MPI Password expiration comparison:

Series of tests showing configuration and tests of openldap password expiration functionality.

Test 1: Password reset by admin w/o user ssh key:

• Current user, aa:

  # ldap -search uid=aa
  ------------------------------------------------------------------------
  dn:uid=aa,ou=users,dc=oci,dc=com
  
              cn: aa
           gecos: aa test user
     objectClass: top
                  account
                  posixAccount
                  shadowAccount
       shadowMin: 0
   shadowWarning: 7
      loginShell: /bin/bash
       uidNumber: 602
       gidNumber: 614
   homeDirectory: /home/aa
             uid: aa
    userPassword: {SSHA}yTycX2lwFYyOth5m02qcD4RTwTZlFdID
  pwdChangedTime: 20140119214749Z
       shadowMax: 7
  

• Reset password and force change:

  # ldap -r -user aa -p 1changeme -f
  User password reset w/force option: aa
  # ldap -search uid=aa
  ------------------------------------------------------------------------
  dn:uid=aa,ou=users,dc=oci,dc=com
  
              cn: aa
           gecos: aa test user
     objectClass: top
                  account
                  posixAccount
                  shadowAccount
       shadowMin: 0
   shadowWarning: 7
      loginShell: /bin/bash
       uidNumber: 602
       gidNumber: 614
   homeDirectory: /home/aa
             uid: aa
       shadowMax: 7
    userPassword: {SSHA}fvFjj4AsXnEaQcKrMCm9XKa2vcLCXINf
  pwdChangedTime: 20140310230231Z
        pwdReset: TRUE
  

• Access the host client3 as user aa to verify password change is forced:

  # Prove there are no keys for user aa on client3:
  # h
  client3
  # grep -i ^authorizedkeys /etc/ssh/sshd_config
  AuthorizedKeysFile      /etc/sshkeys/authorized_keys.%u
  # ll /etc/sshkeys
  total 24
  drwxr-xr-x.   2 root root   4096 Dec 31 12:29 ./
  dr-xr-xr-x. 117 root root  12288 Mar  8 15:48 ../
  -rw-r-----.   1 root admin  1167 Dec 31 12:29 authorized_keys.dkoleary
  -rwxr-x---.   1 root sys     834 Dec 31 12:29 authorized_keys.root*
  
  # Now, access aa@client3 and go through pwd update process:
  # h
  ldapsvr
  # ssh -l aa client3
  aa@client3's password:
  Password expired. Change your password now.
  Creating home directory for aa.
  WARNING: Your password has expired.
  You must change your password now and login again!
  Changing password for user aa.
  Current Password:
  New password:
  Retype new password:
  passwd: all authentication tokens updated successfully.
  Connection to client3 closed.
  # ssh -l aa client3
  aa@client3's password:
  Last login: Mon Mar 10 18:05:06 2014 from ldapsvr
  /usr/bin/xauth:  creating new authority file /home/aa/.Xauthority
  [aa@client3 ~]$
  

Test 2: Password reset with user ssh key:

• Configure ssh key and verify access before resetting password:

  # h
  client3
  # cp /etc/sshkeys/authorized_keys.root /etc/sshkeys/authorized_keys.aa
  # chgrp ldap-users /etc/sshkeys/authorized_keys.aa
  
  # h
  ldapsvr
  # ssh -l aa client3 hostname
  client3
  

• Reset pwd for account aa:

  # ldap -r -user aa -p 1changeme -f
  User password reset w/force option: aa
  # ldap -search uid=aa
  ------------------------------------------------------------------------
  dn:uid=aa,ou=users,dc=oci,dc=com
  
              cn: aa
           gecos: aa test user
     objectClass: top
                  account
                  posixAccount
                  shadowAccount
       shadowMin: 0
   shadowWarning: 7
      loginShell: /bin/bash
       uidNumber: 602
       gidNumber: 614
   homeDirectory: /home/aa
             uid: aa
       shadowMax: 7
    userPassword: {SSHA}AaXQmf4wg69tQa2zpMHoTKaplMYIkaiW
  pwdChangedTime: 20140310231325Z
        pwdReset: TRUE
  

• Access the host client3 as user aa to verify password change is forced:

  # h
  ldapsvr
  # ssh -l aa client3
  Last login: Mon Mar 10 18:05:24 2014 from ldapsvr
  [aa@client3 ~]$
  

  No password change forced. That’s not good.