FeministWiki:LDAP Schema: Difference between revisions

(4 intermediate revisions by the same user not shown)

Line 38:

* The <code>fwRecoveryMail</code> field may hold a mail address that will be used for password reset requests. It's different from the primary mail address because that one may be the member's FeministWiki address, which they can't access if they've lost their password.

* The <code>manager</code> contains the DN (distinguished name) of the member who added the member. It may be empty for special member accounts like "Administrator" or the "Deleted" pseudo-account.

=== Tips on the usage of ldap commands ===

Commands such as ldapsearch, ldapmodify, etc. require authentication. The correct method depends on whether you want to interact with the configuration database found in {{C|/etc/ldap/slapd.d}}, or the actual data database found in {{C|/var/lib/ldap}}.

For configuration, use {{C|-Y external -H ldapi://}} to connect directly with root permissions, so no actual LDAP domain login is needed.

For data, use {{C|-xy ~/pwd/ldap}} to use the LDAP domain admin password. The file {{C|~/.ldaprc}} should contain the following, so you don't have to specify the domain admin explicitly every time:

BINDDN cn=admin,dc=feministwiki,dc=org

=== Read-only user ===

Line 50:

Line 60:

cn: readonly

description: Read-only user

userPassword: $(cat ~/pwd/ldap-readonly)

EOF

Line 102:

Line 113:

In short, the steps go as follows (these commands ''should'' work verbatim):

# ~~Add~~ the ppolicy schema

# Only needed on old versions of slapd, to add the ppolicy schema

ldapadd -Y external -H ldapi:// < /etc/ldap/schema/ppolicy.ldif

#ldapadd -Y external -H ldapi:// < /etc/ldap/schema/ppolicy.ldif

# Enable the ppolicy dynamic module

Line 138:

Line 149:

pwdAttribute: userPassword

pwdLockout: TRUE

pwdFailureCountInterval: 3600

pwdLockoutDuration: 3600

pwdMaxFailure: 10

pwdMaxFailure: 30

~~pwdFailureCountInterval: 3600~~

EOF

Line 151:

Line 162:

EOF

With these settings, ~~ten~~ consecutive authentication failures with a username will lock the account for an hour. Login failures are also cleared after an hour~~. This means~~ it's possible to try ~~ten~~ passwords per hour ~~during a brute-force attack~~, which won't get ~~the~~ attacker ~~very~~ far.

With these settings, 30 consecutive authentication failures with a username will lock the account for an hour. Login failures are also cleared after an hour, meaning it's possible to try 30 passwords per hour, which won't get an attacker far.

=== Time of last login ===

@@ Line 38: / Line 38: @@
 * The <code>fwRecoveryMail</code> field may hold a mail address that will be used for password reset requests.  It's different from the primary mail address because that one may be the member's FeministWiki address, which they can't access if they've lost their password.
 * The <code>manager</code> contains the DN (distinguished name) of the member who added the member.  It may be empty for special member accounts like "Administrator" or the "Deleted" pseudo-account.
+=== Tips on the usage of ldap commands ===
+Commands such as ldapsearch, ldapmodify, etc. require authentication.  The correct method depends on whether you want to interact with the configuration database found in {{C|/etc/ldap/slapd.d}}, or the actual data database found in {{C|/var/lib/ldap}}.
+For configuration, use {{C|-Y external -H ldapi://}} to connect directly with root permissions, so no actual LDAP domain login is needed.
+For data, use {{C|-xy ~/pwd/ldap}} to use the LDAP domain admin password.  The file {{C|~/.ldaprc}} should contain the following, so you don't have to specify the domain admin explicitly every time:
+ BINDDN cn=admin,dc=feministwiki,dc=org
 === Read-only user ===
@@ Line 50: / Line 60: @@
   cn: readonly
   description: Read-only user
+ userPassword: $(cat ~/pwd/ldap-readonly)
   EOF
@@ Line 102: / Line 113: @@
 In short, the steps go as follows (these commands ''should'' work verbatim):
-  # Add the ppolicy schema
+  # Only needed on old versions of slapd, to add the ppolicy schema
-  ldapadd -Y external -H ldapi:// < /etc/ldap/schema/ppolicy.ldif
+  #ldapadd -Y external -H ldapi:// < /etc/ldap/schema/ppolicy.ldif
   # Enable the ppolicy dynamic module
@@ Line 138: / Line 149: @@
   pwdAttribute: userPassword
   pwdLockout: TRUE
+ pwdFailureCountInterval: 3600
   pwdLockoutDuration: 3600
-  pwdMaxFailure: 10
+  pwdMaxFailure: 30
- pwdFailureCountInterval: 3600
   EOF
@@ Line 151: / Line 162: @@
   EOF
-With these settings, ten consecutive authentication failures with a username will lock the account for an hour.  Login failures are also cleared after an hour.  This means it's possible to try ten passwords per hour during a brute-force attack, which won't get the attacker very far.
+With these settings, 30 consecutive authentication failures with a username will lock the account for an hour.  Login failures are also cleared after an hour, meaning it's possible to try 30 passwords per hour, which won't get an attacker far.
 === Time of last login ===