LDAP policies: Difference between revisions

From Essential
Jump to navigation Jump to search
No edit summary
No edit summary
Line 2: Line 2:


== Node install ==
== Node install ==
=== Requirement ===
* Have admin login and password (Keepass)
=== Stop all LDAP nodes ===
=== Stop all LDAP nodes ===
  service pacemaker stop
  service pacemaker stop
Line 95: Line 98:
pwdCheckQuality: 1
pwdCheckQuality: 1
pwdMinLength: 8
pwdMinLength: 8
pwdMaxFailure: 4
pwdMaxFailure: 5
pwdLockout: TRUE
pwdLockout: TRUE
pwdLockoutDuration: 600
pwdLockoutDuration: 600
Line 113: Line 116:


== Test ==
== Test ==
=== Requirement ===
* User test
#MyUser="<UserTest>"
* Have admin login and password (Keepass)
=== Init test ===
<pre>
<pre>
MyUser="myuser"
#=== Init ===
#=== Init ===
MyFilter=$(MyPatern='^olcSuffix: (dc=[^,]*,dc=[^,]*)$'
MyFilter=$(MyPatern='^olcSuffix: (dc=[^,]*,dc=[^,]*)$'
Line 126: Line 133:
sed -rn "s/$MyPatern/\1/p"|head -1) ;echo $MyFilter
sed -rn "s/$MyPatern/\1/p"|head -1) ;echo $MyFilter
MyolcRootDN="$MyFilter"
MyolcRootDN="$MyFilter"
</pre>
=== Create user ===
<pre>
cat <<EOT >/tmp/$$.ldif
dn: ou=users,${MyolcSuffix}
description: My Organization users come here
objectclass: top
objectclass: organizationalUnit
ou: users
dn: uid=${MyUser},ou=users,${MyolcSuffix}
cn: ${MyUser}
sn: ${MyUser}SN
uid: ${MyUser}
ou: users
objectClass: organizationalPerson
objectClass: inetOrgPerson
EOT
ldapadd -D "${MyolcRootDN}" -W -f /tmp/$$.ldif
</pre>
</pre>


Line 152: Line 139:
sed -rn "s/$MyPatern/\1/p" |head -1) ;echo "$MyFilter"
sed -rn "s/$MyPatern/\1/p" |head -1) ;echo "$MyFilter"
MyUserDN="$MyFilter"
MyUserDN="$MyFilter"
</pre>


=== Reset user password ===
=== Reset user password ===
Line 182: Line 170:
tar xzvf "${MyBackup}") &&\
tar xzvf "${MyBackup}") &&\
cd -
cd -
#=== Start node ===
service corosync start
service pacemaker start
</pre>
</pre>
=== Start node ===
service corosync start
service pacemaker start


== Ref ==
== Ref ==
# Ref : http://infocepo.com/wiki/index.php/LDAP_policies
# Ref : http://infocepo.com/wiki/index.php/LDAP_policies
# Ref : https://www.youtube.com/watch?v=_ZvnNVwWk-M
# Ref : https://www.youtube.com/watch?v=_ZvnNVwWk-M

Revision as of 08:45, 25 November 2016

How install LDAP password policies?

Node install

Requirement

  • Have admin login and password (Keepass)

Stop all LDAP nodes

service pacemaker stop
service corosync stop

Backup

#==== Init ====
MySourceList="/etc/default/slapd\n/etc/ldap/slapd.d/"

MyFilter=$(MyPatern='^SLAPD_CONF=(\/.*)$'
cat /etc/default/slapd |\
sed -rn "s/$MyPatern/\1/p" |head -1) ;echo "$MyFilter"
[ ! -z "$MyFilter" ] &&MySourceList+="\n${MyFilter}"

MyFilter=$(MyPatern='^olcConfigDir: (\/.*)$'
slapcat -n0 |\
sed -rn "s/$MyPatern/\1/p" |head -1) ;echo "$MyFilter"
[ ! -z "$MyFilter" ] &&MySourceList+="\n${MyFilter}"

MyFilter=$(MyPatern='^olcDbDirectory: (\/.*)$'
slapcat -n0 |\
sed -rn "s/$MyPatern/\1/p" |head -1) ;echo "$MyFilter"
[ ! -z "$MyFilter" ] &&MySourceList+="\n${MyFilter}"

MyRefDate="$(date -u '+%Y-%m-%dT%H_%M_%SZ')"
MyBackup=~/ldap.backup."$(hostname -f)"."${MyRefDate}".tar.gz

#==== Backup ====
echo -e $MySourceList |tar czvf "${MyBackup}" -T -

#==== Start LDAP ====
service corosync start
service pacemaker start
 
#==== Check backup ====
ls -l "${MyBackup}"

Install

#==== Init ====
MyFilter=$(MyPatern='^olcDatabase: (\{[0-9]+\}.db)$'
slapcat -n0 |\
sed -rn "s/$MyPatern/\1/p" |head -1) ;echo "$MyFilter"
MyolcDatabase="$MyFilter"

MyFilter=$(MyPatern='^olcSuffix: (dc=[^,]*,dc=[^,]*)$'
slapcat -n0 |\
sed -rn "s/$MyPatern/\1/p" |head -1) ;echo "$MyFilter"
MyolcSuffix="$MyFilter"

MyFilter=$(MyPatern='^olcRootDN: (cn=[^,]*,dc=[^,]*,dc=[^,]*)$'
slapcat -n 0 |\
sed -rn "s/$MyPatern/\1/p"|head -1) ;echo $MyFilter
MyolcRootDN="$MyFilter"

#==== [OpenLDAP] Add schema ====
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif

#==== [OpenLDAP] Enable ====
cat <<EOT >/tmp/$$.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy

dn: olcOverlay={0}ppolicy,olcDatabase=${MyolcDatabase},cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: {0}ppolicy
olcPPolicyDefault: cn=MyOrgPPolicy,ou=Policies,${MyolcSuffix}
EOT
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f  /tmp/$$.ldif

#==== Define policies ====
cat <<EOT >/tmp/$$.ldif
dn: ou=Policies,${MyolcSuffix}
objectClass: top
objectClass: organizationalUnit
ou: Policies
description: My Organization policies come here

dn: cn=MyOrgPPolicy,ou=Policies,${MyolcSuffix}
cn: MyOrgPPolicy
objectClass: pwdPolicy
objectClass: device
objectClass: top
pwdAttribute: userPassword
pwdMaxAge: 7776000
pwdExpireWarning: 1814400
pwdInHistory: 3
pwdCheckQuality: 1
pwdMinLength: 8
pwdMaxFailure: 5
pwdLockout: TRUE
pwdLockoutDuration: 600
pwdGraceAuthNLimit: 0
pwdFailureCountInterval: 0
pwdMustChange: TRUE
pwdAllowUserChange: TRUE
pwdSafeModify: FALSE
EOT
ldapadd -D "${MyolcRootDN}" -W -f /tmp/$$.ldif

Restart the node

service pacemaker stop
service corosync restart
service pacemaker start

Test

Requirement

  • User test
#MyUser="<UserTest>"
  • Have admin login and password (Keepass)

Init test

#=== Init ===
MyFilter=$(MyPatern='^olcSuffix: (dc=[^,]*,dc=[^,]*)$'
slapcat -n0 |\
sed -rn "s/$MyPatern/\1/p" |head -1) ;echo "$MyFilter"
MyolcSuffix="$MyFilter"

MyFilter=$(MyPatern='^olcRootDN: (cn=[^,]*,dc=[^,]*,dc=[^,]*)$'
slapcat -n 0 |\
sed -rn "s/$MyPatern/\1/p"|head -1) ;echo $MyFilter
MyolcRootDN="$MyFilter"

MyFilter=$(MyPatern='^dn: ([^=]*=[^,]*'"${MyUser}"'[^,]*,ou=users,dc=[^,]*,dc=[^,]*)$' slapcat -b $MyolcSuffix |\ sed -rn "s/$MyPatern/\1/p" |head -1) ;echo "$MyFilter" MyUserDN="$MyFilter"

Reset user password

  • Take the admin password
ldappasswd -D "${MyolcRootDN}" -W "${MyUserDN}" -s mypasswd

Start checking

  • Test many passwords :
ldappasswd -x -H ldap://localhost -D "${MyUserDN}" -w mypasswd -s mypasswdnew

Node uninstall

ls -lrt ~/ldap.*.gz |tail

echo "Default backup : $MyBackup"  
# Select new date if necessary :
# MyRefDate=""

Stop node

service pacemaker stop
service corosync stop

Restore

#==== Init ====
MyBackup=~/ldap.backup."$(hostname -f)"."${MyRefDate}".tar.gz

# Last chance ... ~/ldap.tmp.tar.gz
cd / &&\
find $(tar -ztf "${MyBackup}") -xdev -type f |cpio -ov --format=ustar |gzip >~/ldap.tmp.tar.gz &&\
(find $(tar -ztf "${MyBackup}") -xdev -type f -delete
tar xzvf "${MyBackup}") &&\
cd -

#=== Start node ===
service corosync start
service pacemaker start

Ref

  1. Ref : http://infocepo.com/wiki/index.php/LDAP_policies
  2. Ref : https://www.youtube.com/watch?v=_ZvnNVwWk-M
Retrieved from "https://infocepo.com/wiki/index.php?title=LDAP_policies&oldid=695"