Users change password remotely?

[danb35 (Dan)]

@pike

The project as default setting leave the admin interface available on red interface.

True. I believe that’s a poor design decision.

@pike

All hosting providers allow to change the password from public interface.
All hosting providers allow the connection for admin interface from whole internet.

To a degree, but there are significant differences:

• With a hosting provider, everybody is remote, including the admin (the hosting provider’s customer)–and they certainly don’t expose their own administrative interface to the Internet.
• The Neth server manager provides much more control over the system than what a typical hosting provider exposes.
• These are separate functions, and should be treated separately. If an attacker is able to compromise an admin password, exposing the password change function means that attacker can change the password (which is certainly a bad thing)–but if the admin interface isn’t exposed to the Internet, that attacker still won’t be able to log in to it.

@pike

If user password should be changed from any of the application added to nethserver, there should be a write access on account providers, just like other webservices.

Yes, and that’s one way to go about it. Not ideal if only some of several web apps have the capability to change passwords (it means you can change your password for everything, but you have to use this specific app to do it), but definitely one possibility.

@pike

If there will be a separate service/interface for change password, there will be another place which should be protected by a hopely strong password. Even for root.

Why? If that interface doesn’t run as root (it doesn’t), and it doesn’t require administrative privileges to do its thing (it doesn’t; it uses the user’s credentials to change that user’s password), it wouldn’t seem to have the ability to compromise the system. I don’t see that it should need to be protected behind another password–though as I noted above, I’d prefer it not have the capability to change an admin’s password.

@pike

OTOH, maybe a prop for the user defining which subnet is allowed for login

That wouldn’t do anything to help my use case.

[LayLow (HF)]

@danb35

• With a hosting provider, everybody is remote, including the admin (the hosting provider’s customer)–and they certainly don’t expose their own administrative interface to the Internet.
• The Neth server manager provides much more control over the system than what a typical hosting provider exposes.
• These are separate functions, and should be treated separately. If an attacker is able to compromise an admin password, exposing the password change function means that attacker can change the password (which is certainly a bad thing)–but if the admin interface isn’t exposed to the Internet, that attacker still won’t be able to log in to it.

pike:

Fully agree

[mrmarkuz (Markus Neuberger)]

@danb35

Did you configure it to use the default virtual host or a separate one? Because I’m running into “Access Denied” when I add it under the default virtual host, despite having this in that virtual host’s configuration:

The default virtual host with Alias (/ssp) is working. The example in the ssp documentation points to /usr/local/self-service-password but it’s located in /usr/share/self-service-password.

@danb35

See if it’s possible to exclude admins from changing their passwords

I couldn’t check group membership of a user but I managed to exclude the admin user (for LDAP):

$ldap_filter = "(&(objectClass=person)(uid={login})(!(uid=admin)))";

It seems not easy to check the group membership with openldap as you’ll need to change LDAP config to use memberof-overlay:

https://jupfaf.net/index.php?article22/openldap-with-memberof-overlay

How to write LDAP query to test if user is member of a group?

@danb35

Enforce SSL for the password change

The typical rewriting should be enough. Just create /etc/e-smith/templates-custom/etc/httpd/conf.d/default-virtualhost.inc/50ssp with following content:

#
# 50ssp
#
RewriteEngine On
RewriteCond %\{HTTPS\} !=on
RewriteRule ^/ssp(/.*)?$ https://%\{HTTP_HOST\}/ssp$1 [L,R=301]

Apply the config:

expand-template /etc/httpd/conf.d/default-virtualhost.inc
systemctl restart httpd

[danb35 (Dan)]

@mrmarkuz

The example in the ssp documentation points to /usr/local/self-service-password but it’s located in /usr/share/self-service-password .

Oops. Easy enough to fix, though.

[mrmarkuz (Markus Neuberger)]

@danb35

Figure out Active Directory (although this might be a less-important feature in an AD environment–users with computers joined to the domain can change their passwords that way)

For AD I needed to enter the admin user, ldapservice is not working. My config.inc.local.php:

<?php
$lang = "de";
$show_menu = true;
$keyphrase = "secret123";
$ad_mode = true;
$ldap_starttls = false;
$ldap_url = "ldap://ad.domain.local:389";
$ldap_binddn = "domain\admin";
$ldap_bindpw = "secret";
$ldap_base = "dc=ad,dc=domain,dc=local";
$ldap_login_attribute = "sAMAccountName";
$ldap_fullname_attribute = "cn";
$ldap_filter = "(&(objectClass=user)(sAMAccountName={login})(!(userAccountControl:1.2.840.113556.1.4.803:=2)))";
$use_questions = false;
$use_sms = false;
$use_tokens = false;
$who_change_password = "manager";

You need to disable strong auth for AD to work:

Put ldap server require strong auth = no to the global section in /var/lib/machines/nsdc/etc/samba/smb.conf and restart samba in the container with systemctl -M nsdc restart samba

EDIT:

You need to use a higher version of PHP if you want to use AD. So I had to install nethserver-rh-php71-php-fpm and put the following in the Directory statements in /etc/httpd/conf.d/self-service-password.conf…

<Directory ...>
...
  <FilesMatch \.php$>
      SetHandler "proxy:fcgi://127.0.0.1:9001"
  </FilesMatch>
...
</Directory>

[danb35 (Dan)]

@mrmarkuz

For AD I needed to enter the admin user

Hmmm, don’t much like that.

@mrmarkuz

You need to disable strong auth for AD to work:

Don’t much like that either. Between these two points, if they can’t be addressed, the AD installation would be much less secure than the OpenLDAP installation:

• It needs admin privileges to run, which give it the power to do other bad things
• It stores the admin credentials, in clear text, in a directory that’s served to the public (which is not quite as bad as it sounds; the PHP should be parsed such that those credentials are never sent out, but still doesn’t sound like a good idea)
• It weakens authentication for everyone using the server, whether they use this feature or not

@mrmarkuz

/usr/share/self-service-password

Changed my template fragment to reflect the correct directory, and yes, it’s now working from the default virtual host. Silly me for not having noticed that myself.

Can we get any input from the devs on this? Specifically, is updating the password in either OpenLDAP or AD all that needs to be done? @dev_team?

[mrmarkuz (Markus Neuberger)]

@danb35

disable strong auth for AD

I think this could be solved with installing a certificate in the samba container…

[danb35 (Dan)]

I was trying to get the reset by email tokens to work with the OpenLDAP backend, and getting a message that the password was refused by the LDAP backend. But as I think about it, that makes sense–the config I’m using has the user resetting his own password, which would mean that user needs to be authenticated. If the user hasn’t entered his password, he isn’t authenticated. Bother.

I have working templates that will do the job for the direct password reset using OpenLDAP, so I think I’ll write that up and adjust as needed.

[davidep (Davide Principi)]

Hi @danb35 do you have any news about the web password changing application?

I’d like to add a user password changing form, publicly accessible from HTTPS. We currently use ldappasswd and kpasswd as client commands to change the user’s password, depending on the accounts provider type.

[danb35 (Dan)]

@davidep

Hi @danb35 do you have any news about the web password changing application?

It’s working for me:
https://wiki.nethserver.org/doku.php?id=userguide:self-service-password

[oneitonitram (Martin)]

self service password is great. i wish there was a forgot password area of sorts.

[danb35 (Dan)]

If you’re using LDAP authentication (rather than AD), you can reset it by an email token.

[oneitonitram (Martin)]

is there content for this. how?

[danb35 (Dan)]

You mean documentation? Yes, there is, at the wiki link four posts up.

[oneitonitram (Martin)]

yes, seen it.
meant, how does the email token work?
i still see enter old password appearing.
so generally, not able to change password if don.t know old one

[danb35 (Dan)]

• Click “Email” on the top header
• Enter your username
• Click on the link that you get in your email–it’s only valid for 15 minutes. That will take you here:
  
  
  
  Enter and confirm the new password, and you’re set.

[oneitonitram (Martin)]

cool, had not seen the email tab.
was wondering where the changes are being implemented.
thanks.

I also noticed ssp is not listed under modules.

[danb35 (Dan)]

@oneitonitram

I also noticed ssp is not listed under modules.

Do you mean in the software center? That’s to be expected; I’m hosting my modules myself rather than through Nethesis infrastructure.

[oneitonitram (Martin)]

not on the software center @danb35
under the modules page on the wiki

[danb35 (Dan)]

@oneitonitram

under the modules page on the wiki

Got it. Fixed.