LDAP policies - Revision history

Tcepo at 23:54, 30 November 2016

2016-11-30T23:54:36Z

← Older revision		Revision as of 01:54, 1 December 2016
Line 126:		Line 126:
	=== Requirement ===		=== Requirement ===
	* To have user user test		* To have user user test
	~~echo "~~Enter user login"		# Enter user login
	read MyUser		read MyUser

Line 184:		Line 184:
	* Down time 1/2 hour		* Down time 1/2 hour
	* Backup file		* Backup file
	ls -lrt ~/ldap.backup.*.tar.gz \|tail		<pre>
			ls -lrt ~/ldap.backup.*.tar.gz \|tail

	echo "Default backup : MyBackup=$MyBackup"		echo "Default backup : MyBackup=$MyBackup"
	~~echo~~
	~~echo "~~Change if necessary"		# Change if necessary
			</pre>

	=== Stop all LDAP nodes ===		=== Stop all LDAP nodes ===
Line 202:		Line 204:
	tar xzvf "${MyBackup}") &&\		tar xzvf "${MyBackup}") &&\
	mv ~/ldap.tmp.tar.gz ~/ldap.undo.tar.gz &&\		mv ~/ldap.tmp.tar.gz ~/ldap.undo.tar.gz &&\
	cd -		cd - &&\
			MyBackup=~/ldap.undo.tar.gz
	</pre>		</pre>

	~~# Undo MyBackup=~/ldap.~~undo~~.tar.gz~~		* To undo execute the block before one more time

	=== Start all LDAP nodes ===		=== Start all LDAP nodes ===

Tcepo at 23:33, 30 November 2016

2016-11-30T23:33:34Z

← Older revision		Revision as of 01:33, 1 December 2016
Line 125:		Line 125:
	== Test ==		== Test ==
	=== Requirement ===		=== Requirement ===
	* ~~User login~~		* To have user user test
	echo "Enter user login"		echo "Enter user login"
	read MyUser		read MyUser

	==== example ====		==== How create test user example ====
	* Create backup before		* Create backup before
	<pre>		<pre>

Tcepo at 23:29, 30 November 2016

2016-11-30T23:29:40Z

← Older revision		Revision as of 01:29, 1 December 2016
Line 176:		Line 176:
	=== Start checking ===		=== Start checking ===
	* Test many passwords :		* Test many passwords :
	ldappasswd -x -H ldap://localhost -D "${MyUserDN}" -w mypasswd -s mypasswdnew		ldappasswd -x -H ldap://localhost -D "${MyUserDN}" -w mypasswd -s <mypasswdnew>

	* Prevent users from ending of maintenance.		* Prevent users from ending of maintenance.

Tcepo at 23:25, 30 November 2016

2016-11-30T23:25:32Z

← Older revision		Revision as of 01:25, 1 December 2016
Line 125:		Line 125:
	== Test ==		== Test ==
	=== Requirement ===		=== Requirement ===
	* User ~~test~~		* User login
			echo "Enter user login"
			read MyUser

			==== example ====
			* Create backup before
			<pre>
			cat <<EOT >/tmp/$$.ldif
			dn: ou=users,${MyolcSuffix}
			description: My Organization users come here
			objectclass: top
			objectclass: organizationalUnit
			ou: users

			dn: uid=${MyUser},ou=users,${MyolcSuffix}
			cn: ${MyUser}
			sn: ${MyUser}SN
			uid: ${MyUser}
			ou: users
			objectClass: organizationalPerson
			objectClass: inetOrgPerson
			EOT
			ldapadd -D "${MyolcRootDN}" -W -f /tmp/$$.ldif
			</pre>

	=== Init test ===		=== Init test ===
	<pre>		<pre>
	# Init		# Init
	~~MyUser="test"~~

	MyFilter=$(MyPatern='^olcSuffix: (dc=[^,],dc=[^,])$'		MyFilter=$(MyPatern='^olcSuffix: (dc=[^,],dc=[^,])$'
	slapcat -n0 \|\		slapcat -n0 \|\
Line 178:		Line 199:
	cd / &&\		cd / &&\
	find $(tar -ztf "${MyBackup}") -type f \|cpio -ov --format=ustar \|gzip >~/ldap.tmp.tar.gz &&\		find $(tar -ztf "${MyBackup}") -type f \|cpio -ov --format=ustar \|gzip >~/ldap.tmp.tar.gz &&\
	~~mv ~/ldap.tmp.tar.gz ~/ldap.undo.tar.gz &&\~~
	(find $(tar -ztf "${MyBackup}") -type f -delete		(find $(tar -ztf "${MyBackup}") -type f -delete
	tar xzvf "${MyBackup}") &&\		tar xzvf "${MyBackup}") &&\
			mv ~/ldap.tmp.tar.gz ~/ldap.undo.tar.gz &&\
	cd -		cd -
	</pre>		</pre>

Tcepo at 22:55, 30 November 2016

2016-11-30T22:55:52Z

← Older revision		Revision as of 00:55, 1 December 2016
Line 126:		Line 126:
	=== Requirement ===		=== Requirement ===
	* User test		* User test
	~~MyUser="<UserTest>"~~

	=== Init test ===		=== Init test ===
	<pre>		<pre>
	# Init		# Init
			MyUser="test"

	MyFilter=$(MyPatern='^olcSuffix: (dc=[^,],dc=[^,])$'		MyFilter=$(MyPatern='^olcSuffix: (dc=[^,],dc=[^,])$'
	slapcat -n0 \|\		slapcat -n0 \|\

Tcepo at 22:49, 30 November 2016

2016-11-30T22:49:45Z

← Older revision		Revision as of 00:49, 1 December 2016
Line 175:		Line 175:
	=== Restore ===		=== Restore ===
	<pre>		<pre>
			cd / &&\
	find $(tar -ztf "${MyBackup}") -type f \|cpio -ov --format=ustar \|gzip >~/ldap.tmp.tar.gz &&\		find $(tar -ztf "${MyBackup}") -type f \|cpio -ov --format=ustar \|gzip >~/ldap.tmp.tar.gz &&\
	mv ~/ldap.tmp.tar.gz ~/ldap.undo.tar.gz &&\		mv ~/ldap.tmp.tar.gz ~/ldap.undo.tar.gz &&\
	(find $(tar -ztf "${MyBackup}") -type f -delete		(find $(tar -ztf "${MyBackup}") -type f -delete
	tar xzvf "${MyBackup}")		tar xzvf "${MyBackup}") &&\
			cd -
	</pre>		</pre>

Tcepo at 22:47, 30 November 2016

2016-11-30T22:47:11Z

← Older revision		Revision as of 00:47, 1 December 2016
Line 44:		Line 44:
	service corosync start		service corosync start
	service pacemaker start		service pacemaker start

	=== Install ===		=== Install ===
	<pre>		<pre>
Line 175:		Line 175:
	=== Restore ===		=== Restore ===
	<pre>		<pre>
	~~# Init~~
	~~MyBackup=~/ldap.backup."$(hostname -f)"."${MyRefDate}".tar.gz~~

	~~# Action~~
	~~cd / &&\~~
	find $(tar -ztf "${MyBackup}") -type f \|cpio -ov --format=ustar \|gzip >~/ldap.tmp.tar.gz &&\		find $(tar -ztf "${MyBackup}") -type f \|cpio -ov --format=ustar \|gzip >~/ldap.tmp.tar.gz &&\
			mv ~/ldap.tmp.tar.gz ~/ldap.undo.tar.gz &&\
	(find $(tar -ztf "${MyBackup}") -type f -delete		(find $(tar -ztf "${MyBackup}") -type f -delete
	tar xzvf "${MyBackup}") ~~&&\~~		tar xzvf "${MyBackup}")
	~~cd -~~		</pre>

	# ~~Reverse!~~ = ~/ldap.~~tmp~~.tar.gz		# Undo MyBackup=~/ldap.undo.tar.gz
	~~</pre>~~

	=== Start all LDAP nodes ===		=== Start all LDAP nodes ===

Tcepo at 21:35, 30 November 2016

2016-11-30T21:35:29Z

← Older revision		Revision as of 23:35, 30 November 2016
Line 13:		Line 13:
	=== Backup ===		=== Backup ===
	<pre>		<pre>
	#~~====~~ Init ~~====~~		# Init
	MySourceList="/etc/default/slapd\n/etc/ldap/slapd.d/"		MySourceList="/etc/default/slapd\n/etc/ldap/slapd.d/"

Line 34:		Line 34:
	MyBackup=~/ldap.backup."$(hostname -f)"."${MyRefDate}".tar.gz		MyBackup=~/ldap.backup."$(hostname -f)"."${MyRefDate}".tar.gz

	#~~=== Backup ===~~		# Action
	echo -e $MySourceList \|tar czvf "${MyBackup}" -T -		echo -e $MySourceList \|tar czvf "${MyBackup}" -T -
			</pre>

	#=== Check backup ===		=== Check backup ===
	ls -l "${MyBackup}"		ls -l "${MyBackup}"
	~~</pre>~~

	=== Start LDAP ===		=== Start LDAP ===
Line 47:		Line 47:
	=== Install ===		=== Install ===
	<pre>		<pre>
	#~~====~~ Init ~~====~~		# Init
	MyFilter=$(MyPatern='^olcDatabase: (\{[0-9]+\}.db)$'		MyFilter=$(MyPatern='^olcDatabase: (\{[0-9]+\}.db)$'
	slapcat -n0 \|\		slapcat -n0 \|\
Line 114:		Line 114:
	* Enter the Ldap password		* Enter the Ldap password

	=== Stop ~~the node~~ ===		=== Stop LDAP ===
	service pacemaker stop		service pacemaker stop
	service corosync stop		service corosync stop
Line 130:		Line 130:
	=== Init test ===		=== Init test ===
	<pre>		<pre>
	#~~===~~ Init ~~===~~		# Init
	MyFilter=$(MyPatern='^olcSuffix: (dc=[^,],dc=[^,])$'		MyFilter=$(MyPatern='^olcSuffix: (dc=[^,],dc=[^,])$'
	slapcat -n0 \|\		slapcat -n0 \|\
Line 145:		Line 145:
	sed -rn "s/$MyPatern/\1/p" \|head -1) ;echo "$MyFilter"		sed -rn "s/$MyPatern/\1/p" \|head -1) ;echo "$MyFilter"
	MyUserDN="$MyFilter"		MyUserDN="$MyFilter"
	#~~===~~ Reset user password ~~===~~
			# Reset user password
	ldappasswd -D "${MyolcRootDN}" -W "${MyUserDN}" -s mypasswd		ldappasswd -D "${MyolcRootDN}" -W "${MyUserDN}" -s mypasswd
	</pre>		</pre>
Line 174:		Line 175:
	=== Restore ===		=== Restore ===
	<pre>		<pre>
	#~~====~~ Init ~~====~~		# Init
	MyBackup=~/ldap.backup."$(hostname -f)"."${MyRefDate}".tar.gz		MyBackup=~/ldap.backup."$(hostname -f)"."${MyRefDate}".tar.gz

	# ~~Last chance ... ~/ldap.tmp.tar.gz~~		# Action
	cd / &&\		cd / &&\
	find $(tar -ztf "${MyBackup}") -type f \|cpio -ov --format=ustar \|gzip >~/ldap.tmp.tar.gz &&\		find $(tar -ztf "${MyBackup}") -type f \|cpio -ov --format=ustar \|gzip >~/ldap.tmp.tar.gz &&\
Line 183:		Line 184:
	tar xzvf "${MyBackup}") &&\		tar xzvf "${MyBackup}") &&\
	cd -		cd -

			# Reverse! = ~/ldap.tmp.tar.gz
	</pre>		</pre>

Tcepo at 21:19, 30 November 2016

2016-11-30T21:19:16Z

← Older revision		Revision as of 23:19, 30 November 2016
Line 111:		Line 111:
	ldapadd -D "${MyolcRootDN}" -W -f /tmp/$$.ldif		ldapadd -D "${MyolcRootDN}" -W -f /tmp/$$.ldif
	</pre>		</pre>

			* Enter the Ldap password

	=== Stop the node ===		=== Stop the node ===
Line 124:		Line 126:
	=== Requirement ===		=== Requirement ===
	* User test		* User test
	#MyUser="<UserTest>"		MyUser="<UserTest>"
	* Have admin login and password (Keepass)

	=== Init test ===		=== Init test ===
Line 144:		Line 145:
	sed -rn "s/$MyPatern/\1/p" \|head -1) ;echo "$MyFilter"		sed -rn "s/$MyPatern/\1/p" \|head -1) ;echo "$MyFilter"
	MyUserDN="$MyFilter"		MyUserDN="$MyFilter"
			#=== Reset user password ===
			ldappasswd -D "${MyolcRootDN}" -W "${MyUserDN}" -s mypasswd
	</pre>		</pre>

	~~=== Reset user password ===~~
	~~ldappasswd -D "${MyolcRootDN}" -W "${MyUserDN}" -s mypasswd~~
	* Enter the Ldap password		* Enter the Ldap password

Line 157:		Line 158:

	== Node uninstall ==		== Node uninstall ==
	ls -lrt ~/ldap.*.gz \|tail		=== Requirement ===
			* Down time 1/2 hour
			* Backup file
			ls -lrt ~/ldap.backup.*.tar.gz \|tail

	echo "Default backup : $MyBackup"		echo "Default backup : MyBackup=$MyBackup"
	~~# Select new date~~ if necessary :		echo
	~~# MyRefDate=""~~		echo "Change if necessary"
	=== Stop ~~node~~ ===
			=== Stop all LDAP nodes ===
			* Prevent users from beginning of maintenance.
	service pacemaker stop		service pacemaker stop
	service corosync stop		service corosync stop
Line 177:		Line 183:
	tar xzvf "${MyBackup}") &&\		tar xzvf "${MyBackup}") &&\
	cd -		cd -
			</pre>

	#=== Start ~~node~~ ===		=== Start all LDAP nodes ===
	service corosync start		* Prevent users from ending of maintenance.
	service pacemaker start		service corosync start
	~~</pre>~~		service pacemaker start

	== Ref ==		== Ref ==
	# Ref : http://infocepo.com/wiki/index.php/LDAP_policies		# Ref : http://infocepo.com/wiki/index.php/LDAP_policies
	# Ref : https://www.youtube.com/watch?v=_ZvnNVwWk-M		# Ref : https://www.youtube.com/watch?v=_ZvnNVwWk-M

Tcepo at 20:57, 30 November 2016

2016-11-30T20:57:11Z

← Older revision		Revision as of 22:57, 30 November 2016
Line 1:		Line 1:
	How install LDAP password policies?		How install LDAP password policies?

	~~== Node install ==~~		== Requirement ==
	=== Requirement ===		* To have the Ldap password (Keepass!)
	* ~~Have admin login and~~ password (Keepass)		* Down time 1 hour

	=== Stop all LDAP nodes ===		== Stop all LDAP nodes ==
			* Prevent users from beginning of maintenance.
	service pacemaker stop		service pacemaker stop
	service corosync stop		service corosync stop

			== Node install ==
	=== Backup ===		=== Backup ===
	<pre>		<pre>
Line 32:		Line 34:
	MyBackup=~/ldap.backup."$(hostname -f)"."${MyRefDate}".tar.gz		MyBackup=~/ldap.backup."$(hostname -f)"."${MyRefDate}".tar.gz

	#==== Backup ====		#=== Backup ===
	echo -e $MySourceList \|tar czvf "${MyBackup}" -T -		echo -e $MySourceList \|tar czvf "${MyBackup}" -T -

			#=== Check backup ===
			ls -l "${MyBackup}"
	</pre>		</pre>

	==== Start LDAP ====		=== Start LDAP ===
	service corosync start		service corosync start
	service pacemaker start		service pacemaker start

	~~==== Check backup ====~~
	~~ls -l "${MyBackup}"~~

	=== Install ===		=== Install ===
	<pre>		<pre>
Line 95:		Line 97:
	pwdMaxAge: 7776000		pwdMaxAge: 7776000
	pwdExpireWarning: 1814400		pwdExpireWarning: 1814400
	pwdInHistory: 3		pwdInHistory: 4
	pwdCheckQuality: 1		pwdCheckQuality: 1
	pwdMinLength: 8		pwdMinLength: 8
Line 110:		Line 112:
	</pre>		</pre>

	=== ~~Restart~~ the node ===		=== Stop the node ===
	service pacemaker stop		service pacemaker stop
	service corosync ~~restart~~		service corosync stop

			== Start all LDAP nodes ==
			* Prevent users from ending of maintenance.
			service corosync start
	service pacemaker start		service pacemaker start

Line 133:		Line 139:
	sed -rn "s/$MyPatern/\1/p"\|head -1) ;echo $MyFilter		sed -rn "s/$MyPatern/\1/p"\|head -1) ;echo $MyFilter
	MyolcRootDN="$MyFilter"		MyolcRootDN="$MyFilter"
	~~</pre>~~

	MyFilter=$(MyPatern='^dn: ([^=]=[^,]'"${MyUser}"'[^,],ou=users,dc=[^,],dc=[^,]*)$'		MyFilter=$(MyPatern='^dn: ([^=]=[^,]'"${MyUser}"'[^,],ou=users,dc=[^,],dc=[^,]*)$'
Line 142:		Line 147:

	=== Reset user password ===		=== Reset user password ===
	* Take the admin password
	ldappasswd -D "${MyolcRootDN}" -W "${MyUserDN}" -s mypasswd		ldappasswd -D "${MyolcRootDN}" -W "${MyUserDN}" -s mypasswd
			* Enter the Ldap password

	=== Start checking ===		=== Start checking ===
	* Test many passwords :		* Test many passwords :
	ldappasswd -x -H ldap://localhost -D "${MyUserDN}" -w mypasswd -s mypasswdnew		ldappasswd -x -H ldap://localhost -D "${MyUserDN}" -w mypasswd -s mypasswdnew

			* Prevent users from ending of maintenance.

	== Node uninstall ==		== Node uninstall ==
Line 166:		Line 173:
	# Last chance ... ~/ldap.tmp.tar.gz		# Last chance ... ~/ldap.tmp.tar.gz
	cd / &&\		cd / &&\
	find $(tar -ztf "${MyBackup}") ~~-xdev~~ -type f \|cpio -ov --format=ustar \|gzip >~/ldap.tmp.tar.gz &&\		find $(tar -ztf "${MyBackup}") -type f \|cpio -ov --format=ustar \|gzip >~/ldap.tmp.tar.gz &&\
	(find $(tar -ztf "${MyBackup}") ~~-xdev~~ -type f -delete		(find $(tar -ztf "${MyBackup}") -type f -delete
	tar xzvf "${MyBackup}") &&\		tar xzvf "${MyBackup}") &&\
	cd -		cd -