{"id":20543779,"url":"https://github.com/isarandi/openldap-check-pwquality","last_synced_at":"2025-07-23T02:04:20.522Z","repository":{"id":79994283,"uuid":"424638704","full_name":"isarandi/openldap-check-pwquality","owner":"isarandi","description":"Password policy module for OpenLDAP using libpwquality. Ensures that users have strong passwords.","archived":false,"fork":false,"pushed_at":"2021-11-04T17:42:31.000Z","size":41,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-07-23T02:02:53.191Z","etag":null,"topics":["openldap","openldap-server","openldap-slapd","password-policy","password-strength","pwquality"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/isarandi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-11-04T15:08:00.000Z","updated_at":"2024-06-18T03:17:52.000Z","dependencies_parsed_at":null,"dependency_job_id":"cab54816-d778-4dc6-8383-884b4a820fc0","html_url":"https://github.com/isarandi/openldap-check-pwquality","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/isarandi/openldap-check-pwquality","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/isarandi%2Fopenldap-check-pwquality","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/isarandi%2Fopenldap-check-pwquality/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/isarandi%2Fopenldap-check-pwquality/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/isarandi%2Fopenldap-check-pwquality/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/isarandi","download_url":"https://codeload.github.com/isarandi/openldap-check-pwquality/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/isarandi%2Fopenldap-check-pwquality/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266604008,"owners_count":23954725,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-23T02:00:09.312Z","response_time":66,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["openldap","openldap-server","openldap-slapd","password-policy","password-strength","pwquality"],"created_at":"2024-11-16T01:40:30.041Z","updated_at":"2025-07-23T02:04:20.502Z","avatar_url":"https://github.com/isarandi.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# OpenLDAP-check-pwquality\n\nThis is a small project to make [libpwquality](https://github.com/libpwquality/libpwquality) work as an OpenLDAP password policy module (`pwdCheckModule`).\n\nThe following installation instructions are for Ubuntu 18.04 LTS, but can be trivially adjusted to different distros.\n\nInstall some dependencies (assuming that OpenLDAP/slapd is already installed):\n\n```bash\nsudo apt install libpwquality-dev cracklib-runtime libdb-dev \n```\n\nWe need the OpenLDAP sources to compile our module. You can download the sources from the OpenLDAP website or use your package manager. On Ubuntu, enable the source packages in `/etc/apt/sources.list`, with e.g.\n\n```bash\necho 'deb-src http://de.archive.ubuntu.com/ubuntu/ bionic main restricted' | sudo tee -a /etc/apt/sources.list\n```\n\nGet the source package and `make` it. This requires the libdbd-dev (BerkeleyDB) package as well.\n\n```bash\ncd /tmp\napt-get source slapd\ncd openldap-2.4.45+dfsg/\n./configure\nmake depend\n```\n\nNow clone this repo and `make` the library as follows:\n\n```bash\ncd /tmp\ngit clone https://github.com/isarandi/openldap-check-pwquality.git\ncd openldap-check-pwquality\nsudo make install LDAP_SRC=/tmp/openldap-2.4.45+dfsg CONFIG_PATH=/etc/ldap/pwquality.conf LDAP_LIBDIR=/usr/lib/ldap\n```\n\nAt this point there should be a file `check_pwquality.so` under `/usr/lib/ldap` and you can simply add the attribute `pwdCheckModule: check_pwquality.so` to your LDAP password policy. How exactly this is done will depend on your particular LDAP layout. See [this blog post on Kifarunix](https://kifarunix.com/implement-openldap-password-policies/) for some guidance.\n\nNow, all that remains is to configure pwquality at the chosen config file path (`/etc/ldap/pwquality.conf` by default). See [`man pwquality.conf`](http://manpages.ubuntu.com/manpages/bionic/man5/pwquality.conf.5.html) for details on this. Since OpenLDAP is often run in a way that doesn't let it read files from just anywhere, make sure that your cracklib dictionary is readable to the LDAP server. In particular, it's best to place both the pwquality.conf file and the cracklib dictionary files under `/etc/ldap/` as well.\n\nYou can set up a beefy cracklib dictionary as follows:\n\n```bash\ncd /tmp\ngit clone https://github.com/cracklib/cracklib.git\ncd cracklib/words\nmake\nsudo cp cracklib-words /etc/cracklib/\nsudo sed -i 's/cracklib_dictpath_src=\"\"/cracklib_dictpath_src=\"\\/etc\\/cracklib\\/cracklib-words\"/' /etc/cracklib/cracklib.conf\nsudo update-cracklib\nsudo cp /var/cache/cracklib/cracklib_dict* /etc/ldap/\necho 'dictpath = /etc/ldap/cracklib_dict' | sudo tee -a /etc/ldap/pwquality.conf\n```\n\nAnd that's it!\n\n## General tips to avoid pitfalls with password policies\n\n- If you use [`ldapscripts`](https://github.com/martymac/ldapscripts), make sure to bind with something other than the root bind DN. The root bind DN bypasses all password policy checks, so `ldapadduser` will accept any password.\n- Make sure that the clients don't send pre-hashed passwords to the server when changing the password. Obviously the server needs the plaintext password to check its quality. This means, you better set up TLS as well, to avoid plaintext passwords flying around the network. (E.g. Ubuntu clients should NOT have lines in [`/etc/ldap.conf`](http://manpages.ubuntu.com/manpages/bionic/man5/ldap.conf.5.html) like `pam_password md5`. Either remove it or set it to `pam_password clear`).\n\n## Similar projects\n\nThere are other similar projects out there already:\n\n- [openldap-ppolicy-check-password](https://github.com/ltb-project/openldap-ppolicy-check-password)\n- [check-password](https://github.com/merces/check-password)\n- [BOFH OpenLDAP PPolicy pwdCheckModules](https://github.com/bindle/bofh-pwdCheckModules)\n- [pqchecker](https://bitbucket.org/ameddeb/pqchecker/)\n- [openldap-ppolicy-cracklib](https://github.com/Elizafox/openldap-ppolicy-cracklib)\n- [ppm](https://github.com/ltb-project/ppm)\n\nHowever, these are more limited in configuration options. The main point of this project is to harness the full power and configurability of libpwquality, by offloading all the password checking logic to its API.\n\n## References\n\n- https://www.openldap.org/\n- [man slapo-ppolicy](https://www.openldap.org/software/man.cgi?query=slapo-ppolicy)\n- https://github.com/libpwquality/libpwquality\n- https://github.com/cracklib/cracklib\n- https://ldapwiki.com/wiki/Draft-behera-ldap-password-policy\n- http://tutoriels.meddeb.net/openldap-password-policy-managing-users-accounts/\n- https://kb.brightcomputing.com/knowledge-base/how-do-i-define-a-password-policy-in-ldap/\n- https://ldapwiki.com/wiki/Password%20Strength\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fisarandi%2Fopenldap-check-pwquality","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fisarandi%2Fopenldap-check-pwquality","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fisarandi%2Fopenldap-check-pwquality/lists"}