From owner-freebsd-doc@FreeBSD.ORG Fri Mar 20 05:50:02 2009 Return-Path: Delivered-To: freebsd-doc@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B49891065670 for ; Fri, 20 Mar 2009 05:50:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id A27068FC12 for ; Fri, 20 Mar 2009 05:50:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n2K5o2Ak049023 for ; Fri, 20 Mar 2009 05:50:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n2K5o2ad049022; Fri, 20 Mar 2009 05:50:02 GMT (envelope-from gnats) Date: Fri, 20 Mar 2009 05:50:02 GMT Message-Id: <200903200550.n2K5o2ad049022@freefall.freebsd.org> To: freebsd-doc@FreeBSD.org From: Toby Burress Cc: Subject: Re: docs/132839: Fix example script in ldap-auth X-BeenThere: freebsd-doc@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Toby Burress List-Id: Documentation project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Mar 2009 05:50:03 -0000 The following reply was made to PR docs/132839; it has been noted by GNATS. From: Toby Burress To: FreeBSD-gnats-submit@FreeBSD.org Cc: Subject: Re: docs/132839: Fix example script in ldap-auth Date: Fri, 20 Mar 2009 01:42:27 -0400 Oops. I just realized I had some typos, and I didn't use the standard example.org domain. Revised patch follows. --- patch begins here --- --- article.sgml.old 2009-03-20 00:57:22.000000000 -0400 +++ article.sgml 2009-03-20 01:03:08.000000000 -0400 @@ -307,7 +307,6 @@ organizational unit will look like: dn: ou=people,dc=example,dc=org -objectClass: top objectClass: organizationalUnit ou: people @@ -336,7 +335,6 @@ objectClass: person objectClass: posixAccount objectClass: shadowAccount -objectClass: top uidNumber: 10000 gidNumber: 10000 homeDirectory: /home/tuser @@ -352,13 +350,11 @@ user entries, but we will use the defaults below: dn: ou=groups,dc=example,dc=org -objectClass: top objectClass: organizationalUnit ou: groups dn: cn=tuser,ou=groups,dc=example,dc=org objectClass: posixGroup -objectClass: top gidNumber: 10000 cn: tuser @@ -604,51 +600,74 @@ &prompt.root; sysctl security.bsd.see_other_uids=0. - A more flexible (and probably more secure) approach can be - used by writing a custom program, or even a web interface. The - following is part of a Ruby library - that can change LDAP passwords. It sees use both on the command - line, and on the web. + A more flexible (and probably more secure) approach can be + used by writing a custom program, or even a web interface. + The following is modeled on a Python + library that can change LDAP passwords. It sees use both + on the command line, and on the web. - - Ruby script for changing passwords + + Python script for changing passwords - + 1: + user = sys.argv[1] + +ldapobj = ldap.initialize(uri) +ldapobj.start_tls_s() # this is pretty important + +# Get the users DN, and then bind as that. +# The way to do this is first bind anonymously (if you don't allow anon +# binds, there's probably some standard account you use for this). +ldapobj.simple_bind_s() + +# Search for a user with the uid we gave. We search everything under +# the "base" we configure above (as there may be other users with the same +# UID elsewhere in the tree; we don't want to return those). +result = ldapobj.search_s(searchbase, ldap.SCOPE_SUBTREE, filter%user) + +if len(result) > 1: + # This is kind of suspicious; we only want one user. + print "I found several users that match that user id." + print "Talk to your sysadmin." + sys.exit(1) + +# The results are an array of (dn, attrlist) tuples. +dn = result[0][0] + +# Now we get the user's old password, and bind to the server with it +# and his DN. If it succeeds, he (and we) have the proper credentials to +# change his password. +passwd = getpass("current password: ") +try: + ldapobj.simple_bind_s(dn, passwd) +except ldap.INVALID_CREDENTIALS: + print "Bad password." + sys.exit(1) + +# Get and confirm new password. +npass1 = 'a' +npass2 = 'b' +while npass1 != npass2: + npass1 = getpass("new password: ") + npass2 = getpass("new password (again): ") + +# This is the key. This uses the LDAP Password Modify Extended Operation. +# It is important to use this when you can, although not all libraries +# (e.g. ruby-ldap) support it. See rfc3062. +ldapobj.passwd_s(dn, passwd, npass1) + +# And we're done. +ldapobj.unbind()]]> Although not guaranteed to be free of security holes (the @@ -759,7 +778,6 @@ Creating a management group dn: cn=homemanagement,dc=example,dc=org -objectClass: top objectClass: posixGroup cn: homemanagement gidNumber: 121 # required for posixGroup --- patch ends here ---