Password Failure Lockout doesn't seem to work
by JLPicard
Hi, I am testing out 389_ds_base, version =1.2.11.15,REV=2013.01.31
running on mixed Solaris 10 servers (SPARC and X86) sourced from
http://www.opencsw.org/packages/CSW389-ds-base
in multi-master mode with 4 servers that is primarily used for
authentication and user/group/netgroup management.
Most of the Password policy components seem to work as they should, but
password failure account lockout doesn't appear to engage after X-failed
attempts. After creating a new account, testing a successful login,
after 5+ failed logins with bad passwords, I can still login after I
would expect to be locked out. I even created a new password policy and
applied it to this user and it still doesn't lock him out after 5+
failed logins with bad passwords.
The client server I am trying to login to is a Solaris 10 Sparc OS that
successfully integrates into LDAP for authentication and
user/group/netgroup management.
Can someone recommend some steps to determine where to start attacking
this issue? I assume this is an 389DS issue, but I provided a copy of
our /etc/pam.conf and /etc/nsswitch.conf in case its a client-side
configuration issues.
I have provided some quick diagnostics of current settings as they are
shown below in an ldapsearch-cmd in this environment (see below).
Thanks in advance for any help you may provide.
#Here is the global password policy:
>>ldapsearch -x -ZZ -LLL -h ldap-dr01.my-domain.com -D 'cn=directory
manager' -b 'cn=config' -s base 'objectClass=*' '*' passwordHistory |
grep password
passwordInHistory: 6
passwordUnlock: on
passwordGraceLimit: 0
passwordMustChange: off
passwordWarning: 86400
passwordLockout: off
passwordMinLength: 8
passwordMinDigits: 0
passwordMinAlphas: 0
passwordMinUppers: 0
passwordMinLowers: 0
passwordMinSpecials: 0
passwordMin8bit: 0
passwordMaxRepeats: 0
passwordMinCategories: 3
passwordMinTokenLength: 3
passwordMaxFailure: 3
passwordHistory: off
passwordMaxAge: 8640000
passwordResetFailureCount: 600
passwordisglobalpolicy: on
passwordlegacypolicy: on
passwordtrackupdatetime: off
passwordChange: on
passwordExp: off
passwordLockoutDuration: 3600
passwordCheckSyntax: off
passwordMinAge: 0
passwordStorageScheme: SSHA
#Here is my newly created policy
>>ldapsearch -x -ZZ -LLL -h "my-ldapHost01.my-domain.com" -b
"cn=nsPwPolicyContainer,ou=people,dc=my-domain,dc=com"
"(&(objectClass=ldapsubentry)(objectClass=passwordPolicy)(cn=TestNewPolicy))"
dn: cn=TestNewPolicy,cn=nsPwPolicyContainer,ou=people,dc=my-domain,dc=com
cn: TestNewPolicy
objectClass: top
objectClass: ldapsubentry
objectClass: passwordPolicy
passwordMustChange: on
passwordChange: on
passwordMinAge: 0
passwordKeepHistory: on
passwordInHistory: 12
passwordExp: on
passwordMaxAge: 86400
passwordWarning: 10000
passwordGraceLimit: 5
passwordLockout: on
passwordMaxFailure: 4
passwordResetDuration: 600
passwordLockoutDuration: 3600
passwordCheckSyntax: on
passwordMinLength: 6
passwordMinAlphas: 1
passwordMinCategories: 1
passwordMinDigits: 1
passwordMinLowers: 1
passwordMinUppers: 1
passwordMinSpecials: 0
passwordMin8bit: 0
passwordMaxRepeats: 0
passwordMinTokenLength: 3
passwordStorageScheme: SSHA
#Here is my newly created user with the test policy applied to him
>>ldapsearch -x -ZZ -LLL -h "my-ldapHost01.my-domain.com" -b
"dc=my-domain,dc=com" "cn=test-user-account"
dn: uid=test-user-account,ou=people,dc=my-domain,dc=com
description: accountHasItsOwnPwdPolicy
objectClass: posixAccount
objectClass: shadowAccount
objectClass: account
objectClass: top
uid: test-user-account
cn: test-user-account
uidNumber: 2853
gidNumber: 2600
gecos: User LDAP Test
homeDirectory: /home/test-user-account
loginShell: /bin/tcsh
>>ldapsearch -x -ZZ -LLL -h "my-ldapHost01.my-domain.com" -b
"dc=my-domain,dc=com" "cn=test-user-account" pwdPolicySubentry
dn: uid=test-user-account,ou=people,dc=my-domain,dc=com
pwdPolicySubentry:
cn=TestNewPolicy,cn=nsPwPolicyContainer,ou=people,dc=my-domain,dc=com
>>ldapsearch -x -ZZ -LLL -h "my-ldapHost01.my-domain.com" -b
"dc=my-domain,dc=com" "cn=test-user-account" passwordExpirationtime
dn: uid=test-user-account,ou=people,dc=my-domain,dc=com
passwordExpirationtime: 20131126160316Z
Here is my Solaris-based PAM file: /etc/pam.conf
#ident "@(#)pam.conf 1.31 07/12/07 SMI"
#
# Copyright 2007 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
# PAM configuration
#
# Unless explicitly defined, all services use the modules
# defined in the "other" section.
#
# Modules are defined with relative pathnames, i.e., they are
# relative to /usr/lib/security/. Absolute path names, as
# present in this file in previous releases are still acceptable.
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_unix_cred.so.1
login auth required pam_dial_auth.so.1
login auth binding pam_unix_auth.so.1 server_policy
login auth required pam_ldap.so.1
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth required pam_dhkeys.so.1
rlogin auth required pam_unix_cred.so.1
rlogin auth binding pam_unix_auth.so.1 server_policy
rlogin auth required pam_ldap.so.1
#
# Kerberized rlogin service
#
#
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
#
rsh auth sufficient pam_rhosts_auth.so.1
rsh auth required pam_unix_cred.so.1
rsh auth binding pam_unix_auth.so.1 server_policy
rsh auth required pam_ldap.so.1
#
# Kerberized rsh service
#
#
# Kerberized telnet service
#
#
# PPP service (explicit because of pam_dial_auth)
#
ppp auth requisite pam_authtok_get.so.1
ppp auth required pam_dhkeys.so.1
ppp auth required pam_dial_auth.so.1
ppp auth binding pam_unix_auth.so.1 server_policy
ppp auth required pam_ldap.so.1
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
#
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth required pam_unix_cred.so.1
other auth binding pam_unix_auth.so.1 server_policy
other auth required pam_ldap.so.1
#
# passwd command (explicit because of a different authentication module)
#
passwd auth binding pam_passwd_auth.so.1 server_policy
passwd auth required pam_ldap.so.1
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron account required pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other account requisite pam_roles.so.1
other account binding pam_unix_account.so.1 server_policy
other account required pam_list.so.1 allow=/etc/user.allow
other account required pam_ldap.so.1
#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other session required pam_unix_session.so.1
#
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
#
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password required pam_authtok_store.so.1 server_policy
#
# Support for Kerberos V5 authentication and example configurations can
# be found in the pam_krb5(5) man page under the "EXAMPLES" section.
#
ppp auth required pam_unix_cred.so.1
ppp auth required pam_unix_auth.so.1
krlogin auth required pam_unix_cred.so.1
krlogin auth required pam_krb5.so.1
krsh auth required pam_unix_cred.so.1
krsh auth required pam_krb5.so.1
ktelnet auth required pam_unix_cred.so.1
ktelnet auth required pam_krb5.so.1
Here is my Solaris-based NSSWITCH file: /etc/nsswitch.conf
#
# Copyright 2006 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
# ident "@(#)nsswitch.ldap 1.10 06/05/03 SMI"
#
# /etc/nsswitch.ldap:
#
# An example file that could be copied over to /etc/nsswitch.conf; it
# uses LDAP in conjunction with files.
#
# "hosts:" and "services:" in this file are used only if the
# /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports.
# LDAP service requires that svc:/network/ldap/client:default be enabled
# and online.
# the following two lines obviate the "+" entry in /etc/passwd and
/etc/group.
passwd: files ldap
group: files ldap
# consult /etc "files" only if ldap is down.
hosts: files dns
# Note that IPv4 addresses are searched for in all of the ipnodes databases
# before searching the hosts databases.
ipnodes: files dns
networks: files
protocols: files
rpc: files
ethers: files
netmasks: files
bootparams: files
publickey: files
netgroup: ldap
automount: files ldap
aliases: files ldap
# for efficient getservbyname() avoid ldap
services: files ldap
printers: user files ldap
auth_attr: files ldap
prof_attr: files ldap
project: files ldap
tnrhtp: files ldap
tnrhdb: files ldap
owner(a)lists.fedoraproject.org.
10 years, 4 months
Managing user quotas
by Mitja Mihelič
Hi!
Is it possible to manage user quotas in 389DS?
This would be the desired setup:
389DS
- holds user information and is used at the primary authentication source
Client
- runs SSSD and all queries about the users get sent through SSSD to 389DS
- manages user quota based on the information in 389DS
Reagards,
Mitja
--
--
Mitja Mihelič
ARNES, Tehnološki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia
tel: +386 1 479 8877, fax: +386 1 479 88 78
10 years, 4 months
setup-ds-admin.pl --update and multiple masters
by Vesa Alho
Hi,
I have the following setup:
ldap1.example.com
ldap2.example.com
They are in Multiple Master configuration. After normal yum updates, I
run setup-ds-admin.pl --update
1. What does this script actually do with --update parameter? Does it
only update version numbers for Console?
2. How do I update version numbers for the second MM? ldap2 is
configured to use ldap1 as configuration server. Also netscaperoot and
userroot have replication agreements both ways. So, I assumed that
running "setup-ds-admin.pl --update" to
"ldaps://ldap1.example.com:636/o=NetscapeRoot" would update numbers to
both MM servers. But it doesn't and if I try to use
ldaps://ldap2.example.com:636/o=NetscapeRoot script gives "unknown error".
Thanks!
-Vesa
10 years, 4 months
nsds5replicaLastInitStatus: -2 Total update abortedSystem error
by Graham Leggett
Hi all,
I have two LDAP servers in a multimaster replication setup that has worked fine for a while.
Recently it was reported to me that the two LDAP servers had somehow gone out of sync and refused to replicate. I am trying to fix this by triggering an initialisation from what I've chosen to be authoritative source of data to the other using the instructions here: http://www.centos.org/docs/5/html/CDS/ag/8.0/Managing_Replication-Configu...
When the replication is triggered, a few thousand lines appear on the remote side's log that look like this:
[23/Nov/2013:15:00:07 +0000] conn=4402 op=0 BIND dn="cn=Replication Manager,cn=config" method=128 version=3
[23/Nov/2013:15:00:07 +0000] conn=4402 op=0 RESULT err=0 tag=97 nentries=0 etime=1 dn="cn=replication manager,cn=config"
[23/Nov/2013:15:00:07 +0000] conn=4402 op=1 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension"
[23/Nov/2013:15:00:07 +0000] conn=4402 op=1 RESULT err=0 tag=101 nentries=1 etime=0
[23/Nov/2013:15:00:07 +0000] conn=4402 op=2 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension"
[23/Nov/2013:15:00:07 +0000] conn=4402 op=2 RESULT err=0 tag=101 nentries=1 etime=0
[23/Nov/2013:15:00:07 +0000] conn=4402 op=3 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop"
[23/Nov/2013:15:00:07 +0000] conn=4402 op=3 RESULT err=0 tag=120 nentries=0 etime=0
[23/Nov/2013:15:00:08 +0000] conn=4402 op=4 EXT oid="2.16.840.1.113730.3.5.6" name="Netscape Replication Total Update Entry"
[23/Nov/2013:15:00:08 +0000] conn=4402 op=4 RESULT err=0 tag=120 nentries=0 etime=0
[23/Nov/2013:15:00:08 +0000] conn=4402 op=5 EXT oid="2.16.840.1.113730.3.5.6" name="Netscape Replication Total Update Entry"
[23/Nov/2013:15:00:08 +0000] conn=4402 op=5 RESULT err=0 tag=120 nentries=0 etime=0
[snip a few thousand log entries all saying err=0]
The side that I initialised the replication from lists this message as the status, which is too vague to be useful:
nsds5replicaLastInitStatus: -2 Total update abortedSystem error
Does anyone know what the error "-2" means?
Does anyone have any clear and unambiguous instructions for re-initialising two LDAP servers that have gone out of sync?
Regards,
Graham
--
10 years, 4 months
Announcing 389 Directory Server versions 1.2.11.25, 1.3.0.9, 1.3.1.15, 1.3.2.5
by Rich Megginson
389 Directory Server versions 1.2.11.25, 1.3.0.9, 1.3.1.15, 1.3.2.5
The 389 Directory Server team is proud to announce new 389-ds-base versions:
* 1.2.11.25 for EL5 and EL6
* 1.3.0.9 for F18
* 1.3.1.15 for F19
* 1.3.2.5 for F20 and Rawhide
These packages address CVE-2013-4485
https://bugzilla.redhat.com/show_bug.cgi?id=1024552
in addition to several other fixes, depending on the platform. Since
these packages address a security issue they will be expedited into
Stable. We strongly encourage you to try out the packages from the
Testing repo and plan accordingly.
The source tarballs for these releases are available at
http://port389.org/wiki/Source
See http://port389.org/wiki/Release_Notes for detailed information about
each release.
* Installation and Upgrade
See http://port389.org/wiki/Download for information about setting up
your yum repositories.
To install, use yum install 389-ds. After install completes, run
setup-ds-admin.pl to set up your directory server.
To upgrade, use yum upgrade. After upgrade completes, run
setup-ds-admin.pl -u to update your directory server/admin
server/console information.
See
http://port389.org/wiki/Install_Guide<http://port389.org/wiki/Install_Guide>
for more information about the initial installation, setup, and upgrade
* Feedback
We are very interested in your feedback!
Please provide feedback and comments to the
389-users(a)lists.fedoraproject.org mailing list:
https://admin.fedoraproject.org/mailman/listinfo/389-users
If you find a bug, or would like to see a new feature, file it in our
Trac instance: https://fedorahosted.org/389
10 years, 5 months
389 directory server crash
by Mitja Mihelič
Hi!
We are having problems with some our 389-DS instances. They crash after
receiving an update from the provider.
The crash happened twice after about a week of running without problems.
The crashes happened on two consumer servers but not at the same time.
The servers are running CentOS 6x with the following 389DS packages
installed:
389-ds-console-doc-1.2.6-1.el6.noarch
389-console-1.1.7-1.el6.noarch
389-adminutil-1.1.15-1.el6.x86_64
389-dsgw-1.1.10-1.el6.x86_64
389-ds-base-debuginfo-1.2.11.15-14.el6_4.x86_64
389-admin-1.1.29-1.el6.x86_64
389-ds-console-1.2.6-1.el6.noarch
389-admin-console-doc-1.1.8-1.el6.noarch
389-ds-1.2.2-1.el6.noarch
389-ds-base-1.2.11.15-14.el6_4.x86_64
389-ds-base-libs-1.2.11.15-14.el6_4.x86_64
389-admin-console-1.1.8-1.el6.noarch
We are in the process of replacing the Centos 5x base consumer+provider
setup with a CentOS 6x base one. For the time being, the CentOS 6
machines are acting as consumers for the old server. They run for a
while and then the replicated instances crash though not at the same time.
One of the servers did not want to start after the crash, so I have run
db2index on its database. It's been running for four days and it has
still not finished. All I get from db2index now are these outputs:
[09/Jul/2013:13:29:11 +0200] - reindex db: Processed 65095 entries (pass
1104) -- average rate 53686277.5/sec, recent rate 0.0/sec, hit ratio 0%
The other instance did start up, but the replication process did not
work anymore. I disabled the replication to this host and set it up
again. I chose "Initialize consumer now" and the consumer crashed every
time. I have enabled full error logging and could find nothing.
I have read a few threads (not all, I admit) on this list and
http://directory.fedoraproject.org/wiki/FAQ#Debugging_Crashes and tried
to troubleshoot.
The crash produced the attached core dump and I could use your help with
understanding it. As well as any help with the crash. If more info is
needed I will gladly provide it.
Regards, Mitja
10 years, 5 months
setup-ds-admin.pl errors
by Alberto Viana
I'm trying to set up a new instance of 389 DS in my homologation enviroment:
389-ds-base-1.3.2.4
389-adminutil-1.1.18
389-admin-console-1.1.8
After I ran setup-ds-admin.pl, i'm getting the following errors:
Are you ready to set up your servers? [yes]:
Creating directory server . . .
Could not import LDIF file '/tmp/ldif9lEZLw.ldif'. Error: 256. Output:
./ldif2db: 3: ./ldif2db: source: not found
./ldif2db: 5: ./ldif2db: libpath_add: not found
./ldif2db: 6: ./ldif2db: libpath_add: not found
./ldif2db: 7: ./ldif2db: libpath_add: not found
./ldif2db: 8: ./ldif2db: libpath_add: not found
./ldif2db: 84: ./ldif2db: get_init_file: not found
./ldif2db: 85: [: 127: unexpected operator
importing data ...
usage: ns-slapd ldif2db -D configdir [-d debuglevel] [-n
backend_instance_name] [-O] [-g uniqueid_type] [--namespaceid uniqueID][{-s
includesuffix}*] [{-x excludesuffix}*] [-E] [-q] {-i ldif-file}*
Note: either "-n backend_instance_name" or "-s includesuffix" is required.
Error: Could not create directory server instance 'RNP'.
Exiting . . .
Log file is '/tmp/setupBsGuLZ.log'
I also tried "389-ds-base-1.3.1.12". Any clues?
10 years, 5 months
Recommended Berkeley DB for compiling 389 DS 1.3.2.3 version
by Balaji P
Hi All,
I downloaded 389 directory server source code 1.3.2.3 from link (http://port389.org/sources/389-ds-base-1.3.2.3.tar.bz2) and try to compile in my CentOS release 4.9 (Final) environment. I noticed below error message and suspect with referring invalid Berkeley DB version. I am currently using Berkeley DB version is db4-4.2.52-7.3.el4 and the link recommended the same. http://directory.fedoraproject.org/wiki/Building#Berkeley_DB
Anyone have idea about what is recommended release version of Berkely DB? Is any other dependencies require to compile the 389 DS 1.3.2.3 release version?
Note: I have able to compile 389 DS 1.2.8.2 release version using this build environment.
[root@ ~]# rpm -qa | grep db4
db4-4.2.52-7.3.el4
db4-4.2.52-7.3.el4
[root@ ~]#
Error message:
In function `checkpoint_threadmain':
../ldap/servers/slapd/back-ldbm/dblayer.c:4789: error: `DB_COMPACT' undeclared (first use in this function)
../ldap/servers/slapd/back-ldbm/dblayer.c:4789: error: (Each undeclared identifier is reported only once
../ldap/servers/slapd/back-ldbm/dblayer.c:4789: error: for each function it appears in.)
../ldap/servers/slapd/back-ldbm/dblayer.c:4789: error: syntax error before "c_data"
../ldap/servers/slapd/back-ldbm/dblayer.c:4791: error: `inst_obj' undeclared (first use in this function)
../ldap/servers/slapd/back-ldbm/dblayer.c:4794: error: `inst' undeclared (first use in this function)
../ldap/servers/slapd/back-ldbm/dblayer.c:4795: error: `rc' undeclared (first use in this function)
../ldap/servers/slapd/back-ldbm/dblayer.c:4795: error: `db' undeclared (first use in this function)
../ldap/servers/slapd/back-ldbm/dblayer.c:4809: error: `c_data' undeclared (first use in this function)
../ldap/servers/slapd/back-ldbm/dblayer.c:4809: error: `DB_FREE_SPACE' undeclared (first use in this function)
../ldap/servers/slapd/back-ldbm/dblayer.c:4691: error: label `error_return' used but not defined
../ldap/servers/slapd/back-ldbm/dblayer.c: At top level:
../ldap/servers/slapd/back-ldbm/dblayer.c:4857: error: syntax error before '{' token
../ldap/servers/slapd/back-ldbm/dblayer.c:4858: error: `li' undeclared here (not in a function)
../ldap/servers/slapd/back-ldbm/dblayer.c:4858: error: initializer element is not constant
../ldap/servers/slapd/back-ldbm/dblayer.c:4858: warning: data definition has no type or storage class
../ldap/servers/slapd/back-ldbm/dblayer.c:4859: error: syntax error before ':' token
../ldap/servers/slapd/back-ldbm/dblayer.c:4861: error: syntax error before '->' token
../ldap/servers/slapd/back-ldbm/dblayer.c:4861: warning: data definition has no type or storage class
With Regards,
Balaji P
10 years, 5 months
Current state, groups of groups
by Deas, Jim
I am running a very old version of 389. I need to upgrade or switch to Mac OSX. The one positive aspect of Mac is the ability to create groups from sub groups.
Do the newer versions of 389 have a way to add sub groups to other groups?
Jim Deas
PPS Engineering | Warner Bros. Post Production Sound
4000 Warner Blvd | Bld 150 Rm. 256 | Burbank Ca. 91522
Office (818)954-6570 | Cell (818)967-8354: | Skype jim.deas2
jim.deas(a)warnerbros.com
10 years, 5 months
389-ds-base-1.2.10.14-3.2.el5: replication latency >= 300s, 400s, 900s..
by Justin Piszcz
Hi,
Problem: During high levels of writes to the master server, _some_
LDAP search hosts replication_latency rises (and in some cases, does
not recover) unless its removed from service or slapd is restarted.
Version: 389-ds-base-1.2.10.14-3.2.el5 (x86_64)
During normal operation, typical replication latency is <= 60 seconds
in our environment.
Questions:
1. Does slapd's BDB backend DB's suffer fragmentation over time? Will
periodic restarts of the slapd improve performance?
2. There are search hosts running on a variety of hardware and it
happens more or less across the board. We've tried specific tweaks on
the hosts with the IO scheduler and other system tuning but this
problem appears(?) to be at the application-level. Is there any
system tuning that I am missing here or slapd tuning to avoid this
problem?
3. Further, is there or are there plans to support network-level
compression on the replication data from the master->hubs->search
hosts?
4. Aside from removing the host from active service and/or restarting
slapd and removing it from service, what are the recommended best
practices to avoid this problem happening in the first place?
Currently we are looking into automation to remove the hosts from
service automatically when latency breaches a certain threshold-- but
why does this occur and is there anyway to tweak/tune or limit search
performance until the replication latency recovers?
Example: Problem begins:
replication_latency_sec=424
[ .. after a few min .. ]
replication_latency_sec=549
replication_latency_sec=553
replication_latency_sec=555
replication_latency_sec=561
replication_latency_sec=564
[ .. after 10 min or so .. ]
replication_latency_sec=780
replication_latency_sec=763
replication_latency_sec=768
replication_latency_sec=774
replication_latency_sec=779
replication_latency_sec=785
replication_latency_sec=791
replication_latency_sec=796
replication_latency_sec=802
replication_latency_sec=807
replication_latency_sec=813
replication_latency_sec=818
replication_latency_sec=824
Justin.
10 years, 5 months