Just to show how contacting a socket can be easy I spent 15 minutes
learning about python's cracklib binding and writing an example
listener to be run at each invocation on a scoket (using stind/stdout
here, could audit on stderr):
-----------------------------------------------------------------------
$ cat ipapwcrack.py
#!/usr/bin/python
import cracklib
import json
import sys
try:
data = json.loads(sys.stdin.read())
try:
cracklib.VeryFascistCheck(data['new'], old=data.get('old',
None))
except ValueError as e:
print(json.dumps({'error':str(e)}))
sys.exit(1)
except Exception as e:
print(json.dumps({'error':'Internal error','debug':str(e)}))
sys.exit(1)
print(json.dumps({'success':True}))
sys.exit(0)
-----------------------------------------------------------------------
Usage examples:
$ echo
'{"user":"username","new":"newpwd","old":"oldpwd"}'
| ./ipapwcrack.py
{"error": "is too similar to the old one"}
$ echo "asds'" | ./ipapwcrack.py
{"debug": "No JSON object could be decoded", "error":
"Internal error")
$ echo
'{"user":"username","new":"newpwd3412432","old":"old123"}'
| ./ipapwcrack.py
{"success": true}
On Fri, 2018-07-13 at 07:54 -0400, Simo Sorce via FreeIPA-devel wrote:
> On Fri, 2018-07-13 at 07:46 -0400, Mark Reynolds wrote:
> > Hi Simo,
> >
> > Yes this would be a long term goal, but we need to do something
> > now,
> > and
> > we have a customer pushing for us top do this feature set
> > "today".
> > Development on this is basically done already. It just needs to
> > be
> > ported to FreeIPA. But I will leave it up to guys on how you want
> > to proceed...
>
> You can do this now, but do it right, the main issue with your
> approach
> is not the quick fix, but the long term maintenance issues and the
> pushing out of the "proper" fix because "it is easier to tweak it
> here
> and now". You are also talking about extending schema which is always
> annoying to do when you take into account old servers and upgrades.
>
> Calling out to a socket with a simple json (or other) formatting for
> data is not a lot of work (you just need to send out 3 strings
> (username, oldpassword, newpassword), certainly comparable to that of
> extending the current plugin.
>
> Plugging it into a cracklib based listener is also going to be
> trivial,
> and if you use a unix socket for the example also something that can
> be
> trivially encapsulated into a systemd socket unit that gets activated
> only if and when this feature is used and stay dormant otherwise.
>
> I know you have pressure to do a "quick fix, but I would ask you to
> resist the urge and consider longer term maintenance as a deciding
> factor. Short term fixes always tend to cause long term maintenance
> burden. The current approach already did, let's not keep doing the
> same
> mistake.
>
> Simo.
>
> > Thanks,
> >
> > Mark
> >
> >
> > On 07/13/2018 07:34 AM, Simo Sorce via FreeIPA-devel wrote:
> > > Hi Mark,
> > >
> > > FWIW I do not think we should do this *in* FreeIPA or the 389ds
> > > password plugin.
> > >
> > > I think we should provide a mechanism to invoke an external
> > > service
> > > to
> > > check for password quality and defer to it any enhancement.
> > >
> > > There are just too many different requests coming in, each with
> > > their
> > > custom thing they want to check.
> > > We can satisfy everyone at once by simply externalizing this
> > > check
> > > instead of trying to catch up to every last fade in pw quality
> > > checking
> > > (passwords are all bad, people need to move to 2FA anyway).
> > >
> > > We can also modify our password change clients to provide the
> > > previous
> > > password during the ldappasswd password change operation, so that
> > > those
> > > scripts can get the previous value too, energy would be spent far
> > > better this way than chasing external requirements.
> > >
> > > An external mechanism would allow people to do even better things
> > > like
> > > querying HIBP[1] via their secure hashed method to prevent people
> > > from
> > > using known bad passwords, and any other SaaS based mechanism.
> > >
> > > We could, then, for example provide an example external mechanism
> > > based
> > > on libpwquality/pam_pwquality so that people understand how to
> > > use
> > > it.
> > >
> > > My 2c,
> > > Simo.
> > >
> > > [1]
https://haveibeenpwned.com/
> > >
> > > On Thu, 2018-07-12 at 15:08 -0400, Mark Reynolds via FreeIPA-
> > > devel
> > > wrote:
> > > > Hello,
> > > >
> > > > I've written up a basic design doc below of what I am proposing
> > > > for
> > > > FreeIPA. This work has already been done in 389 Directory
> > > > Server,
> > > > and
> > > > it can be easily ported to FreeIPA (which I am volunteering to
> > > > do).
> > > > While there are other features we would like to add, these are
> > > > the
> > > > features that most customers are "asking" for today, and
these
> > > > are
> > > > the
> > > > features that we can easily "add" today. Please look it
over,
> > > > and
> > > > share
> > > > your thoughts if this design is acceptable.
> > > >
> > > > Thanks,
> > > >
> > > > Mark
> > > >
> > > >
> > > > Enhance Password Policy Features in FreeIPA
> > > > ===========================================
> > > >
> > > > Customers have been requesting a richer set of password policy
> > > > syntax
> > > > checking features. Mainly everybody wants the feature set from
> > > > pam_pwquality, and one particular customer has explicitly asked
> > > > for
> > > > a
> > > > feature to reject duplicate sequences of a particular
> > > > length. Not
> > > > all
> > > > of the pam_pwquality features can be ported to FreeIPA because
> > > > some
> > > > of
> > > > the features require you have the current password in clear
> > > > text.
> > > > The
> > > > following list contains the features that need to be added (and
> > > > can
> > > > be
> > > > added) to FreeIPA.
> > > >
> > > >
> > > > New Feature List
> > > > ----------------------------------------
> > > >
> > > > - Palindrome Checks (on/off)- password can not be a palindrome.
> > > > (pam_pwquality)
> > > > - Sequence Checks (length) - password can not have a monotonic
> > > > sequence
> > > > (1234, abcd, 4321, dcba) of set length in password.
> > > > (pam_pwquality)
> > > > - Sequence Sets (length) - password can not have duplicate
> > > > monotonic
> > > > sequences of set length: ma123_123jF (customer request)
> > > > - Consecutive Character Classes (length) - Password can not
> > > > have
> > > > consecutive characters from the same class/category greater
> > > > than
> > > > the
> > > > length. If set to 3, then this password is invalid:
> > > > azd5555_f -
> > > > >
> > > >
> > > > there
> > > > are 4 consecutive digits which exceeds the limit of 3.
> > > > (pam_pwquality)
> > > > - Dictionary Check (on/off) - Checks password against CrackLib.
> > > > (pam_pwquality)
> > > > - Outstanding SELinux issue is blocking the dictionary
> > > > check
> > > > from
> > > > working:
https://Bugzilla.redhat.com/show_bug.cgi?id=1599726et
> > > > - Dictionary Path (string) - Path to custom CrackLib dictionary
> > > > files.
> > > > (pam_pwquality)
> > > > - Bad Words (string) - space separated list of words that are
> > > > not
> > > > allowed to be in passwords. (pam_pwquality)
> > > > - User Attributes (string) - space separated list of attributes
> > > > whose
> > > > values (tokens of values) are not allowed in the new password.
> > > > (pam_pwquality)
> > > > - This requires another setting (krbPwdMinTokenLength)
> > > > that
> > > > does
> > > > not currently exist in FreeIPA.
> > > > - Minimum number of digits (length) - (pam_pwquality)
> > > > - Minimum number of alphas (length) - (pam_pwquality)
> > > > - Minimum number of special characters (length) -
> > > > (pam_pwquality)
> > > > - Minimum number of 8-bit characters (length) - (pam_pwquality)
> > > > - Minimum number of uppercase (length) - (pam_pwquality)
> > > > - Minimum number of lowercase (length) - (pam_pwquality)
> > > > - Maximum repeated characters (length) - (pam_pwquality)
> > > >
> > > >
> > > > Configuration
> > > > -----------------------------------------
> > > >
> > > > Current FreeIPA Password Policy Configuration:
> > > >
> > > > dn:
> > > > cn=global_policy,cn=MARKFREE.COM,cn=kerberos,dc=markfree,dc=com
> > > > objectClass: top
> > > > objectClass: nsContainer
> > > > objectClass: krbPwdPolicy
> > > > krbMinPwdLife: 3600
> > > > krbPwdMinDiffChars: 0
> > > > krbPwdMinLength: 8
> > > > krbPwdHistoryLength: 0
> > > > krbMaxPwdLife: 7776000
> > > > krbPwdMaxFailure: 6
> > > > krbPwdFailureCountInterval: 60
> > > > krbPwdLockoutDuration: 600
> > > > cn: global_policy
> > > >
> > > > New Attributes to add to objectclass "krbPwdPolicy":
> > > >
> > > > krbPwdPalindrome: on
> > > > krbPwdMaxSequence: 4
> > > > krbPwdMaxSeqSets: 2
> > > > krbPwdMaxCharClass: 3
> > > > krbPwdMinDigits: 1
> > > > krbPwdMinAlphas: 1
> > > > krbPwdMinSpecial: 1
> > > > krbPwdMin8bit: 0
> > > > krbPwdMinUppers: 1
> > > > krbPwdMinLowers: 1
> > > > krbPwdMaxRepeated: 3
> > > > krbPwdDictCheck: on
> > > > krbPwdDictPath: /path/to/custom/cracklib/dict/files
> > > > krbPwdBadWords: redhat fedora
> > > > krbPwdUserAttrs: uid cn sn givenname mail
> > > > krbPwdMinTokenLength: 3 **works only with
> > > > "krbPwdUserAttrs".
> > > > Example: if any 3 consecutive characters from "uid" (and
> > > > friends)
> > > > are
> > > > in
> > > > the new password then it is rejected
> > > >
> > > >
> > > > Implementation
> > > > -------------------------------------------
> > > >
> > > > Dictionary Checks require linking with CrackLib as follows:
> > > >
> > > > diff --git a/freeipa.spec.in b/freeipa.spec.in
> > > > index 0ebc6df3e..ba573a00f 100755
> > > > --- a/freeipa.spec.in
> > > > +++ b/freeipa.spec.in
> > > > @@ -148,6 +148,7 @@ BuildRequires: libini_config-devel
> > > > BuildRequires: cyrus-sasl-devel
> > > > %if ! %{ONLY_CLIENT}
> > > > BuildRequires: 389-ds-base-devel >= %{ds_version}
> > > > +BuildRequires: cracklib-devel
> > > >
> > > >
> > > > diff --git a/util/Makefile.am b/util/Makefile.am
> > > > index be40e8699..5c24be2b9 100644
> > > > --- a/util/Makefile.am
> > > > +++ b/util/Makefile.am
> > > > @@ -14,3 +14,4 @@ libutil_la_SOURCES = ipa_krb5.c \
> > > > ipa_pwd_ntlm.c
> > > >
> > > > libutil_la_LIBADD = $(CRYPTO_LIBS) $(KRB5_LIBS)
> > > > $(LDAP_LIBS)
> > > > $(NSS_LIBS)
> > > > +libutil_la_LDFLAGS = -lcrack
> > > >
> > > >
> > > > pam_pwquality is open sourced and has been ported to 389
> > > > Directory
> > > > Server. The changes in 389 DS can basically be copied and
> > > > pasted
> > > > into
> > > > FreeIPA source (around ipapwd_CheckPolicy() in
> > > > daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c). The major
> > > > change
> > > > here is that we need to provide the Slapi_Entry to
> > > > ipapwd_CheckPolicy()
> > > > so you can check its attributes/values for the "User
Attribute"
> > > > comparison feature (I've actually already coded this in a beta
> > > > patch).
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.
> > > > or
> > > > g
> > > > To unsubscribe send an email to freeipa-devel-leave(a)lists.fedor
> > > > ah
> > > > oste
> > > > d.org
> > > > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.h
> > > > tm
> > > > l
> > > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_gu
> > > > id
> > > > elin
> > > > es
> > > > List Archives:
https://lists.fedoraproject.org/archives/list/fr
> > > > ee
> > > > ipa-
> > > > devel(a)lists.fedorahosted.org/message/FUST5IM3GUNIDGNZASI4RYMB6P
> > > > 4W
> > > > BRD6
> > > > /
> > >
> > > _______________________________________________
> > > FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.or
> > > g
> > > To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorah
> > > os
> > >
ted.org
> > > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.htm
> > > l
> > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guid
> > > el
> > > ines
> > > List Archives:
https://lists.fedoraproject.org/archives/list/free
> > > ip
> > > a-
> > > devel(a)lists.fedorahosted.org/message/HHWPLX4WZJ54M6AVL6AR5HE3TP63
> > > 6T
> > > 7O/
> >
> >
>
> _______________________________________________
> FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahoste
> d.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelin
> es
> List Archives:
https://lists.fedoraproject.org/archives/list/freeipa-
> devel(a)lists.fedorahosted.org/message/LXPFM5IUXAS6ZVHCT75NA3YAI5ZX4C7K
> /