Thanks for the explanation that really helped, I didn't know about the '+'and was able to see some ppolicy operational attributes on my uid. I read the slapo-ppolicy manual page and that also helped clarified a few things. You stated user's being able to change their own password depended on access rights. These are the access rights I have in my database. Are these correct to allow user's to change their password:

=================================================== root@baneling:~# ldapsearch -Y EXTERNAL -H ldapi:/// -b olcDatabase={1}hdb,cn=config olcAccess SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <olcDatabase={1}hdb,cn=config> with scope subtree # filter: (objectclass=*) # requesting: olcAccess #

# {1}hdb, config dn: olcDatabase={1}hdb,cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=harmonywave,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=harmonywave,dc=com" write by * read

# {0}ppolicy, {1}hdb, config dn: olcOverlay={0}ppolicy,olcDatabase={1}hdb,cn=config

# search result search: 2 result: 0 Success

# numResponses: 3 # numEntries: 2 ===================================================

I've been fiddling with my setup to see if I can't get it to work. I read that you need to tell PAM on the client server to do a lookup for password policies using 'pam_lookup_policy yes' in the /etc/pam_ldap.conf file. I was using libpam-ldapd instead of libpam-ldap which doesn't use the pam_ldap.conf file for its configuration (I shares its config file with libnss-ldapd which is the /etc/nslcd.conf file). I uninstalled libpam-ldapd and installed libpam-ldap instead, adjusted the config file, and I appears to be getting a little further. Now when I try to change my password on a client server I get the following:

=================================================== jschaeffer@defiler:~$ passwd Enter login(LDAP) password: New password: Re-enter new password: LDAP password information update failed: Insufficient access Must supply old password to be changed as well as new one passwd: Permission denied passwd: password unchanged ===================================================

I'm not sure why it wouldn't recognized that I did enter my previous password before I attempted to change it.

-Joshua

On 01/20/2014 12:53 AM, Dieter Klünter wrote:

Am Sun, 19 Jan 2014 14:18:56 -0700 schrieb Joshua Schaeffer jschaeffer0922@gmail.com:

...

I'm trying implement the password policy overlay into my openldap setup, I'm running a Debian 7 server and installed openldap with the package manager.

=================================================== root@baneling:~# dpkg -l | grep slapd ii slapd 2.4.31-1+nmu2 amd64 OpenLDAP server (slapd) ===================================================

I currently have my ldap server setup for authentication and authorization, I'm using libnss-ldapd and libpam-ldapd on my other machines to search the ldap directory and would like to implement the password policy provided by the overlay. I believe I've added the schema, loaded thedynamic module, and added the overlay to my databasecorrectly, however I'm not sure it's actually working. I've been mostly followingthis article and the openldap documentation:

http://www.zytrax.com/books/ldap/ch6/ppolicy.html http://www.openldap.org/doc/admin24/overlays.html#Password Policies http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies

Here is my slapd.d config (shortened for brevity):

root@baneling:~# slapcat -b cn=config [...] dn: cn=module{1},cn=config objectClass: olcModuleList cn: module{1} structuralObjectClass: olcModuleList entryUUID: ad917d22-1583-1033-9e53-473d795f568b creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140119183138Z olcModuleLoad: {0}ppolicy.so olcModulePath: /usr/lib/ldap entryCSN: 20140119183433.154615Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20140119183433Z [...] dn: cn={4}ppolicy,cn=schema,cn=config objectClass: olcSchemaConfig cn: {4}ppolicy [...] dn: olcOverlay={0}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyDefault: cn=default,ou=Policies,dc=harmonywave,dc=com olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: TRUE structuralObjectClass: olcPPolicyConfig entryUUID: 3c8dc8ce-158d-1033-9e57-473d795f568b creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140119194003Z entryCSN: 20140119194003.774030Z#000000#00'+' . I read0#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20140119194003Z ===================================================

And my container for the default policy:

root@baneling:~# ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b ou=Policies,dc=harmonywave,dc=com SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: ou=Policies,dc=harmonywave,dc=com ou: Policies objectClass: top objectClass: organizationalUnit

dn: cn=default,ou=Policies,dc=harmonywave,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdExpireWarning: 432000 pwdFailureCountInterval: 1800 pwdGraceAuthNLimit: 10 pwdInHistory: 10 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxAge: 7776000 pwdMaxFailure: 6 pwdMinAge: 86400 pwdMinLength: 10 pwdMustChange: FALSE pwdSafeModify: TRUE sn: passwdpolicy ===================================================

However, I'm not sure the policy is actually being applied. I thought it might be because I originally created my user before adding the schema and overlay, so I deleted the user and recreated it. I'm able to log into a server using my uid, however if I try to change my password I get the following:

=================================================== jschaeffer@defiler:~$ passwd (current) LDAP Password: New password: Retype new password: password change failed: Constraint violation passwd: Authentication token manipulation error passwd: password unchanged ===================================================

I've been entering mycurrent password correctly when it asks and I am using a complex new password. I also don't see any of the ppolicy attributes on my user (pwdChangeTime, pwdFailureTime, pwdGraceUseTime, etc):

=================================================== root@baneling:~# ldapsearch -LLL -x -D cn=admin,dc=harmonywave,dc=com -W -H ldapi:/// -b uid=jschaeffer,ou=People,dc=harmonywave,dc=com Enter LDAP Password: dn: uid=jschaeffer,ou=People,dc=harmonywave,dc=com objectClass: top objectClass: account objectClass: posixAccount uid: jschaeffer cn: Joshua Schaeffer uidNumber: 3000 gidNumber: 3000 homeDirectory: /home/jschaeffer loginShell: /bin/bash gecos: Joshua Schaeffer userPassword:: .... ===================================================

I've been searching around for on the web for answers to the passwd issue, but I've not been able to find anything useful. Does anyone know how to verify that the ppolicy overlay is actually working?

rootdn must change user passwords, but this depends on access rules. ppolicy attributes are operational, thus apply a '+' to the search string, according to RFC-3673. You may obtain further information on ppolicy by reading slapo-ppolicy(5).

-Dieter