Re: [Freeipa-users] ldap modify
On 07/21/2014 01:14 PM, Martin Kosek wrote:
On 07/21/2014 01:04 PM, Atanas Bachvaroff wrote:
Hello,
I've been experiencing strange problems trying to manually modify the
userPassword attributes in the FreeIPA's 389 directory (FreeIPA 3.3.4 on
Fedora 20). I'm using the following script:
CUT
[nasko@ipa ~]$ cat change_pass.sh
#!/bin/sh
if test -z ${1}; then
echo no dn supplied
exit 1
fi
if test -z ${2}; then
PASS=`pwgen 10 1`
else
PASS=${2}
fi
echo ${PASS}
PASS_HASH=`pwdhash ${PASS}`
(
echo dn: ${1}
echo changetype: modify
echo replace: userPassword
echo userPassword: ${PASS_HASH}
) | ldapmodify -h localhost -p 389 -D cn=directory manager -w
[nasko@ipa ~]$ ./change_pass.sh
'uid=,cn=users,cn=accounts,dc=uni-sofia,dc=bg'
nohshohwoo
modifying entry uid=,cn=users,cn=accounts,dc=uni-sofia,dc=bg
ldap_modify: Operations error (1)
[nasko@ipa ~]$
CUT
and so on and so on, ldapmodify returing the same error every time, on any
dn. Any suggestions?
P.S.
The server is in migration mode at this time.
Hello Atanas,
This issue is already discussed in
https://fedorahosted.org/freeipa/ticket/4450
and thread [Freeipa-users] 4.0.0 password migration trouble, you will find
some information there. Ludwig, this issue is completely different than
nsslapd-allow-hashed-passwords, correct?
no, don't think so. pwdhash XXX returns {SSSH}hgjhdgjah
so it matches 389 ticket 47389
But anyway, changing password via ldapmodify and supplying pre-hashed password
will not work well and you will need to run through the migration mode even
after ticket 4450 is fixed.
If you have a clear text available (which I assume based on `pwdhash ${PASS}`
construct), I would rather suggest changing it via ldappasswd script so that
FreeIPA can also generate all the Kerberos attributes.
HTH,
Martin
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project
Re: [Freeipa-users] ldap modify
Martin Kosek wrote:
On 07/21/2014 01:04 PM, Atanas Bachvaroff wrote:
Hello,
I've been experiencing strange problems trying to manually modify the
userPassword attributes in the FreeIPA's 389 directory (FreeIPA 3.3.4 on
Fedora 20). I'm using the following script:
CUT
[nasko@ipa ~]$ cat change_pass.sh
#!/bin/sh
if test -z ${1}; then
echo no dn supplied
exit 1
fi
if test -z ${2}; then
PASS=`pwgen 10 1`
else
PASS=${2}
fi
echo ${PASS}
PASS_HASH=`pwdhash ${PASS}`
(
echo dn: ${1}
echo changetype: modify
echo replace: userPassword
echo userPassword: ${PASS_HASH}
) | ldapmodify -h localhost -p 389 -D cn=directory manager -w
[nasko@ipa ~]$ ./change_pass.sh
'uid=,cn=users,cn=accounts,dc=uni-sofia,dc=bg'
nohshohwoo
modifying entry uid=,cn=users,cn=accounts,dc=uni-sofia,dc=bg
ldap_modify: Operations error (1)
[nasko@ipa ~]$
CUT
and so on and so on, ldapmodify returing the same error every time, on
any
dn. Any suggestions?
P.S.
The server is in migration mode at this time.
Hello Atanas,
This issue is already discussed in
https://fedorahosted.org/freeipa/ticket/4450
and thread [Freeipa-users] 4.0.0 password migration trouble, you will
find
some information there. Ludwig, this issue is completely different than
nsslapd-allow-hashed-passwords, correct?
But anyway, changing password via ldapmodify and supplying pre-hashed
password
will not work well and you will need to run through the migration mode
even
after ticket 4450 is fixed.
If you have a clear text available (which I assume based on `pwdhash
${PASS}`
construct), I would rather suggest changing it via ldappasswd script so
that
FreeIPA can also generate all the Kerberos attributes.
HTH,
Martin
Unfortunately, I don't have access to the cleartext passwords ('coz I'm
migrating from existing 389 / OpenLDAP directories) and ipa migrate-ds
failed miserably with hashed passwords constraint violations, so I cloned
the 389s etc., deleted the the userPassword attributes and tried to
restore 'em with the script above, taking the PASS=${2} branch, which
failed.
It appears that #4450 is very close to my issues.
--
Best regards, / Mit freundlichen Grüßen, / Met vriendelijke groeten,
Atanas Bachvaroff / Atanas Batschwaroff / Ätänas Batsjwärow
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project
Re: [Freeipa-users] ldap modify
On 07/21/2014 01:30 PM, Atanas Bachvaroff wrote:
Martin Kosek wrote:
On 07/21/2014 01:04 PM, Atanas Bachvaroff wrote:
Hello,
I've been experiencing strange problems trying to manually modify the
userPassword attributes in the FreeIPA's 389 directory (FreeIPA 3.3.4 on
Fedora 20). I'm using the following script:
CUT
[nasko@ipa ~]$ cat change_pass.sh
#!/bin/sh
if test -z ${1}; then
echo no dn supplied
exit 1
fi
if test -z ${2}; then
PASS=`pwgen 10 1`
else
PASS=${2}
fi
echo ${PASS}
PASS_HASH=`pwdhash ${PASS}`
(
echo dn: ${1}
echo changetype: modify
echo replace: userPassword
echo userPassword: ${PASS_HASH}
) | ldapmodify -h localhost -p 389 -D cn=directory manager -w
[nasko@ipa ~]$ ./change_pass.sh
'uid=,cn=users,cn=accounts,dc=uni-sofia,dc=bg'
nohshohwoo
modifying entry uid=,cn=users,cn=accounts,dc=uni-sofia,dc=bg
ldap_modify: Operations error (1)
[nasko@ipa ~]$
CUT
and so on and so on, ldapmodify returing the same error every time, on
any
dn. Any suggestions?
P.S.
The server is in migration mode at this time.
Hello Atanas,
This issue is already discussed in
https://fedorahosted.org/freeipa/ticket/4450
and thread [Freeipa-users] 4.0.0 password migration trouble, you will
find
some information there. Ludwig, this issue is completely different than
nsslapd-allow-hashed-passwords, correct?
But anyway, changing password via ldapmodify and supplying pre-hashed
password
will not work well and you will need to run through the migration mode
even
after ticket 4450 is fixed.
If you have a clear text available (which I assume based on `pwdhash
${PASS}`
construct), I would rather suggest changing it via ldappasswd script so
that
FreeIPA can also generate all the Kerberos attributes.
HTH,
Martin
Unfortunately, I don't have access to the cleartext passwords ('coz I'm
migrating from existing 389 / OpenLDAP directories) and ipa migrate-ds
failed miserably with hashed passwords constraint violations, so I cloned
the 389s etc., deleted the the userPassword attributes and tried to
restore 'em with the script above, taking the PASS=${2} branch, which
failed.
It appears that #4450 is very close to my issues.
Ok. When 4450 is fixed (I would like to get it done this week), you should be
able to just run migrate-ds and have pre-hashed user passwords stored.
Given you are running on 3.3.4 (why not the latest 3.3.5?), we should also
release fixed FreeIPA build in Fedora 20.
Martin
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project
