389-ds-base

#49836 Ticket 49794 - Add pam_pwquality features to password syntax checking
Closed by spichugi. Opened by mreynolds.
mreynolds/389-ds-base ticket49794  into  master

Download 49836.patch

Description: Added the following pam_pwquality fartures to DS. We can
not add all the features because some of them require that
you have the the previous or current password in clear text.

           New features:
             - Check password is not in dictionary
             - Password is not a palindrome
             - Maximum allowed monotonic sequence characters
             - Maximum allowed monotonic sequence characters that can
               be repeated.
             - Maximum number of consectuve characters from the same
               class of characters (digits, alphas, specials, etc)
             - List of words that are not allowed to appear in the new
               password
             - List of attributes to check in the user's entry to see
               if those values are in the new password.

https://pagure.io/389-ds-base/issue/49794

Reviewed by: ?

rebased onto e487ae847ab95971512caf29e9dbe96edd67c7c2

rebased onto cc808a7b3a4bec12cf4f620a1733428026c724e4

I'll read through the C code but I'll let others check it.

Couple of issues:

  • I think, we need to add this to the spec file:

    BuildRequires:    cracklib-devel

  • the test you've added fails here - tryPassword(topology_st.standalone, 'passwordDictCheck', 'on', 'on', 'PASSWORD', '13_#Kad472h', 'Password found in dictionary')

    pwdPolicy_syntax_test.py   127 CRITICAL Failed to change password: {'desc': 'Constraint violation', 'info': 'Password failed dictionary check: \x18'}

rebased onto d9be40917af0e2b895cfd60218a207b562c9afd1

The problem is selinux is blocking the cracklib dictionary files. I opened a selinux bug

https://bugzilla.redhat.com/show_bug.cgi?id=1599726

rebased onto a6a3f79de924667016645cb22d998707d7eeb3cc

These tests fail on older versions of 389-ds-base, that don't have these attributes. Perhaps we should skip them if ds version is <=1.4.0.13.

The rest LGTM.

Is it okay that we have SYNTAX == 1.3.6.1.4.1.1466.115.121.1.15 (Directory String syntax) but the actual value is int? Should we set it accordingly?
I am not advising but asking...

Nice catch, yes several of these of should be changed to int syntax

Do we need to actually? If we don't backport this test, then it will be in sync with the source code and version checking is not needed. Thoughts?

We run tests from master on older versions. It's easier than maintaining different sets of tests in different branches for different feature sets. Here's one example: https://pagure.io/389-ds-base/blob/master/f/dirsrvtests/tests/suites/plugins/acceptance_test.py#_34

oh okay, no problem I'll get that added and rebase shortly

rebased onto 8651a1494fbcd4eb6ce8f79ae312681a441d1352

@vashirov @spichugi changes made, please review...

Thanks, ack!

rebased onto fd8ca9aaa55e3745203eacb305afd528942b552d

Pull-Request has been merged by mreynolds

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/2895

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.