On 09/11/2013 04:06 PM, Bright, Daniel wrote:

Jakub,

 

Thanks for the quick response, to answer your question I am using the built-in password policy features of 389-ds that allows us to use these features:

 

Maximum Number of Failures

Password Change After Reset

User-Defined Passwords

Password Expiration

Expiration Warning

Grace Login Limit

Password Syntax Checking

Password Length

Password Minimum Age

Password History

Password Storage Schemes

Password Last Change Time

 

Here is a sanitized version of ldap.conf that is used in our current environment:

 

===========================================================================

 

host ldap1 ldap2

URI ldap://ldap1:389 ldap://ldap2:389

 

base dc=some,dc=company,dc=com

#bind_timelimit 5

#>>

bind_timelimit 3

bind_policy soft

timelimit 3

#^^

ldap_version 3

 

pam_lookup_policy yes

pam_filter objectclass=posixAccount

pam_password md5

 

nss_base_passwd ou=People,dc=some,dc=company,dc=com?one

nss_base_passwd ou=Disabled Users,dc=some,dc=company,dc=com?one

nss_base_shadow ou=People,dc=some,dc=company,dc=com?one

nss_base_group  ou=Groups,dc=some,dc=company,dc=com?one?|(host=\2A)(host=osd)

#>>

nss_initgroups_ignoreusers root,ldap

#^^

 

ssl start_tls

#ssl on

tls_cacertdir /etc/openldap/cacerts

 

===========================================================================

 

Thanks,
Daniel Bright



_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users

I would leave this for Jakub to comment in the morning however if you use 389 DS it should be enforcing your password policy.
SSSD leaves it to central server to enforce. It does not do any possword policy checking locally to the best of my knowledge except trying to deal with shadow.

ldap_pwd_policy (string)
               Select the policy to evaluate the password expiration on the
               client side. The following values are allowed:

               none - No evaluation on the client side. This option cannot
               disable server-side password policies.

               shadow - Use shadow(5) style attributes to evaluate if the
               password has expired.

               mit_kerberos - Use the attributes used by MIT Kerberos to
               determine if the password has expired. Use chpass_provider=krb5
               to update these attributes when the password is changed.

               Default: none


I think commenting shadow is the right step.
When you try with this setting removed (and SSSD restarted) do you see actually the change happening on the central server? Have you checked the 389 DS logs?
Can it be that password change actually does not go to the DS server but captured by some other PAM module in your stack?

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/