FeministWiki:LDAP Schema - Revision history

Technician: /* Tips on the usage of ldap commands */

2025-02-06T11:50:23Z

Tips on the usage of ldap commands

← Older revision		Revision as of 11:50, 6 February 2025
Line 45:		Line 45:
	For configuration, use {{C\|-Y external -H ldapi://}} to connect directly with root permissions, so no actual LDAP domain login is needed.		For configuration, use {{C\|-Y external -H ldapi://}} to connect directly with root permissions, so no actual LDAP domain login is needed.

	For data, use {{C\|-xy ~/pwd/ldap}} to use the LDAP domain admin password. The file {{C\|~/.ldaprc}} should contain ~~{{C\|BINDDN cn=admin,dc=feministwiki~~,~~dc=org}}~~ so you don't have to specify the domain admin explicitly every time.		For data, use {{C\|-xy ~/pwd/ldap}} to use the LDAP domain admin password. The file {{C\|~/.ldaprc}} should contain the following, so you don't have to specify the domain admin explicitly every time:

			BINDDN cn=admin,dc=feministwiki,dc=org

	=== Read-only user ===		=== Read-only user ===

Technician at 22:49, 11 January 2024

2024-01-11T22:49:06Z

← Older revision		Revision as of 22:49, 11 January 2024
Line 38:		Line 38:
	* The <code>fwRecoveryMail</code> field may hold a mail address that will be used for password reset requests. It's different from the primary mail address because that one may be the member's FeministWiki address, which they can't access if they've lost their password.		* The <code>fwRecoveryMail</code> field may hold a mail address that will be used for password reset requests. It's different from the primary mail address because that one may be the member's FeministWiki address, which they can't access if they've lost their password.
	* The <code>manager</code> contains the DN (distinguished name) of the member who added the member. It may be empty for special member accounts like "Administrator" or the "Deleted" pseudo-account.		* The <code>manager</code> contains the DN (distinguished name) of the member who added the member. It may be empty for special member accounts like "Administrator" or the "Deleted" pseudo-account.

			=== Tips on the usage of ldap commands ===

			Commands such as ldapsearch, ldapmodify, etc. require authentication. The correct method depends on whether you want to interact with the configuration database found in {{C\|/etc/ldap/slapd.d}}, or the actual data database found in {{C\|/var/lib/ldap}}.

			For configuration, use {{C\|-Y external -H ldapi://}} to connect directly with root permissions, so no actual LDAP domain login is needed.

			For data, use {{C\|-xy ~/pwd/ldap}} to use the LDAP domain admin password. The file {{C\|~/.ldaprc}} should contain {{C\|BINDDN cn=admin,dc=feministwiki,dc=org}} so you don't have to specify the domain admin explicitly every time.

	=== Read-only user ===		=== Read-only user ===

Technician: /* Password policy */

2024-01-11T22:08:15Z

Password policy

← Older revision		Revision as of 22:08, 11 January 2024
Line 103:		Line 103:
	In short, the steps go as follows (these commands ''should'' work verbatim):		In short, the steps go as follows (these commands ''should'' work verbatim):

	# ~~Add~~ the ppolicy schema		# Only needed on old versions of slapd, to add the ppolicy schema
	ldapadd -Y external -H ldapi:// < /etc/ldap/schema/ppolicy.ldif		#ldapadd -Y external -H ldapi:// < /etc/ldap/schema/ppolicy.ldif

	# Enable the ppolicy dynamic module		# Enable the ppolicy dynamic module

Technician: /* Read-only user */

2023-02-22T19:02:53Z

Read-only user

← Older revision		Revision as of 19:02, 22 February 2023
Line 50:		Line 50:
	cn: readonly		cn: readonly
	description: Read-only user		description: Read-only user
			userPassword: $(cat ~/pwd/ldap-readonly)
	EOF		EOF

Technician: /* Password policy */

2020-04-02T21:35:30Z

Password policy

← Older revision		Revision as of 21:35, 2 April 2020
Line 140:		Line 140:
	pwdLockoutDuration: 3600		pwdLockoutDuration: 3600
	pwdMaxFailure: 10		pwdMaxFailure: 10
			pwdFailureCountInterval: 3600
	EOF		EOF

Line 150:		Line 151:
	EOF		EOF

	With these settings, ~~five~~ consecutive authentication failures with a username will lock the account for an hour.		With these settings, ten consecutive authentication failures with a username will lock the account for an hour. Login failures are also cleared after an hour. This means it's possible to try ten passwords per hour during a brute-force attack, which won't get the attacker very far.

	=== Time of last login ===		=== Time of last login ===

Technician: /* Password policy */

2020-03-07T23:59:41Z

Password policy

← Older revision		Revision as of 23:59, 7 March 2020
Line 139:		Line 139:
	pwdLockout: TRUE		pwdLockout: TRUE
	pwdLockoutDuration: 3600		pwdLockoutDuration: 3600
	pwdMaxFailure: 5		pwdMaxFailure: 10
	EOF		EOF

Technician at 22:19, 29 February 2020

2020-02-29T22:19:33Z

← Older revision		Revision as of 22:19, 29 February 2020
Line 43:		Line 43:
	For security purposes, it's a good idea to have a "read-only" user for LDAP read operations, instead of using the admin for everything.		For security purposes, it's a good idea to have a "read-only" user for LDAP read operations, instead of using the admin for everything.

	# ~~Addition to be made via '~~ldapadd'		# Add read-only user
			ldapadd -xy ~/pwd/ldap <<EOF
	dn: cn=readonly,dc=feministwiki,dc=org		dn: cn=readonly,dc=feministwiki,dc=org
	objectClass: simpleSecurityObject		objectClass: simpleSecurityObject
Line 49:		Line 50:
	cn: readonly		cn: readonly
	description: Read-only user		description: Read-only user
			EOF

	No fiddling with access control is needed, since read-only access is the default.		No fiddling with access control is needed, since read-only access is the default.
Line 54:		Line 56:
	=== Custom objectClass ===		=== Custom objectClass ===

	The following ~~LDIF statement may be passed to <code>ldapadd</code> to create~~ the <code>fwMember</code> object class.		The following command creates the <code>fwMember</code> object class.

	~~# Addition to be made via '~~ldapadd'		ldapadd -Y external -H ldapi:// <<EOF
	dn: cn=feministwiki,cn=schema,cn=config		dn: cn=feministwiki,cn=schema,cn=config
	objectClass: olcSchemaConfig		objectClass: olcSchemaConfig
Line 71:		Line 73:
	STRUCTURAL		STRUCTURAL
	MAY ( fwRecoveryMail ) )		MAY ( fwRecoveryMail ) )
			EOF

	=== Attribute permissions ===		=== Attribute permissions ===
Line 80:		Line 83:
	* Members should not be able to see who a member was added by (the <code>manager</code> field).		* Members should not be able to see who a member was added by (the <code>manager</code> field).

	The following ~~LDIF statement may be passed to 'ldapmodify' to make~~ the necessary access control changes:		The following command makes the necessary access control changes:

	~~# Modification to be made via '~~ldapmodify'		ldapmodify -Y external -H ldapi:// <<EOF
	dn: olcDatabase={1}mdb,cn=config		dn: olcDatabase={1}mdb,cn=config
	changetype: modify		changetype: modify
Line 89:		Line 92:
	olcAccess: {3}to attrs=fwRecoveryMail by self write by dn.exact="cn=readonly,dc=feministwiki,dc=org" search		olcAccess: {3}to attrs=fwRecoveryMail by self write by dn.exact="cn=readonly,dc=feministwiki,dc=org" search
	olcAccess: {4}to attrs=manager by self read		olcAccess: {4}to attrs=manager by self read
	-		EOF

	Note that <code>olcAccess</code> entries are evaluated in order, and the first match takes effect. This can affect performance. In the statement above, we start inserting entries from index 2, because indexes 0 and 1 already have some meaningful default entries.		Note that <code>olcAccess</code> entries are evaluated in order, and the first match takes effect. This can affect performance. In the statement above, we start inserting entries from index 2, because indexes 0 and 1 already have some meaningful default entries.
Line 153:		Line 156:
	The <code>lastbind</code> module of OpenLDAP keeps track of when a user last logged in.		The <code>lastbind</code> module of OpenLDAP keeps track of when a user last logged in.

	Load the module:		# Load the module
			ldapmodify -Y external -H ldapi:// <<EOF
	~~# Modification to be made via '~~ldapmodify'
	dn: cn=module{0},cn=config		dn: cn=module{0},cn=config
	changetype: modify		changetype: modify
	add: olcModuleLoad		add: olcModuleLoad
	olcModuleLoad: lastbind		olcModuleLoad: lastbind
			EOF

	~~And enable~~ the overlay:		# Enable the overlay
			ldapadd -Y external -H ldapi:// <<EOF
	~~# Addition to be made via '~~ldapadd'
	dn: olcOverlay=lastbind,olcDatabase={1}mdb,cn=config		dn: olcOverlay=lastbind,olcDatabase={1}mdb,cn=config
	objectClass: olcLastBindConfig		objectClass: olcLastBindConfig
	olcOverlay: lastbind		olcOverlay: lastbind
	olcLastBindPrecision: 60		olcLastBindPrecision: 60
			EOF

Technician: /* Password policy */

2020-02-05T21:03:54Z

Password policy

← Older revision		Revision as of 21:03, 5 February 2020
Line 135:		Line 135:
	pwdAttribute: userPassword		pwdAttribute: userPassword
	pwdLockout: TRUE		pwdLockout: TRUE
	pwdLockoutDuration: ~~36000~~		pwdLockoutDuration: 3600
	pwdMaxFailure: 10		pwdMaxFailure: 5
	EOF		EOF

Line 147:		Line 147:
	EOF		EOF

	With these settings, ~~ten~~ consecutive authentication failures with a username will lock the account for ~~ten hours~~.		With these settings, five consecutive authentication failures with a username will lock the account for an hour.

	=== Time of last login ===		=== Time of last login ===

Technician: /* Password hashing */

2020-02-02T22:16:13Z

Password hashing

@@ Line 93: / Line 93: @@
 Note that <code>olcAccess</code> entries are evaluated in order, and the first match takes effect.  This can affect performance.  In the statement above, we start inserting entries from index 2, because indexes 0 and 1 already have some meaningful default entries.
-=== Password hashing ===
+=== Password policy ===
 To make sure passwords are stored with the <code>{SSHA}</code> scheme rather than plain text, the <code>ppolicy</code> "password policy overlay" is used.  ZYTRAX has a very nice book about LDAP which documents how to enable this: http://www.zytrax.com/books/ldap/ch6/ppolicy.html
@@ Line 117: / Line 117: @@
   olcPPolicyHashCleartext: TRUE
   EOF
 === Time of last login ===

Technician: /* Custom objectClass */

2019-12-24T18:47:25Z

Custom objectClass

← Older revision		Revision as of 18:47, 24 December 2019
Line 54:		Line 54:
	=== Custom objectClass ===		=== Custom objectClass ===

	The following LDIF statement may be passed to 'ldapadd' to create the <code>fwMember</code> object class.		The following LDIF statement may be passed to <code>ldapadd</code> to create the <code>fwMember</code> object class.

	# Addition to be made via 'ldapadd'		# Addition to be made via 'ldapadd'