Password Policy

Implement OpenLDAP password policies. In OpenLDAP, password policies are implemented through the use of Password Policy (ppolicy) Overlay.

Implementing OpenLDAP Password Policies

PPolicy Control Mechanisms

ppolicy overlay provides a variety of password control mechanisms including-

• Password aging — both minimum and maximum ages
• Password quality
• Automatic account locking
• Password reuse and duplication control
• Account time-outs
• Mandatory password resets
• Acceptable password content
• Grace logins to allow the use of expired passwords for a specific time period after the expiry date.

Load Password Policy Module

In order to implement the password policies, you need to ensure that the, ppolicy.la module is loaded onto LDAP database. To list loaded modules, run the command;

slapcat -n 0 | grep -i module

In our current LDAP setup, no password policy module, ppolicy.la, is loaded. See the output of the command above;

dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/libexec/openldap
olcModuleLoad: {0}back_mdb.la
olcModuleLoad: {1}memberof.la
olcModuleLoad: {2}refint.la
structuralObjectClass: olcModuleList
olcAttributeTypes: {15}( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 
 'Loadable module that instantiates "check_password() function' EQUALITY cas
 op AUXILIARY MAY pwdCheckModule )

Therefore, to load the module, you can simply create an LDIF file as shown below to define how to add the password policy module to slapd.

vim load-ppolicy-mod.ldif

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy.la

Load the module in to LDAP database.

ldapadd -Y EXTERNAL -H ldapi:/// -f load-ppolicy-mod.ldif

After loading the module, if you list the slapd modules again, you should get an output similar to the below (It might be different for your case);

slapcat -n 0 | grep -i module

dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/libexec/openldap
olcModuleLoad: {0}back_mdb.la
olcModuleLoad: {1}memberof.la
olcModuleLoad: {2}refint.la
olcModuleLoad: {3}ppolicy.la
structuralObjectClass: olcModuleList

Create Password Policies OU Container

Create an LDAP OU container that will be used to store the default password policies.

vi pwpolicy-ou.ldif

dn: ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com
objectClass: organizationalUnit
objectClass: top
ou: pwpolicy

ldapadd -Y EXTERNAL -H ldapi:/// -f pwpolicy-ou.ldif

Create OpenLDAP Password Policy Overlay DN

Once you have loaded the ppolicy module into slapd database, proceed to add the LDAP password policy Overlay DN.

Add the password policy overlay into your respective LDAP database backend, which in this setup is mdb.

ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b  cn=config olcDatabase | grep mdb

See the highlighted line in the output below;

dn: olcDatabase={1}mdb,cn=config
olcDatabase: {1}mdb
dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config

Create an LDIF file with the content below for adding the ppolicy Overlay DN along with the configuration options into slapd. Replace the domain components accordingly.

vi pwpolicyoverlay.ldif

dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
olcPPolicyDefault: cn=default,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com
olcPPolicyHashCleartext: TRUE

Read more about the configuration options applied to the ppolicy overlay above on man slapo-ppolicy.

Update the database.

ldapadd -Y EXTERNAL -H ldapi:/// -f pwpolicyoverlay.ldif

Create OpenLDAP Password Policies

You are now ready to create your LDAP password policies under your default password policies ou created above, cn=default,ou=pwpolicy,dc=learn,dc=ac,dc=lk

The ppolicy overlay depends on the pwdPolicy object class and thus when defining the policies, you can use any of the attributes described under the ObjectClass attributes section of man slapo-ppolicy.

cat > ldap-pwpolicies.ldif << 'EOL'
dn: cn=default,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com
objectClass: person
objectClass: pwdPolicyChecker
objectClass: pwdPolicy
cn: pwpolicy
sn: pwpolicy
pwdAttribute: userPassword
pwdMinAge: 0
pwdMaxAge: 5184000
pwdInHistory: 5
pwdCheckQuality: 2
pwdMinLength: 12
pwdExpireWarning: 432000
pwdGraceAuthNLimit: 5
pwdLockout: TRUE
pwdLockoutDuration: 0
pwdMaxFailure: 3
pwdFailureCountInterval: 0
pwdReset: TRUE
pwdMustChange: TRUE
pwdAllowUserChange: TRUE
pwdSafeModify: FALSE
EOL

For a good explanation of the password attributes used above, consult, man slapo-ppolicy.

Update the Password policies on the slapd.

ldapadd -Y EXTERNAL -H ldapi:/// -f ldap-pwpolicies.ldif

Testing Password Policies

To test the effectiveness of the implemented OpenLDAP password policies, we will try to change the password of one of the existing OpenLDAP users in our environment.

Some of the checks we implemented above include;

• pwdInHistory: stores 5 previously used passwords in the database to avoid re-use.
• pwdCheckQuality: Set to value to 2. The server will check the syntax of the password and if the server is unable to check the syntax it will return an error refusing the password.
• pwdMinLength: Sets the minimum number of characters that will be accepted in a password to 12.

Reset User's Password as OpenLDAP RootDN Administrator

Note the rootDN, which is typically the LDAP administrator, is granted full access and permissions to the entire LDAP directory, including the ability to bypass password policies. This is to ensure that the LDAP administrator can always access and manage the directory, even if there are password policy restrictions in place for regular users. This means that the rootDN administrator can set any password for any user, regardless of the password policy rules defined for regular users. They are not subject to password complexity requirements, expiration rules, or other password policy restrictions that apply to regular users.

Try setting a simple password;

ldappasswd -H ldapi:/// -Y EXTERNAL -S "uid=johndoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com"

Since you are resetting/setting password as LDAP admin, any password can work;

New password: password
Re-enter new password: password
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0

From the logs, the result is success.