Arch Linux

gettons

Member

Registered: 2011-04-13

Posts: 2

problem changing ldap user password

Hi all,

I have a problem with my client workstation.
I am trying to change my ldap user password through passwd command.
When I first create the user on ldap server, I use md5 and create the user password.

This is the entry:

dn: uid=boo,ou=People,dc=linux,dc=gettolandia,dc=org
uid: boo
cn: boo
objectclass: posixAccount
objectclass: inetOrgPerson
objectclass: shadowAccount
shadowMax: 999999
shadowWarning: 7
shadowLastChange: 10877
userPassword: {MD5}IKrpa9u8/J9z3VryD0DzEQ==
loginShell: /bin/bash
uidNumber: 9001
gidNumber: 9001
homeDirectory: /home/boo
gecos: boo
displayName: boo
mail: boo@boo.boo
givenName: boo
sn: boo

I have installed all the necessary packages on my desktop client.
When I first try to change the password by doing the following I get prompted the current password and all goes well for setting up a new one.

boo@gettons-desktop:~$ passwd

But If I do that again, It does not recognize my actual password for some reasons.
Infact I get:

boo@gettons-desktop:~$ passwd 
Enter login(LDAP) password: 
LDAP Password incorrect: try again
Enter login(LDAP) password: 
Password change aborted
passwd: User not known to the underlying authentication module
passwd: password unchanged

Doing that with root user all goes well, I presume because It does not check the actual password while setting the new one up.

Interesting config files on the client:

boo@gettons-desktop:~$ cat /etc/pam.d/common-password

password        sufficient      pam_ldap.so
password        required        pam_unix.so nullok obscure min=4 max=8 md5


boo@gettons-desktop:~$ cat /etc/login.defs
...
ENCRYPT_METHOD MD5
...

Thanks in advance.

zenlord

Member

From: Belgium

Registered: 2006-05-24

Posts: 1,229

Website

Re: problem changing ldap user password

I'm not sure it works that way. The dev who setup our office network with LDAP auth, told me I had to use a program called gq to change passwords. He never told me why, but thinking about it, it could make sense:

passwd tries to login using the old passwd and if that succeeds, it changes the new passwd. But with LDAP, it has to bind using the user that your setup is configged to bind with the LDAP-server. In your case, that might be root, and root probably binds with another password than your user boo.

This might be utterly incorrect - in that case you can just install gq and use that to change passwords

premier

Member

Registered: 2006-12-07

Posts: 16

Re: problem changing ldap user password

You can use passwd to change LDAP passwords but you have to configure PAM and NSS to do that.  Look at /etc/pam_ldap.conf, /etc/nss_ldap.conf,  and /etc/openldap/ldap.conf plust /etc/nsswitch.conf

http://max.home.subnet.at/ldap

https://wiki.archlinux.org/index.php/LD … entication

gettons

Member

Registered: 2011-04-13

Posts: 2

Re: problem changing ldap user password

Hi again,

there must be a problem with the encryption method.
Basically, once I create the ldiff file with the "boo" user, when I do ldapsearch I get this password :

userPassword:: e01ENX1JS3JwYTl1OC9KOXozVnJ5RDBEekVRPT0=
which is md5
python -c "import base64; print base64.b64decode('e01ENX1JS3JwYTl1OC9KOXozVnJ5RDBEekVRPT0=')"
{MD5}IKrpa9u8/J9z3VryD0DzEQ==

When I do passwd ( the first time I do it's fine, it's the second time I run passwd to change the passwd again ,that passwd won't recognize the password I have just changed ) it works fine

boo@gettons-desktop:~$ passwd 
Enter login(LDAP) password: 
New password: 
Re-enter new password: 
LDAP password information changed for boo
passwd: password updated successfully

and I can test this by logging out / in on the tty/pts

Now, if I look at the password:

userPassword:: e2NyeXB0fSQxJDlQT2pTRmw0JENUTU1yR0g5UDBCa1ppSHQyLzVoUi4=
which has a different encryption now:
python -c "import base64; print base64.b64decode('e2NyeXB0fSQxJDlQT2pTRmw0JENUTU1yR0g5UDBCa1ppSHQyLzVoUi4=')"
{crypt}$1$9POjSFl4$CTMMrGH9P0BkZiHt2/5hR.

Then when I run passwd again and I get prompted for the *actual* password, it won't recognize it.

boo@gettons-desktop:~$ passwd 
Enter login(LDAP) password: 
LDAP Password incorrect: try again
Enter login(LDAP) password: 
LDAP Password incorrect: try again
Enter login(LDAP) password: 
LDAP Password incorrect: try again
passwd: User not known to the underlying authentication module
passwd: password unchanged

Also, I am using slapd on openwrt , which is a flavour of linux running on routers. I know it's not compiled like the others are on distro like redhat, centos, ubuntu ...
ie it does not have ssl, debugging or so, so it might be because it's missing something.

I think the proble is here:

If I put this in slapd.conf
password-hash   {CRYPT}     

I get this:

root@openget:~# slapd -T test
slaptest: bad configuration file!

premier

Member

Registered: 2006-12-07

Posts: 16

Re: problem changing ldap user password

I had some similar problems getting the passwords working initially. Using 'pam_password exop' in /etc/pam_ldap.conf on each client solved the problem.  'exop' causes the password to be hashed on the server (and not by PAM) and removing interoperability problems due to client configuration issues.  If your using PAM to update the passwords, then it has to be configured for each client and they will all have to be compatible.

Note: /etc/login.defs doesn't apply if your using PAM.

The openldap in openwrt is severly crippled so it may be a culprit also.  I started with openwrt but gave up to get TLS.  I don't think I would have got it working without debug which shows the LDAP queries that were being made.