Changes between Version 2 and Version 3 of campuswifiandeduroam2023Agenda/pwdp

Timestamp:

Jul 24, 2024, 1:16:09 PM (4 months ago)

Author:

tuwan

Comment:

--

campuswifiandeduroam2023Agenda/pwdp

@@ -17 +17 @@
 - Acceptable password content
 - Grace logins to allow the use of expired passwords for a specific time period after the expiry date.
+
+'''Load Password Policy Module'''
+
+In order to implement the password policies, you need to ensure that the, ppolicy.la module is loaded onto LDAP database. To list loaded modules, run the command;
+
+{{{
+slapcat -n 0 | grep -i module
+}}}
+
+In our current LDAP setup, no password policy module, ppolicy.la, is loaded. See the output of the command above;
+
+{{{
+dn: cn=module{0},cn=config
+objectClass: olcModuleList
+cn: module{0}
+olcModulePath: /usr/libexec/openldap
+olcModuleLoad: {0}back_mdb.la
+olcModuleLoad: {1}memberof.la
+olcModuleLoad: {2}refint.la
+structuralObjectClass: olcModuleList
+olcAttributeTypes: {15}( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 
+ 'Loadable module that instantiates "check_password() function' EQUALITY cas
+ op AUXILIARY MAY pwdCheckModule )
+}}}
+
+Therefore, to load the module, you can simply create an LDIF file as shown below to define how to add the password policy module to slapd.
+
+{{{
+vim load-ppolicy-mod.ldif
+}}}
+
+{{{
+dn: cn=module{0},cn=config
+changetype: modify
+add: olcModuleLoad
+olcModuleLoad: ppolicy.la
+}}}
+
+Load the module in to LDAP database.
+
+{{{
+ldapadd -Y EXTERNAL -H ldapi:/// -f load-ppolicy-mod.ldif
+}}}
+
+After loading the module, if you list the slapd modules again, you should get an output similar to the below (It might be different for your case);
+
+{{{
+slapcat -n 0 | grep -i module
+}}}
+
+{{{
+dn: cn=module{0},cn=config
+objectClass: olcModuleList
+cn: module{0}
+olcModulePath: /usr/libexec/openldap
+olcModuleLoad: {0}back_mdb.la
+olcModuleLoad: {1}memberof.la
+olcModuleLoad: {2}refint.la
+olcModuleLoad: {3}ppolicy.la
+structuralObjectClass: olcModuleList
+}}}
+
+'''Create Password Policies OU Container'''
+
+Create an LDAP OU container that will be used to store the default password policies.
+
+{{{
+vi pwpolicy-ou.ldif
+}}}
+
+{{{
+dn: ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com
+objectClass: organizationalUnit
+objectClass: top
+ou: pwpolicy
+}}}
+
+{{{
+ldapadd -Y EXTERNAL -H ldapi:/// -f pwpolicy-ou.ldif
+}}}
+
+'''Create OpenLDAP Password Policy Overlay DN'''
+
+Once you have loaded the ppolicy module into slapd database, proceed to add the LDAP password policy Overlay DN.
+
+Add the password policy overlay into your respective LDAP database backend, which in this setup is mdb.
+
+{{{
+ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b  cn=config olcDatabase | grep mdb
+}}}
+
+See the highlighted line in the output below;
+
+{{{
+dn: olcDatabase={1}mdb,cn=config
+olcDatabase: {1}mdb
+dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
+}}}
+
+Create an LDIF file with the content below for adding the ppolicy Overlay DN along with the configuration options into slapd. Replace the domain components accordingly.
+
+{{{
+vi pwpolicyoverlay.ldif
+}}}
+
+{{{
+dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config
+objectClass: olcOverlayConfig
+objectClass: olcPPolicyConfig
+olcOverlay: ppolicy
+olcPPolicyDefault: cn=default,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com
+olcPPolicyHashCleartext: TRUE
+}}}
+
+Read more about the configuration options applied to the ppolicy overlay above on man slapo-ppolicy.
+
+Update the database.
+
+{{{
+ldapadd -Y EXTERNAL -H ldapi:/// -f pwpolicyoverlay.ldif
+}}}
+
+'''Create OpenLDAP Password Policies'''
+
+You are now ready to create your LDAP password policies under your default password policies ou created above, cn=default,ou=pwpolicy,dc=learn,dc=ac,dc=lk
+
+The ppolicy overlay depends on the pwdPolicy object class and thus when defining the policies, you can use any of the attributes described under the ObjectClass attributes section of man slapo-ppolicy.
+
+{{{
+cat > ldap-pwpolicies.ldif << 'EOL'
+dn: cn=default,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com
+objectClass: person
+objectClass: pwdPolicyChecker
+objectClass: pwdPolicy
+cn: pwpolicy
+sn: pwpolicy
+pwdAttribute: userPassword
+pwdMinAge: 0
+pwdMaxAge: 5184000
+pwdInHistory: 5
+pwdCheckQuality: 2
+pwdMinLength: 12
+pwdExpireWarning: 432000
+pwdGraceAuthNLimit: 5
+pwdLockout: TRUE
+pwdLockoutDuration: 0
+pwdMaxFailure: 3
+pwdFailureCountInterval: 0
+pwdReset: TRUE
+pwdMustChange: TRUE
+pwdAllowUserChange: TRUE
+pwdSafeModify: FALSE
+EOL
+}}}
+
+For a good explanation of the password attributes used above, consult, man slapo-ppolicy.
+
+Update the Password policies on the slapd.
+
+{{{
+ldapadd -Y EXTERNAL -H ldapi:/// -f ldap-pwpolicies.ldif
+}}}
+
+'''Testing Password Policies'''
+
+To test the effectiveness of the implemented OpenLDAP password policies, we will try to change the password of one of the existing OpenLDAP users in our environment.
+
+Some of the checks we implemented above include;
+
+- pwdInHistory: stores 5 previously used passwords in the database to avoid re-use.
+- pwdCheckQuality: Set to value to 2. The server will check the syntax of the password and if the server is unable to check the syntax it will return an error refusing the password.
+- pwdMinLength: Sets the minimum number of characters that will be accepted in a password to 12.
+
+'''Reset User's Password as OpenLDAP RootDN Administrator'''
+
+//Note// the rootDN, which is typically the LDAP administrator, is granted full access and permissions to the entire LDAP directory, including the ability to bypass password policies. This is to ensure that the LDAP administrator can always access and manage the directory, even if there are password policy restrictions in place for regular users. This means that the rootDN administrator can set any password for any user, regardless of the password policy rules defined for regular users. They are not subject to password complexity requirements, expiration rules, or other password policy restrictions that apply to regular users.
+
+Try setting a simple password;
+
+{{{
+ldappasswd -H ldapi:/// -Y EXTERNAL -S "uid=johndoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com"
+}}}
+
+Since you are resetting/setting password as LDAP admin, any password can work;
+
+{{{
+New password: password
+Re-enter new password: password
+SASL/EXTERNAL authentication started
+SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
+SASL SSF: 0
+}}}
+
+From the logs, the result is success.
+
+