Emmanuel Dreyfus
2015-11-06 08:55:34 UTC
Content preview: Hello It seems OTP was broken at some time, I wonder if it
is just me (and why), or if it is more genral. I have a user with: cmusaslsecretOTP:
sha1 0499 se2124 xxxxxxxxxxxxxxxx 00000000 slapd.conf contains: access to
dn.regex="^uid=.+,dc=example,dc=net$" attrs=cmusaslsecretOTP by anonymous
auth stop by self write stop by * none stop [...]
Content analysis details: (-4.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium
trust
[149.20.53.66 listed in list.dnswl.org]
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: netbsd.org]
0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
Hello
It seems OTP was broken at some time, I wonder if it is just me (and why),
or if it is more genral. I have a user with:
cmusaslsecretOTP: sha1 0499 se2124 xxxxxxxxxxxxxxxx 00000000
slapd.conf contains:
access to dn.regex="^uid=.+,dc=example,dc=net$" attrs=cmusaslsecretOTP
by anonymous auth stop
by self write stop
by * none stop
I try:
$ ldapwhomai -Y OTP -X dn:${user_dn}
SASL/OTP authentication started
(delay)
ldap_sasl_interactive_bind_s: Server is unavailable (52)
additional info: SASL(-8): transient failure (e.g., weak key): simultaneous OTP authentications not permitted
This is:
OpenLDAP 2.4.42
Cyrusl SASL 2.1.26
While there, this uses sha1. Is there some new specs about doing
it with sha256? Patching cyrus-sasl to add a new hashing algorithme
is just a one liner.
is just me (and why), or if it is more genral. I have a user with: cmusaslsecretOTP:
sha1 0499 se2124 xxxxxxxxxxxxxxxx 00000000 slapd.conf contains: access to
dn.regex="^uid=.+,dc=example,dc=net$" attrs=cmusaslsecretOTP by anonymous
auth stop by self write stop by * none stop [...]
Content analysis details: (-4.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium
trust
[149.20.53.66 listed in list.dnswl.org]
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: netbsd.org]
0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
Hello
It seems OTP was broken at some time, I wonder if it is just me (and why),
or if it is more genral. I have a user with:
cmusaslsecretOTP: sha1 0499 se2124 xxxxxxxxxxxxxxxx 00000000
slapd.conf contains:
access to dn.regex="^uid=.+,dc=example,dc=net$" attrs=cmusaslsecretOTP
by anonymous auth stop
by self write stop
by * none stop
I try:
$ ldapwhomai -Y OTP -X dn:${user_dn}
SASL/OTP authentication started
(delay)
ldap_sasl_interactive_bind_s: Server is unavailable (52)
additional info: SASL(-8): transient failure (e.g., weak key): simultaneous OTP authentications not permitted
This is:
OpenLDAP 2.4.42
Cyrusl SASL 2.1.26
While there, this uses sha1. Is there some new specs about doing
it with sha256? Patching cyrus-sasl to add a new hashing algorithme
is just a one liner.
--
Emmanuel Dreyfus
***@netbsd.org
Emmanuel Dreyfus
***@netbsd.org