From owner-freebsd-doc@FreeBSD.ORG Fri Mar 20 05:30:02 2009 Return-Path: Delivered-To: freebsd-doc@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 07B0B106566C for ; Fri, 20 Mar 2009 05:30:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id DA8AF8FC1A for ; Fri, 20 Mar 2009 05:30:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n2K5U12h021469 for ; Fri, 20 Mar 2009 05:30:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n2K5U1Xp021468; Fri, 20 Mar 2009 05:30:01 GMT (envelope-from gnats) Resent-Date: Fri, 20 Mar 2009 05:30:01 GMT Resent-Message-Id: <200903200530.n2K5U1Xp021468@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-doc@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Toby Burress Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A3420106564A for ; Fri, 20 Mar 2009 05:27:24 +0000 (UTC) (envelope-from kurin@delete.org) Received: from lithium.delete.org (lithium.delete.org [198.177.254.210]) by mx1.freebsd.org (Postfix) with ESMTP id 690818FC16 for ; Fri, 20 Mar 2009 05:27:24 +0000 (UTC) (envelope-from kurin@delete.org) Received: by lithium.delete.org (Postfix, from userid 1028) id C1F197E83F; Fri, 20 Mar 2009 01:10:02 -0400 (EDT) Message-Id: <20090320051002.C1F197E83F@lithium.delete.org> Date: Fri, 20 Mar 2009 01:10:02 -0400 (EDT) From: Toby Burress To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: docs/132839: Fix example script in ldap-auth X-BeenThere: freebsd-doc@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Toby Burress List-Id: Documentation project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Mar 2009 05:30:02 -0000 >Number: 132839 >Category: docs >Synopsis: Fix example script in ldap-auth >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-doc >State: open >Quarter: >Keywords: >Date-Required: >Class: maintainer-update >Submitter-Id: current-users >Arrival-Date: Fri Mar 20 05:30:01 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Toby Burress >Release: FreeBSD 6.3-RELEASE-p2 amd64 >Organization: >Environment: System: FreeBSD lithium.delete.org 6.3-RELEASE-p2 FreeBSD 6.3-RELEASE-p2 #2: Sun May 4 03:12:43 EDT 2008 root@lithium.delete.org:/usr/obj/usr/src/sys/LITHIUMv3 amd64 >Description: This article (it turns out) has a few errors, two of which are fixed in this patch. (a) some object classes given in the examples are implicit as they are the parents of other object classes explicitly named, and it is apparently gouche to include them. Specifically "top", maybe others. (b) the Ruby script that was here before used an LDAP Modify operation to change a user's password. This is not the Done Thing for a number of reasons which interested parties can read about in RFC 3062. It turns out the entire ruby-ldap library is not very well maintained and does not support the proper operation. The example has been replaced with a Python script that implements the proper procedure. see http://lists.freebsd.org/pipermail/freebsd-doc/2008-November/015026.html for more info >How-To-Repeat: >Fix: patch: --- patch begins here --- --- article.sgml.old 2009-03-20 00:57:22.000000000 -0400 +++ article.sgml 2009-03-20 01:03:08.000000000 -0400 @@ -307,7 +307,6 @@ organizational unit will look like: dn: ou=people,dc=example,dc=org -objectClass: top objectClass: organizationalUnit ou: people @@ -336,7 +335,6 @@ objectClass: person objectClass: posixAccount objectClass: shadowAccount -objectClass: top uidNumber: 10000 gidNumber: 10000 homeDirectory: /home/tuser @@ -352,13 +350,11 @@ user entries, but we will use the defaults below: dn: ou=groups,dc=example,dc=org -objectClass: top objectClass: organizationalUnit ou: groups dn: cn=tuser,ou=groups,dc=example,dc=org objectClass: posixGroup -objectClass: top gidNumber: 10000 cn: tuser @@ -604,51 +600,74 @@ &prompt.root; sysctl security.bsd.see_other_uids=0. - A more flexible (and probably more secure) approach can be - used by writing a custom program, or even a web interface. The - following is part of a Ruby library - that can change LDAP passwords. It sees use both on the command - line, and on the web. + A more flexible (and probably more secure) approach can be + used by writing a custom program, or even a web interface. + The following is modeled on a Python + library that can change LDAP passwords. It sees use both + on the command line, and on the web. - - Ruby script for changing passwords + + Python script for changing passwords - + 1: + user = sys.argv[1] + +ldapobj = ldap.initialize(uri) +ldapobj.start_tls_s() # this is pretty important + +# Get the users DN, and then bind as that. +# The way to do this is first bind anonymously (if you don't allow anon +# binds, there's probably some standard account you use for this. +ldapobj.simple_bind_s() + +# Search for a user with the uid we gave. We search everything under +# the "base" we configure above (as there may be other users with the same +# UID elsewhere in the tree; we don't want to return those. +result = ldapobj.search_s(searchbase, ldap.SCOPE_SUBTREE, filter%user) + +if len(result) > 1: + # This is kind of suspicious; we only want one user. + print "I found several users that match that user id." + print "Talk to your sysadmin." + sys.exit(1) + +# The results are an array of (dn, attrlist) tuples. +dn = result[0][0] + +# Now we get the user's old password, and bind to the server with it +# and his DN. If it succeeds, he (and we) have the proper credentials to +# change his password. +passwd = getpass("current password: ") +try: + ldapobj.simple_bind_s(dn, passwd) +except ldap.INVALID_CREDENTIALS: + print "Bad password." + sys.exit(1) + +# Get and confirm new password. +npass1 = 'a' +npass2 = 'b' +while npass1 != npass2: + npass1 = getpass("new password: ") + npass2 = getpass("new password (again): ") + +# This is the key. This uses the LDAP Password Modify Extended Operation. +# It is important to use this when you can, although not all libraries +# (e.g. ruby-ldap) support it. See rfc3062. +ldapobj.passwd_s(dn, passwd, npass1) + +# And we're done. +ldapobj.unbind()]]> Although not guaranteed to be free of security holes (the @@ -759,7 +778,6 @@ Creating a management group dn: cn=homemanagement,dc=example,dc=org -objectClass: top objectClass: posixGroup cn: homemanagement gidNumber: 121 # required for posixGroup --- patch ends here --- >Release-Note: >Audit-Trail: >Unformatted: