When changing passwd, pam.conf is not using dsee6 for password policy
I have dsee 6.0 installed on a solaris 10 server (nznsfn60).
I have a solaris 9 server (nznsfn29) set up to use ldap authentication.
bash-2.05# cat /var/ldap/ldap_client_file
#
# Do not edit this file manually; your changes will be lost.Please use ldapclient (1M) instead.
#
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= nznsfn60.zeus.ghsewn.com, nzlsfn60.zeus.ghsewn.com
NS_LDAP_SEARCH_BASEDN= dc=zeus,dc=ghsewn,dc=com
NS_LDAP_AUTH= tls:simple
NS_LDAP_SEARCH_REF= FALSE
NS_LDAP_SEARCH_SCOPE= one
NS_LDAP_SEARCH_TIME= 30
NS_LDAP_SERVER_PREF= nznsfn60.zeus.ghsewn.com, nzlsfn60.zeus.ghsewn.com
NS_LDAP_CACHETTL= 43200
NS_LDAP_PROFILE= tls_nelsonst_profile
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=People,dc=zeus,dc=ghsewn,dc=com?one
NS_LDAP_SERVICE_SEARCH_DESC= group:ou=People,dc=zeus,dc=ghsewn,dc=com?one
NS_LDAP_SERVICE_SEARCH_DESC= shadow:ou=People,dc=zeus,dc=ghsewn,dc=com?one
NS_LDAP_BIND_TIME= 10
bash-2.05# cat /var/ldap/ldap_client_cred
#
# Do not edit this file manually; your changes will be lost.Please use ldapclient (1M) instead.
#
NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com
NS_LDAP_BINDPASSWD= {NS1}6ff7353e346f87a7
bash-2.05# cat /etc/nsswitch.conf
#
# /etc/nsswitch.ldap:
#
# An example file that could be copied over to /etc/nsswitch.conf; it
# uses LDAP in conjunction with files.
#
# "hosts:" and "services:" in this file are used only if the
# /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports.
# the following two lines obviate the "+" entry in /etc/passwd and /etc/group.
passwd:files ldap
group:files ldap
# consult /etc "files" only if ldap is down.
hosts:files dns
ipnodes:files
# Uncomment the following line and comment out the above to resolve
# both IPv4 and IPv6 addresses from the ipnodes databases. Note that
# IPv4 addresses are searched in all of the ipnodes databases before
# searching the hosts databases. Before turning this option on, consult
# the Network Administration Guide for more details on using IPv6.
#ipnodes:ldap [NOTFOUND=return] files
networks:files
protocols: files
rpc:files
ethers:files
netmasks:files
bootparams: files
publickey: files
netgroup:ldap
automount: files ldap
aliases:files ldap
# for efficient getservbyname() avoid ldap
services:files ldap
sendmailvars:files
printers:user files ldap
auth_attr: files ldap
prof_attr: files ldap
project:files ldap
bash-2.05# cat /etc/pam.conf
#
#ident "@(#)pam.conf1.2002/01/23 SMI"
#
# Copyright 1996-2002 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
# PAM configuration
#
# Unless explicitly defined, all services use the modules
# defined in the "other" section.
#
# Modules are defined with relative pathnames, i.e., they are
# relative to /usr/lib/security/$ISA. Absolute path names, as
# present in this file in previous releases are still acceptable.
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
loginauth requisite pam_authtok_get.so.1 debug
loginauth requiredpam_dhkeys.so.1 debug
loginauth requiredpam_dial_auth.so.1 debug
loginauth bindingpam_unix_auth.so.1 server_policy debug
loginauth requiredpam_ldap.so.1 use_first_pass debug
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth requiredpam_dhkeys.so.1
rlogin auth bindingpam_unix_auth.so.1 server_policy
rlogin auth requiredpam_ldap.so.1 use_first_pass
#
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
#
rshauth sufficient pam_rhosts_auth.so.1
rshauth requiredpam_unix_auth.so.1
#
# PPP service (explicit because of pam_dial_auth)
#
pppauth requisite pam_authtok_get.so.1
pppauth requiredpam_dhkeys.so.1
pppauth requiredpam_dial_auth.so.1
pppauth bindingpam_unix_auth.so.1 server_policy
pppauth requiredpam_ldap.so.1 use_first_pass
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authenctication
#
otherauth requisite pam_authtok_get.so.1 debug
otherauth requiredpam_dhkeys.so.1 debug
otherauth bindingpam_unix_auth.so.1 server_policy debug
otherauth requiredpam_ldap.so.1 use_first_pass debug
#
# passwd command (explicit because of a different authentication module)
#
passwd auth bindingpam_passwd_auth.so.1 server_policy debug
passwd auth requiredpam_ldap.so.1 use_first_pass debug
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cronaccount requiredpam_projects.so.1
cronaccount requiredpam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
otheraccount requisitepam_roles.so.1 debug
otheraccount requiredpam_projects.so.1 debug
otheraccount binding pam_unix_account.so.1 server_policy debug
otheraccount requiredpam_ldap.so.1 no_pass debug
#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
othersession requiredpam_unix_session.so.1
#
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
#
otherpassword requiredpam_dhkeys.so.1 debug
otherpassword requisitepam_authtok_get.so.1 debug
otherpassword requisitepam_authtok_check.so.1 debug
otherpassword requiredpam_authtok_store.so.1 server_policy debug
#
# Support for Kerberos V5 authentication (uncomment to use Kerberos)
#
#rlogin auth optionalpam_krb5.so.1 try_first_pass
#login auth optionalpam_krb5.so.1 try_first_pass
#other auth optionalpam_krb5.so.1 try_first_pass
#cronaccount optionalpam_krb5.so.1
#other account optionalpam_krb5.so.1
#other session optionalpam_krb5.so.1
#other password optionalpam_krb5.so.1 try_first_pass
I can ssh into nznsfn29 with user vz07r1 which does not exist locally but exists in the directory server. This is from /var/adm/messages on nznsfn29 (the ldap client):
May 17 15:25:07 nznsfn29 sshd[26956]: [ID 634615 auth.debug] pam_authtok_get:pam_sm_authenticate: flags = 0
May 17 15:25:11 nznsfn29 sshd[26956]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
May 17 15:25:11 nznsfn29 sshd[26956]: [ID 285619 auth.debug] ldap pam_sm_authenticate(sshd vz07r1), flags = 0
May 17 15:25:11 nznsfn29 sshd[26956]: [ID 509786 auth.debug] roles pam_sm_authenticate, service = sshd user = vz07r1 ruser = not set rhost = hlz1ir16.zeus.ghsewn.com
May 17 15:25:11 nznsfn29 sshd[26956]: [ID 579461 auth.debug] pam_unix_account: entering pam_sm_acct_mgmt()
May 17 15:25:11 nznsfn29 sshd[26956]: [ID 724664 auth.debug] pam_ldap pam_sm_acct_mgmt: illegal option no_pass
May 17 15:25:11 nznsfn29 sshd[26956]: [ID 100510 auth.debug] ldap pam_sm_acct_mgmt(vz07r1), flags = 0
May 17 15:25:11 nznsfn29 sshd[26953]: [ID 800047 auth.info] Accepted keyboard-interactive/pam for vz07r1 from 10.115.1.251 port 2703 ssh2
May 17 15:25:11 nznsfn29 sshd[26953]: [ID 914923 auth.debug] pam_dhkeys: no valid mechs found. Trying AUTH_DES.
May 17 15:25:11 nznsfn29 sshd[26953]: [ID 499478 auth.debug] pam_dhkeys: get_and_set_seckey: could not get secret key for keytype 192-0
May 17 15:25:11 nznsfn29 sshd[26953]: [ID 507889 auth.debug] pam_dhkeys: mech key totals:
May 17 15:25:11 nznsfn29 sshd[26953]: [ID 991756 auth.debug] pam_dhkeys: 0 valid mechanism(s)
May 17 15:25:11 nznsfn29 sshd[26953]: [ID 898160 auth.debug] pam_dhkeys: 0 secret key(s) retrieved
May 17 15:25:11 nznsfn29 sshd[26953]: [ID 403608 auth.debug] pam_dhkeys: 0 passwd decrypt successes
May 17 15:25:11 nznsfn29 sshd[26953]: [ID 327308 auth.debug] pam_dhkeys: 0 secret key(s) set
May 17 15:25:11 nznsfn29 sshd[26958]: [ID 965073 auth.debug] pam_dhkeys: cred reinit/refresh ignored
If I try to then change the password with the `passwd` command it does not use the password policy on the directory server but the default defined in /etc/default/passwd
bash-2.05$ passwd
passwd: Changing password for vz07r1
Enter existing login password:
New Password:
passwd: Password too short - must be at least 8 characters.
Please try again
May 17 15:26:17 nznsfn29 passwd[27014]: [ID 285619 user.debug] ldap pam_sm_authenticate(passwd vz07r1), flags = 0
May 17 15:26:17 nznsfn29 passwd[27014]: [ID 509786 user.debug] roles pam_sm_authenticate, service = passwd user = vz07r1 ruser = not set rhost = not set
May 17 15:26:17 nznsfn29 passwd[27014]: [ID 579461 user.debug] pam_unix_account: entering pam_sm_acct_mgmt()
May 17 15:26:17 nznsfn29 passwd[27014]: [ID 724664 user.debug] pam_ldap pam_sm_acct_mgmt: illegal option no_pass
May 17 15:26:17 nznsfn29 passwd[27014]: [ID 100510 user.debug] ldap pam_sm_acct_mgmt(vz07r1), flags = 80000000
May 17 15:26:17 nznsfn29 passwd[27014]: [ID 985558 user.debug] pam_dhkeys: entered pam_sm_chauthtok()
May 17 15:26:17 nznsfn29 passwd[27014]: [ID 988707 user.debug] read_authtok: Copied AUTHTOK to OLDAUTHTOK
May 17 15:26:20 nznsfn29 passwd[27014]: [ID 558286 user.debug] pam_authtok_check: pam_sm_chauthok called
May 17 15:26:20 nznsfn29 passwd[27014]: [ID 271931 user.debug]pam_authtok_check: minimum length from /etc/default/passwd: 8
May 17 15:26:20 nznsfn29 passwd[27014]: [ID 985558 user.debug] pam_dhkeys: entered pam_sm_chauthtok()
May 17 15:26:20 nznsfn29 passwd[27014]: [ID 417489 user.debug] pam_dhkeys: OLDRPCPASS already set
I am using the default policy on the directory server which states a minimum password length of 6 characters.
nznsfn60:root:LDAP_Master:/var/opt/SUNWdsee/dscc6/dcc/ads/ldif#dsconf get-server-prop -h nznsfn60 -p 389|grep ^pwd-
pwd-accept-hashed-pwd-enabled: N/A
pwd-check-enabled: off
pwd-compat-mode: DS6-mode
pwd-expire-no-warning-enabled: on
pwd-expire-warning-delay: 1d
pwd-failure-count-interval : 10m
pwd-grace-login-limit : disabled
pwd-keep-last-auth-time-enabled: off
pwd-lockout-duration: disabled
pwd-lockout-enabled: off
pwd-lockout-repl-priority-enabled : on
pwd-max-age: disabled
pwd-max-failure-count : 3
pwd-max-history-count : disabled
pwd-min-age: disabled
pwd-min-length : 6
pwd-mod-gen-length: 6
pwd-must-change-enabled: off
pwd-root-dn-bypass-enabled : off
pwd-safe-modify-enabled: off
pwd-storage-scheme: CRYPT
pwd-strong-check-dictionary-path: /opt/SUNWdsee/ds6/plugins/words-english-big.txt
pwd-strong-check-enabled: off
pwd-strong-check-require-charset: lower
pwd-strong-check-require-charset: upper
pwd-strong-check-require-charset: digit
pwd-strong-check-require-charset: special
pwd-supported-storage-scheme: CRYPT
pwd-supported-storage-scheme: SHA
pwd-supported-storage-scheme: SSHA
pwd-supported-storage-scheme: NS-MTA-MD5
pwd-supported-storage-scheme: CLEAR
pwd-user-change-enabled: off
Whereas /etc/default/passwd on the ldap client (nznsfn29) says passwords must be 8 characters. This is seen with thepam_authtok_check: minimum length from /etc/default/passwd: 8
. It is clearly not using the policy from the directory server but checking locally. So I can login ok using the ldap server for authentication but when I try to change the password it does not use the policy from the server which says I only need a minimum lenght of 6 characters.
I have read that pam_ldap is only supported for directory server 5.2. Because I am running ds6 and with password compatability in ds6 mode maybe this is my problem. Does anyone know of any updated pam_ldap modules for solaris 9?
# 1
pam_ldap on Solaris 10 works fine with DS6.I think the bit you are missing is in the client config. Try adding these to the clients profile:NS_LDAP_SERVICE_AUTH_METHOD= passwd-cmd:tls:simpleNS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:tls:simple
# 2
I shouldn't need to specify tls:simple for serviceAuthenticationMethod as it should grab my value for authenticationMethod which is set to tls:simple.
Anyway, I gave it a go to see if it would make a difference. Still no luck - it checks /etc/default/passwd on the client machine. I have had a case with SUN open for this and they have come back with an answer.
It appears to be a pam design issue. Every new password needs to be validated by "pam_authtok_check.so.1". By design and implementation, "pam_authtok_check.so.1" only checks "/etc/default/passwd" for syntax rules. The alternative would be to use "pam_ldap.so.1" but it also checks "/etc/default/passwd". Apparently the LDAP password policy is really intended for password changes via "ldapmodify" or the console (for dsee6 that is the command centre).
I guess that means we can not use the ldap server to enforce syntax checking on passwords - length of password or make up of password (lower or upper case, special characters etc). That side of things will have to be controlled on the individual server (via /etc/default/passwd). So for Solaris 9 will not be able to enforce strict password rules (mix of lower and upper case, no dictionary words etc)
# 3
> I shouldn't need to specify tls:simple for
> serviceAuthenticationMethod as it should grab my
> value for authenticationMethod which is set to
> tls:simple.
>
Yes, I thought that but I was unable to get the passwd change mechanism working until I added:
NS_LDAP_SERVICE_AUTH_METHOD= passwd-cmd:tls:simple
The options binding and server_policy, according to Sun docs, alter the way an account is referenced depending if it is local or remote (on ldap server). So a user id which only appears in ldap should have the passwd management rules of the server applied.
Just tested it again, it does seem to work. I have PASSLENGTH=4 in /etc/default/passwd, and the server policy set to length 8. The client will only accept 8 char passwords.
However, I have a Solaris 10 client, haven't tested on Solaris 9 yet.
If Solaris 9 is really broken in this respect, I wonder if it would be possible to replace the passwd command with a wrapper which invokes ldapmodify?
# 4
I have not had a chance to test this out on solaris 10 clients yet. I would be interested to see your results with a solaris 9 client, if you get the same problem as me.
# 5
I now have a working configuration for Solaris 9 & 10
I can set a minimum password length on the DS 6.x server, and a different password length locally in /etc/default/passwd.
For ldap only clients, I need to use the minimum passwd length defined on the server. For local accounts (using passwd -r files) I can set according to the local policy. The messages returned from the server are a bit variable, i.e. if I use a password which is in the dictionary, it says the password is too short.
Let me know if you want the configs.
# 6
I would very much like to see your configuration. That is great to hear. Something that SUN support was not able to provide me!
# 7
For some reason I can't get the client to pick up and check the password policy assigned in DSEE 6.0. If I login to the server the password policy is enforced, however if I login at a client configured with native LDAP I don't get prompted for anything. I think my problem is in the pam.conf but I'd like a working Solaris 9 pam.conf to check it against. Any assistance or guidance would be truly appreciated...and for the record I'm a Solaris novice. Thanks
# 8
I think the important bit is that account management only works if the bind is being done as the logged in user, not the proxyagent. This enables the server to act on the user id. You can check this by looking at the access log file. Do a `tail -f` on the file while logging in to the client or changing the password. If the bind is being done as the proxyagent, things won't work.
The pam.conf is from a Sun doc. The important bits are the binding and server_policy options which instruct the pam stack to use pam_ldap if the user is on the ldap server and not in local passwd file.
On the server side, I had a ACI which originally allowed the proxyagent to read the passwd field. I set this to deny which ensures the uid must bind to login and change passwd etc. With this set, you won't be able to login unless you bind as the user id.
This also stops commands like `ldaplist passwd` from displaying the passwd field on the client.
Some of this info was taken from LDAP in the Solaris Operating Environment:
http://www.amazon.com/LDAP-Solaris-Operating-Environment-Microsystems/dp/013145 6938/ref=sr_1_2/103-9860328-0701422?ie=UTF8&s=books&qid=1182529551&s r=1-2
I recommend it.
Finally, how well account management works is more relevant to the client side. Some clients (HP, AIX Solaris 8 and below) may not be able to implement all functionality.
Good luck.
PS. There is a patch on sunsolve to update to DS 6.1. Patch id: 125276-02
Client side:
ldapclient list:
NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=<xxx>,dc=<xxx>l
NS_LDAP_BINDPASSWD= {NS1}<encrypted passwd>
NS_LDAP_SERVERS= <master server ip address>
NS_LDAP_SEARCH_BASEDN= dc=<xxx>,dc=<xxx>l
NS_LDAP_AUTH= tls:simple
NS_LDAP_SEARCH_REF= TRUE
NS_LDAP_SEARCH_SCOPE= one
NS_LDAP_SEARCH_TIME= 30
NS_LDAP_SERVER_PREF= <preferred server ip address>
NS_LDAP_CACHETTL= 43200
NS_LDAP_PROFILE= profile1
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_BIND_TIME= 30
NS_LDAP_SERVICE_AUTH_METHOD= passwd-cmd:tls:simple
NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:tls:simple
Pam.conf
# PAM configuration
#
# Authentication management
#
# login service (explicit because of pam_dial_auth)
#
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_dial_auth.so.1
login auth binding pam_unix_auth.so.1 server_policy
login auth required pam_ldap.so.1
#
# rlogin service (explicit because of pam_rhost_auth)
#
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth required pam_dhkeys.so.1
rlogin auth binding pam_unix_auth.so.1 server_policy
rlogin auth required pam_ldap.so.1
#
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
#
rsh auth sufficient pam_rhosts_auth.so.1
rsh auth required pam_unix_auth.so.1
#
# PPP service (explicit because of pam_dial_auth)
#
ppp auth requisite pam_authtok_get.so.1
ppp auth required pam_dhkeys.so.1
ppp auth required pam_dial_auth.so.1
ppp auth binding pam_unix_auth.so.1 server_policy
ppp auth required pam_ldap.so.1
#
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth binding pam_unix_auth.so.1 server_policy
other auth required pam_ldap.so.1
#
# passwd command (explicit because of a different authentication module)
#
passwd auth binding pam_passwd_auth.so.1 server_policy
passwd auth required pam_ldap.so.1
#
# cron service (explicit because of non-usage of pam_roles.so.1)
#
cron account required pam_projects.so.1
cron account required pam_unix_account.so.1
#
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other account requisite pam_roles.so.1
other account required pam_projects.so.1
other account binding pam_unix_account.so.1 server_policy
other account required pam_ldap.so.1
#
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
#
other session required pam_unix_session.so.1
#
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
#
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password required pam_authtok_store.so.1 server_policy
#
# Support for Kerberos V5 authentication (uncomment to use Kerberos)
#
#rlogin auth optional pam_krb5.so.1 try_first_pass
#login auth optional pam_krb5.so.1 try_first_pass
#other auth optional pam_krb5.so.1 try_first_pass
#cron account optional pam_krb5.so.1
#other account optional pam_krb5.so.1
#other session optional pam_krb5.so.1
#other password optional pam_krb5.so.1 try_first_pass
Server side
Using DSCC:
Directory Servers > <ServerName>:389 Access Control > LDAP_Naming_Services_proxy_password_read
(target="ldap:///dc=<xxx>,dc=<xxx>")(targetattr="userPassword")(ver sion 3.0; acl LDAP_Naming_Services_proxy_password_read; deny (compare,read,search) userdn = "ldap:///cn=proxyagent,ou=profile,dc=<xxx>,dc=<xxx>l";)
# 9
Looking at the access logs there are multiple binds as the proxy agent and searches for a number of attributest (including userpassword) and only one bind as the user I want to authenticate with but with no searches:
[25/Jun/2007:15:11:25 +1200] conn=479 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:25 +1200] conn=479 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:25 +1200] conn=479 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell"
[25/Jun/2007:15:11:25 +1200] conn=479 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:25 +1200] conn=479 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:25 +1200] conn=479 op=2 msgId=-1 - closing from 10.115.4.65:43786 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:26 +1200] conn=479 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:27 +1200] conn=480 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43789 to 10.220.30.98
[25/Jun/2007:15:11:27 +1200] conn=480 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:27 +1200] conn=480 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:27 +1200] conn=480 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:27 +1200] conn=480 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell"
[25/Jun/2007:15:11:27 +1200] conn=480 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:27 +1200] conn=480 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:27 +1200] conn=480 op=2 msgId=-1 - closing from 10.115.4.65:43789 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:27 +1200] conn=481 op=-1 msgId=-1 - fd=40 slot=40 LDAPS connection from 10.115.4.65:43790 to 10.220.30.98
[25/Jun/2007:15:11:27 +1200] conn=480 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:27 +1200] conn=481 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:27 +1200] conn=481 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:27 +1200] conn=481 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:27 +1200] conn=481 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="uid userPassword shadowFlag"
[25/Jun/2007:15:11:27 +1200] conn=481 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:27 +1200] conn=481 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:27 +1200] conn=481 op=2 msgId=-1 - closing from 10.115.4.65:43790 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:28 +1200] conn=481 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:29 +1200] conn=482 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43793 to 10.220.30.98
[25/Jun/2007:15:11:29 +1200] conn=482 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:29 +1200] conn=482 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:29 +1200] conn=482 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:29 +1200] conn=482 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell"
[25/Jun/2007:15:11:29 +1200] conn=482 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:29 +1200] conn=482 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:29 +1200] conn=482 op=2 msgId=-1 - closing from 10.115.4.65:43793 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:30 +1200] conn=482 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=483 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43798 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=483 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=483 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=483 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=483 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell"
[25/Jun/2007:15:11:34 +1200] conn=483 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:34 +1200] conn=483 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=483 op=2 msgId=-1 - closing from 10.115.4.65:43798 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=484 op=-1 msgId=-1 - fd=40 slot=40 LDAPS connection from 10.115.4.65:43799 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=483 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=484 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=484 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=484 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=484 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell"
[25/Jun/2007:15:11:34 +1200] conn=484 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:34 +1200] conn=484 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=484 op=2 msgId=-1 - closing from 10.115.4.65:43799 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=485 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43800 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=484 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=485 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=485 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=485 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=485 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="uid userPassword shadowFlag"
[25/Jun/2007:15:11:34 +1200] conn=485 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:34 +1200] conn=485 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=485 op=2 msgId=-1 - closing from 10.115.4.65:43800 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=486 op=-1 msgId=-1 - fd=40 slot=40 LDAPS connection from 10.115.4.65:43801 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=485 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=486 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=486 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=486 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=486 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell"
[25/Jun/2007:15:11:34 +1200] conn=486 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:34 +1200] conn=486 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=486 op=2 msgId=-1 - closing from 10.115.4.65:43801 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=487 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43802 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=486 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=487 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=487 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=487 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=487 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="uid userPassword shadowFlag"
[25/Jun/2007:15:11:34 +1200] conn=487 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:34 +1200] conn=487 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=487 op=2 msgId=-1 - closing from 10.115.4.65:43802 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=488 op=-1 msgId=-1 - fd=40 slot=40 LDAPS connection from 10.115.4.65:43803 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=487 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=488 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=488 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=488 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=488 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs=ALL
[25/Jun/2007:15:11:34 +1200] conn=488 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:34 +1200] conn=488 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=488 op=2 msgId=-1 - closing from 10.115.4.65:43803 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=489 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43805 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=488 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=489 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=489 op=0 msgId=1 - BIND dn="uid=vz07r1,ou=people,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=489 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=vz07r1,ou=people,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=489 op=1 msgId=2 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=489 op=1 msgId=-1 - closing from 10.115.4.65:43805 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=490 op=-1 msgId=-1 - fd=40 slot=40 LDAPS connection from 10.115.4.65:43806 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=489 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=490 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=490 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=490 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=490 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(objectClass=SolarisUserAttr)(uid=vz07r1))" attrs="uid SolarisUserQualifier SolarisAttrReserved1 SolarisAttrReserved2 SolarisAttrKeyValue"
[25/Jun/2007:15:11:34 +1200] conn=490 op=1 msgId=2 - RESULT err=0 tag=101 nentries=0 etime=0
[25/Jun/2007:15:11:34 +1200] conn=490 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=490 op=2 msgId=-1 - closing from 10.115.4.65:43806 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=491 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43807 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=490 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=491 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=491 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=491 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=491 op=1 msgId=2 - SRCH base="ou=projects,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(objectClass=SolarisProject)(SolarisProjectName=user.vz07r1))" attrs="SolarisProjectName SolarisProjectID description memberUid memberGid SolarisProjectAttr"
[25/Jun/2007:15:11:34 +1200] conn=491 op=1 msgId=2 - RESULT err=32 tag=101 nentries=0 etime=0
[25/Jun/2007:15:11:34 +1200] conn=491 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=491 op=2 msgId=-1 - closing from 10.115.4.65:43807 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=492 op=-1 msgId=-1 - fd=40 slot=40 LDAPS connection from 10.115.4.65:43808 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=491 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=492 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=492 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=492 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=492 op=1 msgId=2 - SRCH base="ou=projects,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(objectClass=SolarisProject)(SolarisProjectName=group.edsunix))" attrs="SolarisProjectName SolarisProjectID description memberUid memberGid SolarisProjectAttr"
[25/Jun/2007:15:11:34 +1200] conn=492 op=1 msgId=2 - RESULT err=32 tag=101 nentries=0 etime=0
[25/Jun/2007:15:11:34 +1200] conn=492 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=492 op=2 msgId=-1 - closing from 10.115.4.65:43808 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=493 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43809 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=492 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=493 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=493 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=493 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=493 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="uid userPassword shadowFlag"
[25/Jun/2007:15:11:34 +1200] conn=493 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:34 +1200] conn=493 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=493 op=2 msgId=-1 - closing from 10.115.4.65:43809 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=494 op=-1 msgId=-1 - fd=40 slot=40 LDAPS connection from 10.115.4.65:43810 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=493 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=494 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=494 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=494 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=494 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs=ALL
[25/Jun/2007:15:11:34 +1200] conn=494 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:34 +1200] conn=494 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=494 op=2 msgId=-1 - closing from 10.115.4.65:43810 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=495 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43811 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=494 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=495 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=495 op=0 msgId=1 - BIND dn="uid=vz07r1,ou=people,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=495 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=vz07r1,ou=people,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=495 op=1 msgId=2 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=495 op=1 msgId=-1 - closing from 10.115.4.65:43811 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=496 op=-1 msgId=-1 - fd=40 slot=40 LDAPS connection from 10.115.4.65:43812 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=495 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=496 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=496 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=496 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=496 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uidN umber=5041))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell"
[25/Jun/2007:15:11:34 +1200] conn=496 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:34 +1200] conn=496 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=496 op=2 msgId=-1 - closing from 10.115.4.65:43812 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=497 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43813 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=496 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=497 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:34 +1200] conn=497 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:34 +1200] conn=497 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:34 +1200] conn=497 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell"
[25/Jun/2007:15:11:34 +1200] conn=497 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:34 +1200] conn=497 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:34 +1200] conn=497 op=2 msgId=-1 - closing from 10.115.4.65:43813 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:34 +1200] conn=498 op=-1 msgId=-1 - fd=40 slot=40 LDAPS connection from 10.115.4.65:43814 to 10.220.30.98
[25/Jun/2007:15:11:34 +1200] conn=497 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:34 +1200] conn=498 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:35 +1200] conn=498 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:35 +1200] conn=498 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=1 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:35 +1200] conn=498 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell"
[25/Jun/2007:15:11:35 +1200] conn=498 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:35 +1200] conn=498 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:35 +1200] conn=498 op=2 msgId=-1 - closing from 10.115.4.65:43814 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:35 +1200] conn=499 op=-1 msgId=-1 - fd=37 slot=37 LDAPS connection from 10.115.4.65:43815 to 10.220.30.98
[25/Jun/2007:15:11:35 +1200] conn=498 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:35 +1200] conn=499 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:35 +1200] conn=499 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:35 +1200] conn=499 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:35 +1200] conn=499 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(nsRole=cn=nznsfn29Role,ou=profile,dc=zeus,dc=ghsewn,dc=com)(uid= vz07r1))" attrs="uid userPassword shadowFlag"
[25/Jun/2007:15:11:35 +1200] conn=499 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[25/Jun/2007:15:11:35 +1200] conn=499 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:35 +1200] conn=499 op=2 msgId=-1 - closing from 10.115.4.65:43815 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:35 +1200] conn=500 op=-1 msgId=-1 - fd=40 slot=40 LDAPS connection from 10.115.4.65:43816 to 10.220.30.98
[25/Jun/2007:15:11:35 +1200] conn=499 op=-1 msgId=-1 - closed.
[25/Jun/2007:15:11:35 +1200] conn=500 op=-1 msgId=-1 - SSL 128-bit RC4
[25/Jun/2007:15:11:35 +1200] conn=500 op=0 msgId=1 - BIND dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com" method=128 version=3
[25/Jun/2007:15:11:35 +1200] conn=500 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com"
[25/Jun/2007:15:11:35 +1200] conn=500 op=1 msgId=2 - SRCH base="ou=people,dc=zeus,dc=ghsewn,dc=com" scope=1 filter="(&(objectClass=posixGroup)(memberUid=vz07r1))" attrs="cn gidNumber userPassword memberUid"[25/Jun/2007:15:11:35 +1200] conn=500 op=1 msgId=2 - RESULT err=0 tag=101 nentries=0 etime=0
[25/Jun/2007:15:11:35 +1200] conn=500 op=2 msgId=3 - UNBIND
[25/Jun/2007:15:11:35 +1200] conn=500 op=2 msgId=-1 - closing from 10.115.4.65:43816 - U1 - Connection closed by unbind client -
[25/Jun/2007:15:11:36 +1200] conn=500 op=-1 msgId=-1 - closed.
What do you see in your access log?
My pam.conf is the same as yours except for the extra use_first_pass which means if pam_unix_auth.so.1 fails for the local user it will not then try and check pam_ldap.so.1. So there should be no issues here.
I have modified my aci for the proxy agent but so they only have search and compare permissions for userpassword so read access is denied:
(target="ldap:///dc=zeus,dc=ghsewn,dc=com")(targetattr="userPassword")(version 3.0; acl LDAP_Naming_Services_proxy_password_read; allow (compare,search) userdn = "ldap:///cn=proxyagent,ou=profile,dc=zeus,dc=ghsewn,dc=com";)
I have set up an hp-ux 11.23 client for authentication as well and I can not get the password policy working for that client either!
I may upgrade to 6.1 and see what happens. This is starting to get quite frustrating. I may look at moving to Openldap.
Do you have debugging turned on for pam for your client? I was wondering what your logs look like.
# 10
Forgot to mention that Solaris 9 will need patches. Solaris 10 h/w 1106 is ok but Solaris 9 0905 needs patching for this to work. Don't know the patch numbers, I just loaded the recommended bundle.
The thing is that the BIND as the userid will only happen for login and passwd operations. When you are logged in, any lookup will be done using the proxyagent, so you will see loads of BIND's as proxyagent if you have a number of clients searching the database. Cherck the errors file for any entries around the time the BIND as your userid happened.
You can set debugging in the pam.conf file by adding the word "debug" as an option at the end of the line for the module you want to see debugging for. Then in syslog.conf set auth.debug to point to a file. There are more debug things you can do but I'm not familiar with them. Finally you could switch off using ssl and snoop the network with something like:
`snoop -x0` between the client and server. This will show what transactions are taking place.
This whole account management thing is very dependant on the capabilities of the client, you may not get the same functionality between Solaris levels let alone other OS's like HP. Sun initially supplied the mechanism of ldap account management to the IETF earlier this year and it has only just recently been agreed so I don't know what the take up among other platforms will be like, it is still a bit early stages. Anyway, don't give up, took me three months to get to this stage.
# 11
I will investigate patches for solaris 9 now.
I already have pam.conf debugging working. That is how I could tell my server is checking the local policy (/etc/default/passwd) rather than the directory server.
I agree, taking ssl out of the equation will be a good idea for further debugging.
# 12
I added the following solaris 9 patches to my client:
112874-38SunOS 5.9: libc patch
112960-52SunOS 5.9: ldap library Patch
113032-05SunOS 5.9: init patch
114713-03SunOS 5.9: newtask & libproject.so.1 patch
117431-01SunOS 5.9: nss_nis Patch
I have also updated the directory server to version 6.1. Still no luck with the password management functionality. I took out ssl and did a snoop on my traffic but nothing is obvious.
I have been trying for nearly 3 months now! The annoying thing is that when I logged a call with SUN their final answer was that the design of pam is to check /etc/default/passwd file on the local server not the directory server. But obviously you have managed to get it to work.
I would be intersted in seeing what shows up in your logs when debug is on for pam and you are changing passwords and checking the directory server policy. Would be interested to compare with what I see:
Jun 26 11:15:39 nznsfn29 passwd[2944]: [ID 271931 user.debug] pam_authtok_check: minimum length from /etc/default/passwd: 8
# 13
I just tried another experiment. Changed my default policy so also does strong password checking (mix of upper and lower, and special characters) and also for dictionary words. Both of these checks work (confirmed in error logs) although the error message on the client:Password too short is not helpful.
So, if I could just get it to use the password length check on the directory server as well!
# 14
Something else interesting. I disabled password length checking on my client in /etc/default/passwd. The policy on the directory server is for a minimum length of 6. I then changed the password for my user (which is only in LDAP) on the client and gave it a 6 character password, which worked. This is what I see from syslog on the client:
Jun 26 12:08:25 nznsfn29 passwd[4737]: [ID 271931 user.debug] pam_authtok_check: minimum length from /etc/default/passwd: 6
Obvioulsy just a PAM error message to say it is checking the minimum password length. Says it is /etc/default/passwd even if it is from the directory server.
# 15
I have retested on HP-UX 11.23. It appears my problems here were due to not updating the client cache. My HP-UX 11.23 client does now obey the policy from the directory server for length check, strong password composition and dictionary words.
# 16
I'm pleased to see you have an HP client working, I wasn't expecting to be able to do that. Did you install anything third party or is the HP client working with natvie LDAP from the HP-UX?
I have turned debugging off now but here is a message from the client side on Solaris 10 which reflect server policy:
Jun 8 10:47:50 chianti-10 login: [ID 468494 auth.crit] login account failure: User password has expired
And a different error on the server side in /var/ds/logs/errors:
[26/Jun/2007:10:53:09 +0100] - INFORMATION - Strong Password Check Plugin - conn=2620 op=1 msgId=2 - invalid password syntax: dictionary word match
The messaging back to the client doesn't work properly. I get errors on the server saying passwd change failed due to a dictionary match, while the error at the client side says the passwd is too short.
I get the feeling that whilst it basically works, there are several "features" about it which may make it unsuitable for serious production use. It may be easier to set passwd policy local on each client!
The Sun support for this product is a bit variable. I do recommend buying the book mentioned earlier and if possible have your company spend some money on Sun Professional Services to have them come to site and make it work they way they claim it does!
# 17
...
> I have turned debugging off now but here is a message
> from the client side on Solaris 10 which reflect
> server policy:
> Jun 8 10:47:50 chianti-10 login: [ID 468494
> auth.crit] login account failure: User password has
> expired
>
> And a different error on the server side in
> /var/ds/logs/errors:
> [26/Jun/2007:10:53:09 +0100] - INFORMATION - Strong
> Password Check Plugin - conn=2620 op=1 msgId=2 -
> invalid password syntax: dictionary word match
>
This is strange. And I am not sure the two errors are related.
The first one occurs when one authenticates to the Directory (login failure, password expired).
The second one occurs when the password is changed (ie the new password supplied doesn't pass the quality checkings).
Regards,
Ludovic.
> The messaging back to the client doesn't work
> properly. I get errors on the server saying passwd
> change failed due to a dictionary match, while the
> error at the client side says the passwd is too
> short.
>
> I get the feeling that whilst it basically works,
> there are several "features" about it which may make
> it unsuitable for serious production use. It may be
> easier to set passwd policy local on each client!
>
> The Sun support for this product is a bit variable. I
> do recommend buying the book mentioned earlier and if
> possible have your company spend some money on Sun
> Professional Services to have them come to site and
> make it work they way they claim it does!
# 18
Sorry, by different error, I mean a different issue. The log entries are to show account management references for server side policy, rather than local policy. Perhaps I confused things by putting them in the post.
# 19
For HP-UX 11.23 all I had to install was the LDAP-UX depot which is free from HP. The config files on HP are very clear and their is good documentation. It was alot more straight forward than getting the Solaris 9 client to work.
