireTimeTZ}). Mail sent to ${mail}" >> ${tmp_dir_stats}
     162                        nb_warning_users=`expr ${nb_warning_users} + 1`
     163                fi
     164        fi
     165done < ${result_file}
     166sed -i "1iHello Admin,\nFind the LDAP users account password expiry status as at ${MY_LOG_HEADER}.\n" ${tmp_dir_stats}
     167echo "Total User Accounts checked: ${nb_users}" >> ${tmp_dir_stats}
     168echo "Accounts with Expired Passwords: ${nb_expired_users}" >> ${tmp_dir_stats}
     169echo "Accounts with Passwords in Warning state: ${nb_warning_users}" >> ${tmp_dir_stats}
     170sed -i -e '/^Total.*/i\\ ' -e '/^Total.*/i ===== Statistics =====' ${tmp_dir_stats}
     171mail -s "LDAP Password Expiration Status" kifaunix@gmail.com < ${tmp_dir_stats}
     172rm -rf ${tmp_dir}
     173rm -rf ${tmp_dir_stats}
     174exit 0}}}