I have successfully configured ppolicy on a test server and everything works as it should; except one small detail that isn’t strictly necessary, but very useful to monitor the “state of affairs”.

The slapd log doesn’t seem to include any information to indicate that an account has just been locked due to password policies. This information would be very useful for automatic log monitoring, because a high number of accounts being locked in a short period of time could indicate some kind of problem or attack against our systems via some supposedly secure client. The only thing I use password policies for is locking down accounts temporarily after repeated authentication failures. The LDAP catalogue isn’t the place where passwords are actually set or changed.

I’ve tried configuring the auditlog overlay, imagining it would log the locking of an account somehow, but I haven’t actually been able to make it work. There are no errors in the slapd log when loading the module, but the auditlog log file is always empty, even after running ldapmodify on a “cn” attribute for a random person.

Snippets from the slapd.conf (for testing purposes I’ve enabled and disabled ppolicy_use_lockout to see if it also had an effect in the logs, but nothing):

[…]

loglevel        stats config cons

[…]

database        bdb

[…]

overlay auditlog

auditlog /var/log/slapd_audit.log

overlay ppolicy

ppolicy_default "cn=default,ou=policies,dc=uit,dc=no"

ppolicy_use_lockout

[…]

This server is a test server, the production servers are slaves in a master–slave configuration using syncrepl. The server version is 2.4.23. Getting auditlog to work is not a priority, what I really want is to be able to monitor locking of accounts.

Does anybody have ideas around these issues? Maybe a new approach?

Regards,

Remi Mikalsen