freeipa

Clone
Source Code
GIT

#6964 IPA password policy has no password difference checking
Closed: fixed 3 years ago by rcritten. Opened 6 years ago by pvoborni.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1442413

Description of problem:

There's no way to configure IPA's password policy to required a new password to
be sufficiently different from the old one.

By next year, this will make IPA unusable on all Redhat systems that need to
meet U.S. DoD hardening requirements.

Version-Release number of selected component (if applicable):


How reproducible:
always

Steps to Reproduce:
1. try to configure password policy to check for difference
2.
3.

Actual results:
Can't configure

Expected results:
Can configure IPA password policy to have at least identical functionality to
the PAM difok option.

Additional info:

A workaround is to somehow disable the web interface, and uninstall IPA CLI
tools from all systems. Then users have to go through PAM to change their
passwords. However, I'm not sure if this will apply to kinit.

A complicated workaround is to launch a program when a user logs in that tries
to match the hash of the previous password by generating permutations of the
current one. This would either have to be run at every login, or every few
logins, and would require the ability to retrieve the password history from the
IPA server. Yes, this is a terrible workaround.

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1442413
6 years ago

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1442413
6 years ago

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.7
6 years ago

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)
5 years ago

FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone

master:

  • 41021c2 Add LDAP schema for new libpwquality attributes
  • 6b452e5 Extend IPA pwquality plugin to include libpwquality support
  • c03b486 Add new pwpolicy objectclass to test_xmprpc/objectclasses.py
  • 3fc2eda Require libpwolicy and configure it in the build system
  • c4cca53 Extend password policy to evaluate passwords using libpwpolicy
  • 46d0096 Add a unit test for libpwquality-based password policy
  • 6da070e Pass the user to the password policy check in the kdb driver
  • be2efc1 Add a raiseonerr option to ldappasswd_user_change
  • fe44835 ipatests: add test for password policies
  • 68aa7c0 Add SELinux policy so kadmind can read the crackdb dictionary
  • f602da4 Requirements and design for libpwquality integration
  • 5155280 ipatests: Add test_pwpolicy to nightly runs

ipa-4-8:

  • 04c34dc Add LDAP schema for new libpwquality attributes
  • e8232dd Extend IPA pwquality plugin to include libpwquality support
  • 4dcb8d9 Add new pwpolicy objectclass to test_xmprpc/objectclasses.py
  • 734afe3 Require libpwolicy and configure it in the build system
  • 43cdcad Extend password policy to evaluate passwords using libpwpolicy
  • cba86e8 Add a unit test for libpwquality-based password policy
  • d6a8fc2 Pass the user to the password policy check in the kdb driver
  • 676979e Add a raiseonerr option to ldappasswd_user_change
  • 9627ac4 ipatests: add test for password policies
  • 60768b7 Add SELinux policy so kadmind can read the crackdb dictionary
  • 48801cb ipatests: Add test_pwpolicy to nightly runs

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
3 years ago

master:

  • 26b9a69 Wrap libpwquality PKG_CHECK_MODULES in ENABLE_SERVER test

ipa-4-8:

  • 3e51d44 Wrap libpwquality PKG_CHECK_MODULES in ENABLE_SERVER test

Login to comment on this ticket.

Metadata
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
https://bugzilla.redhat.com/show_bug.cgi?id=1442413
None
None
None
Powered by Pagure 5.13.3
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.