By default, do not manage unhashed password #2848

389-ds-bot · 2020-09-13T03:43:39Z

Cloned from Pagure issue: https://pagure.io/389-ds-base/issue/49789

Created at 2018-06-18 11:04:27 by tbordaz (@tbordaz)
Closed at 2019-07-16 15:56:28 as fixed
Assigned to tbordaz (@tbordaz)
Associated bugzillas

Issue Description

By default nsslapd-unhashed-pw-switch is set to 'on'. So a copy of the unhashed password is kept in modifiers and is possibly logged in changelog and retroCL.

Unless it is used by some plugin it does not require to keep unhash password
nsslapd-unhashed-pw-switch should be 'off' by default

Package Version and Platform

1.3.1 and later

Steps to reproduce

install replica and check changelog contains unhashed#user#password

Actual results

contains unhashed#user#password (db file)

Expected results

should not contain if it is not required

389-ds-bot · 2020-09-13T03:43:41Z

Comment from tbordaz (@tbordaz) at 2018-06-18 12:07:33

Metadata Update from @tbordaz:

Custom field component adjusted to None
Custom field origin adjusted to None
Custom field reviewstatus adjusted to None
Custom field type adjusted to None
Custom field version adjusted to None
Issue set to the milestone: 1.3.7 backlog

389-ds-bot · 2020-09-13T03:43:42Z

Comment from tbordaz (@tbordaz) at 2018-06-18 12:07:38

Metadata Update from @tbordaz:

Issue assigned to tbordaz

389-ds-bot · 2020-09-13T03:43:43Z

Comment from spichugi (@droideck) at 2018-07-16 20:54:38

Metadata Update from @droideck:

Custom field reviewstatus adjusted to ack (was: None)

389-ds-bot · 2020-09-13T03:43:44Z

Comment from tbordaz (@tbordaz) at 2018-07-17 15:53:43

e81fa85 master
51e2f0c..f94a4fe 389-ds-base-1.3.8 -> 389-ds-base-1.3.8
2dbb47e..3b67635 389-ds-base-1.3.7 -> 389-ds-base-1.3.7

389-ds-bot · 2020-09-13T03:43:44Z

Comment from mreynolds (@mreynolds389) at 2018-07-18 18:04:52

Backing out fix as this breaks FreeIPA:

a9fa210..172c60a master -> master

ecd826b..a47ea3a 389-ds-base-1.3.8 -> 389-ds-base-1.3.8

It's okay to leave this in 1.3.7

389-ds-bot · 2020-09-13T03:43:45Z

Comment from rcritten (@rcritten) at 2018-10-09 19:56:54

Can we revisit this? I forget how it broke IPA.

389-ds-bot · 2020-09-13T03:43:46Z

Comment from tbordaz (@tbordaz) at 2018-10-10 09:58:15

@rcritten, there are two FreeIPA requirement regarding unhashed password.

ipa-pwd-extop, needs the unhashed password. so it needs to enable it BUT it looks acceptable to not log the password in the changelogs ( (i.e. 'nsslapd-unhashed-pw-switch: nolog') .

with winsync, where the unhashed password needs to be logged on all replicas (IIRC). It can be configured to log it ('nsslapd-unhashed-pw-switch: on') but the impact of the default behavior being 'off' needs evaluation.

389-ds-bot · 2020-09-13T03:43:47Z

Comment from tbordaz (@tbordaz) at 2018-10-16 11:33:08

Metadata Update from @tbordaz:

Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1595766,https://bugzilla.redhat.com/show_bug.cgi?id=1592228

389-ds-bot · 2020-09-13T03:43:48Z

Comment from tbordaz (@tbordaz) at 2018-10-16 11:34:41

Metadata Update from @tbordaz:

Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1595766,https://bugzilla.redhat.com/show_bug.cgi?id=1592228, https://bugzilla.redhat.com/show_bug.cgi?id=1592226 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1595766,https://bugzilla.redhat.com/show_bug.cgi?id=1592228)

389-ds-bot · 2020-09-13T03:43:48Z

Comment from tbordaz (@tbordaz) at 2019-01-31 16:46:31

Metadata Update from @tbordaz:

Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1595766,https://bugzilla.redhat.com/show_bug.cgi?id=1592228, https://bugzilla.redhat.com/show_bug.cgi?id=1592226, https://bugzilla.redhat.com/show_bug.cgi?id=1639644 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1595766,https://bugzilla.redhat.com/show_bug.cgi?id=1592228, https://bugzilla.redhat.com/show_bug.cgi?id=1592226)

389-ds-bot · 2020-09-13T03:43:49Z

Comment from firstyear (@Firstyear) at 2019-04-16 04:09:34

Why not default this to off for 389-ds, and then IPA can enable the setting back to on in it's install process ... Seems like a pretty easy change IMO.

389-ds-bot · 2020-09-13T03:43:50Z

Comment from tbordaz (@tbordaz) at 2019-04-16 08:57:56

@Firstyear, you are right it is a pretty easy change but it needs to be sync with FreeIPA that rely on managing/logging unhashed password. It was pushed/backout because of this need to sync with freeipa.
It should land shortly, once changes on freeipa are tested/reviewed.

389-ds-bot · 2020-09-13T03:43:51Z

Comment from firstyear (@Firstyear) at 2019-04-16 09:19:51

Is there a freeipa pagure issue id so we can follow that here? Thanks for the information :)

389-ds-bot · 2020-09-13T03:43:51Z

Comment from tbordaz (@tbordaz) at 2019-04-16 09:38:48

Sure, this is https://pagure.io/freeipa/issue/4812.
Except usual upgrades cases the main issue is the handling of winsync that requires to manage and log unhashed password.