Red Hat Bugzilla – Bug 1174723
values for pwdChecker are not set to default values
Last modified: 2015-11-19 03:52:44 EST
Description of problem: minPoints value in pwdChecker isn't set to default value. Documentation says: minPoints : integer. Default value: 3. Minimum number of quality points a new password must have to be accepted. One quality point is awarded for each character class used in the password. My use case: cat > /etc/openldap/check_password.conf <<EOF minLower 3 EOF Then 'ldappasswd -H ldap://my-domain.com -a PASSab -s BLABla -D uid=testuser3,dc=my-domain,dc=com -w PASSab -x uid=testuser3,dc=my-domain,dc=com' is allowed but it should fail. If I explicitly set 'minPoints 3' then ldappasswd fails: [test]ldappasswd -H ldap://my-domain.com -a PASSab -s BLABla -D uid=testuser3,dc=my-domain,dc=com -w PASSab -x uid=testuser3,dc=my-domain,dc=com -e ppolicy Result: Constraint violation (19) control: 1.3.6.1.4.1.42.2.27.8.5.1 false MAOBAQU= ppolicy: error=5 (Password fails quality checks) Version-Release number of selected component (if applicable): openldap-2.4.39-3.el7 How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
The same situation is for other keywords in /etc/openldap/check_password.conf. If keyword isn't found in a file then its value is set to '-1' instead of default value.
Fix in Fedora: http://pkgs.fedoraproject.org/cgit/openldap.git/commit/?id=0625d0e5014f6ddcf02e6d6ffed7fa2ba57fd024
*** Bug 1196243 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-2131.html