On Mon, 2017-07-31 at 12:51 +1000, William Brown wrote: > On Fri, 2017-07-28 at 18:49 +0000, [email protected] wrote: > > Hi, > > > > I am doing some experiements with account lockout password policy. The > > account is locked out after many wrong password tries. > > > > Then > > If bind with correct password, the result is > > #<OpenStruct extended_response=nil, code=19, error_message="Exceed password > > retry limit. Please try later.", matched_dn="", message="Constraint > > Violation"> > > > > if bind with wrong password, the result is > > #<OpenStruct extended_response=nil, code=49, error_message="", > > matched_dn="", message="Invalid Credentials"> > > > > So attacker can still continue to try/guess different passwords until he > > get the result of : code=19, error_message="Exceed password retry limit. > > Please try later.". > > > > > When you say "account lockout" you are referring to the setting: > > dn: cn=config > passwordMaxFailure: 4 > passwordLockoutDuration: 600 > > Correct? > > If so this may be a security issue. Please confirm the settings you are > referring to here,
Ahh, indeed. I can produce this issue: ldapwhoami -H ldap://localhost -x -D 'uid=testuser,dc=example,dc=com' -w password dn: uid=testuser,dc=example,dc=com Bind with invalid credentials a number of times to trigger the lockout: ldapwhoami -H ldap://localhost -x -D 'uid=testuser,dc=example,dc=com' -w passworda ldap_bind: Invalid credentials (49) Then bind with valid crendentials while the lockout is in effect: ldapwhoami -H ldap://localhost -x -D 'uid=testuser,dc=example,dc=com' -w password ldap_bind: Constraint violation (19) additional info: Exceed password retry limit. Please try later. You are correct that this is likely a security issue as it allows an attacker to bypass the rate limit and account lockout mechanism. I will report this and have it dealt with appropriately. Thanks for your report, -- Sincerely, William Brown Software Engineer Red Hat, Australia/Brisbane
signature.asc
Description: This is a digitally signed message part
_______________________________________________ 389-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
