[389-users] Re: Account lockout error code/message differences for correct and incorrect password

On Mon, 2017-07-31 at 12:51 +1000, William Brown wrote:
> On Fri, 2017-07-28 at 18:49 +0000, albert.luo@uwindsor.ca wrote:
> > Hi,
> >
> > I am doing some experiements with account lockout password policy. The account is locked out after many wrong password tries.
> >
> > Then
> > If bind with correct password, the result is
> > #<OpenStruct extended_response=nil, code=19, error_message="Exceed password retry limit. Please try later.", matched_dn="", message="Constraint Violation">
> >
> > if bind with wrong password, the result is
> > #<OpenStruct extended_response=nil, code=49, error_message="", matched_dn="", message="Invalid Credentials">
> >
> > So attacker can still continue to try/guess different passwords until he get the result of : code=19, error_message="Exceed password retry limit. Please try later.".
> >
>
>
> When you say "account lockout" you are referring to the setting:
>
> dn: cn=config
> passwordMaxFailure: 4
> passwordLockoutDuration: 600
>
> Correct?
>
> If so this may be a security issue. Please confirm the settings you are
> referring to here,

Ahh, indeed. I can produce this issue:

ldapwhoami -H ldap://localhost -x -D 'uid=testuser,dc=example,dc=com' -w
password
dn: uid=testuser,dc=example,dc=com

Bind with invalid credentials a number of times to trigger the lockout:

ldapwhoami -H ldap://localhost -x -D 'uid=testuser,dc=example,dc=com' -w
passworda
ldap_bind: Invalid credentials (49)

Then bind with valid crendentials while the lockout is in effect:

ldapwhoami -H ldap://localhost -x -D 'uid=testuser,dc=example,dc=com' -w
password
ldap_bind: Constraint violation (19)
additional info: Exceed password retry limit. Please try later.

You are correct that this is likely a security issue as it allows an
attacker to bypass the rate limit and account lockout mechanism.

I will report this and have it dealt with appropriately.

Thanks for your report,

--
Sincerely,

William Brown
Software Engineer
Red Hat, Australia/Brisbane