Hey, On 05/28/2012 10:25 PM, Tim Watts wrote: > 1) Rig OpenLDAP so all password changes get sent to the kerberos > server but do not use it for authentication. In the meantime we will > continue authenticate with the SSHA1 hashes in the user's LDAP > entry. The usual way to do this on most *nix systems is to actually 'rig' the PAM. In debian for example you setup your /etc/pam.d/common-password to contain something like: password sufficient pam_krb5.so ignore_root password required pam_unix.so nullok obscure min=4 max=8 sha256 use_first_pass this sets up most of your tools to use the right modules when changing the password, e.g. 'passwd'.

I do not know if you could do something like 'referring' a password change request from the OpenLDAP server to the kerberos server but since this would be an invitation von mitm attacks I doubt it.

> 2) After some time (months) when everyone has eventually done a > password change, the Kerberos server will be well enough in sync. Now > I would like to switch OpenLDAP to using kerberos on the backend (ie > for binds etc) and I will purge the SSHA1 hashes. We successfully auth against kerberos with our LDAP, you might be interested in reading the SASL section of man slapd-config. Make sure you ahve compiled your OpenLDAP with SASL support and have successfully kerberized your server.

happy configuration party :)

On 29/05/12 00:00, Bernd May wrote: > Hey, > > On 05/28/2012 10:25 PM, Tim Watts wrote: >> 1) Rig OpenLDAP so all password changes get sent to the kerberos >> server but do not use it for authentication. In the meantime we will >> continue authenticate with the SSHA1 hashes in the user's LDAP >> entry. > The usual way to do this on most *nix systems is to actually 'rig' the > PAM. In debian for example you setup your /etc/pam.d/common-password to > contain something like: > > password sufficient pam_krb5.so ignore_root > password required pam_unix.so nullok obscure min=4 max=8 sha256 > use_first_pass > > this sets up most of your tools to use the right modules when changing > the password, e.g. 'passwd'. Hi Brend, Thanks for the reply. Unfortunately there's a problem with that - the user would need their old kerberos password before they could initiate a change and in this case, their old kerberos password is unknown because Kerberos has only just existed. > I do not know if you could do something like 'referring' a password > change request from the OpenLDAP server to the kerberos server but since > this would be an invitation von mitm attacks I doubt it. It will be a bit of a pity in this case if it's not possible :( When using password hashes in the user entry, does slapd receive the plaintext password or does the client generate the hash? If slapd does not have a mechanism specifically for forcing (priming) kerberos servers, does it have a password change hook? Otherwise, I am going to have to provide a special password change service somewhere - probably web based or something. Or crack all the LANMan hashes I found in the original LDAP server! (Just joking).

On 29/05/12 08:18, Christian Manal wrote: > Hi, > > what Kerberos implementation are you using? If it's Heimdal and if it > uses your OpenLDAP server as its storage backend, you can use the > smbk5pwd overlay to set the Kerberos password along with a regular > password change. > > If your distro doesn't ship it with OpenLDAP or as a seperate package, > you can build it from source. It's in the tarball under > > contrib/slapd-modules/smbk5pwd/ > Hi Christian, I'm going to use MIT kerberos as that is what I am used to and I trust it and my abilities to fix it :) But what you've said about smbk5pwd is interesting. So Overlays are the plug-ins that can hook into parts of the process, including a password change? That is very useful knowledge - I can have a hunt for some others if smbk5pwd does not support MIT password changes - and I am aware that beyond ticket granting the wire protocols do differ. If I'm desperate enough, I feel reasonably confident I could copy and modify that overlay - even if it is just to fork/exec to kadmind. Many thanks for your time - very useful stuff! All the best, Tim

There's a SLAPI plugin for 389 DS which supports MIT Kerberos. A C programmer might be able to adapt this as an OpenLDAP overlay (similar to OpenLDAP's slapo-smbk5pwd).

Tim Watts wrote: > http://www.opinsys.fi/en/smbkrb5pwd-password-syncing-for-openldap-mit-ker... > (Line wrap warning) - some nice person has already done the job for MIT > Kerberos :->>> The system described above is a bit fragile. Because if one of the systems fail the password might only be changed in LDAP or Kerberos.

> On the face of it - that looks absolutely perfect! Hmm... A better approach is taken in the FreeIPA project: There's a SLAPI plugin for 389 DS which supports MIT Kerberos. A C programmer might be able to adapt this as an OpenLDAP overlay (similar to OpenLDAP's slapo-smbk5pwd). Ciao, Michael.