Inhaltsverzeichnis

Horde 5 Applikation Passwortänderungen: Passwd unter CentOS 7.x

Als nächste Applikation installieren wir uns die Anwendung Passwd. Diese Anwendung werden wir dazu nutzen, um über die Webapplikation Horde bei Bedarf unser Passwort zu ändern und auf dem mySQL-Datenbankbackendserver zu speichern. Informationen zu Installation und Konfiguration findet man auch auf der offiziellen Doku-Seite.

Installation

Die Installation der Applikation Passwd können wir ganz einfach über das Paketverwaltungswerkzeug yum vornehmen. 

 # yum install php-horde-passwd -y

Was uns das Paket php-horde-passwd alles mitgebracht hat zeigt uns der folgende Aufruf. 

 # rpm -qil php-horde-passwd
Name        : php-horde-passwd
Version     : 5.0.2
Release     : 1.el7
Architecture: noarch
Install Date: Thu 15 Jan 2015 11:17:21 PM CET
Group       : Development/Libraries
Size        : 430134
License     : GPLv2
Signature   : RSA/SHA256, Thu 11 Dec 2014 02:14:45 AM CET, Key ID 6a2faea2352c64e5
Source RPM  : php-horde-passwd-5.0.2-1.el7.src.rpm
Build Date  : Mon 08 Dec 2014 06:44:04 PM CET
Build Host  : buildvm-18.phx2.fedoraproject.org
Relocations : (not relocatable)
Packager    : Fedora Project
Vendor      : Fedora Project
URL         : http://www.horde.org/apps/passwd
Summary     : Horde password changing application
Description :
An application to change any user passwords stored in various backends like
SQL, LDAP, Kolab, passwd files etc.
/etc/horde/passwd
/etc/horde/passwd/backends.php
/etc/horde/passwd/conf.xml
/etc/horde/passwd/hooks.php.dist
/etc/httpd/conf.d/php-horde-passwd.conf
/usr/share/doc/pear/passwd
/usr/share/doc/pear/passwd/CHANGES
/usr/share/doc/pear/passwd/COPYING
/usr/share/doc/pear/passwd/CREDITS
/usr/share/doc/pear/passwd/INSTALL
/usr/share/doc/pear/passwd/README
/usr/share/doc/pear/passwd/RELEASE_NOTES
/usr/share/doc/pear/passwd/TODO
/usr/share/doc/pear/passwd/UPGRADING
/usr/share/horde/passwd
/usr/share/horde/passwd/config
/usr/share/horde/passwd/index.php
/usr/share/horde/passwd/js
/usr/share/horde/passwd/js/passwd.js
/usr/share/horde/passwd/lib
/usr/share/horde/passwd/lib/Application.php
/usr/share/horde/passwd/lib/Basic.php
/usr/share/horde/passwd/lib/Driver
/usr/share/horde/passwd/lib/Driver.php
/usr/share/horde/passwd/lib/Driver/Adsi.php
/usr/share/horde/passwd/lib/Driver/Composite.php
/usr/share/horde/passwd/lib/Driver/Expect.php
/usr/share/horde/passwd/lib/Driver/Expectpecl.php
/usr/share/horde/passwd/lib/Driver/Horde.php
/usr/share/horde/passwd/lib/Driver/Http.php
/usr/share/horde/passwd/lib/Driver/Kolab.php
/usr/share/horde/passwd/lib/Driver/Ldap.php
/usr/share/horde/passwd/lib/Driver/Null.php
/usr/share/horde/passwd/lib/Driver/Pine.php
/usr/share/horde/passwd/lib/Driver/Poppassd.php
/usr/share/horde/passwd/lib/Driver/Procopen.php
/usr/share/horde/passwd/lib/Driver/Pspasswd.php
/usr/share/horde/passwd/lib/Driver/Servuftp.php
/usr/share/horde/passwd/lib/Driver/Smbldap.php
/usr/share/horde/passwd/lib/Driver/Smbpasswd.php
/usr/share/horde/passwd/lib/Driver/Soap.php
/usr/share/horde/passwd/lib/Driver/Sql.php
/usr/share/horde/passwd/lib/Driver/Vmailmgr.php
/usr/share/horde/passwd/lib/Driver/Vpopmail.php
/usr/share/horde/passwd/lib/Exception.php
/usr/share/horde/passwd/lib/Factory
/usr/share/horde/passwd/lib/Factory/Driver.php
/usr/share/horde/passwd/lib/Test.php
/usr/share/horde/passwd/locale
/usr/share/horde/passwd/locale/ar
/usr/share/horde/passwd/locale/ar/LC_MESSAGES
/usr/share/horde/passwd/locale/ar/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/bg
/usr/share/horde/passwd/locale/bg/LC_MESSAGES
/usr/share/horde/passwd/locale/bg/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/ca
/usr/share/horde/passwd/locale/ca/LC_MESSAGES
/usr/share/horde/passwd/locale/ca/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/cs
/usr/share/horde/passwd/locale/cs/LC_MESSAGES
/usr/share/horde/passwd/locale/cs/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/da
/usr/share/horde/passwd/locale/da/LC_MESSAGES
/usr/share/horde/passwd/locale/da/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/de
/usr/share/horde/passwd/locale/de/LC_MESSAGES
/usr/share/horde/passwd/locale/de/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/de/help.xml
/usr/share/horde/passwd/locale/en
/usr/share/horde/passwd/locale/en/help.xml
/usr/share/horde/passwd/locale/es
/usr/share/horde/passwd/locale/es/LC_MESSAGES
/usr/share/horde/passwd/locale/es/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/es/help.xml
/usr/share/horde/passwd/locale/et
/usr/share/horde/passwd/locale/et/LC_MESSAGES
/usr/share/horde/passwd/locale/et/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/fa
/usr/share/horde/passwd/locale/fa/LC_MESSAGES
/usr/share/horde/passwd/locale/fa/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/fa/help.xml
/usr/share/horde/passwd/locale/fi
/usr/share/horde/passwd/locale/fi/LC_MESSAGES
/usr/share/horde/passwd/locale/fi/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/fi/help.xml
/usr/share/horde/passwd/locale/fr
/usr/share/horde/passwd/locale/fr/LC_MESSAGES
/usr/share/horde/passwd/locale/fr/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/gl
/usr/share/horde/passwd/locale/gl/LC_MESSAGES
/usr/share/horde/passwd/locale/gl/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/hr
/usr/share/horde/passwd/locale/hr/LC_MESSAGES
/usr/share/horde/passwd/locale/hr/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/hr/help.xml
/usr/share/horde/passwd/locale/hu
/usr/share/horde/passwd/locale/hu/LC_MESSAGES
/usr/share/horde/passwd/locale/hu/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/hu/help.xml
/usr/share/horde/passwd/locale/id
/usr/share/horde/passwd/locale/id/LC_MESSAGES
/usr/share/horde/passwd/locale/id/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/it
/usr/share/horde/passwd/locale/it/LC_MESSAGES
/usr/share/horde/passwd/locale/it/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/ja
/usr/share/horde/passwd/locale/ja/LC_MESSAGES
/usr/share/horde/passwd/locale/ja/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/lt
/usr/share/horde/passwd/locale/lt/LC_MESSAGES
/usr/share/horde/passwd/locale/lt/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/lv
/usr/share/horde/passwd/locale/lv/LC_MESSAGES
/usr/share/horde/passwd/locale/lv/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/lv/help.xml
/usr/share/horde/passwd/locale/nl
/usr/share/horde/passwd/locale/nl/LC_MESSAGES
/usr/share/horde/passwd/locale/nl/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/nl/help.xml
/usr/share/horde/passwd/locale/nn
/usr/share/horde/passwd/locale/nn/LC_MESSAGES
/usr/share/horde/passwd/locale/nn/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/pl
/usr/share/horde/passwd/locale/pl/LC_MESSAGES
/usr/share/horde/passwd/locale/pl/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/pt
/usr/share/horde/passwd/locale/pt/LC_MESSAGES
/usr/share/horde/passwd/locale/pt/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/pt_BR
/usr/share/horde/passwd/locale/pt_BR/LC_MESSAGES
/usr/share/horde/passwd/locale/pt_BR/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/ro
/usr/share/horde/passwd/locale/ro/LC_MESSAGES
/usr/share/horde/passwd/locale/ro/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/ru
/usr/share/horde/passwd/locale/ru/LC_MESSAGES
/usr/share/horde/passwd/locale/ru/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/ru/help.xml
/usr/share/horde/passwd/locale/sk
/usr/share/horde/passwd/locale/sk/LC_MESSAGES
/usr/share/horde/passwd/locale/sk/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/sl
/usr/share/horde/passwd/locale/sl/LC_MESSAGES
/usr/share/horde/passwd/locale/sl/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/sv
/usr/share/horde/passwd/locale/sv/LC_MESSAGES
/usr/share/horde/passwd/locale/sv/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/tr
/usr/share/horde/passwd/locale/tr/LC_MESSAGES
/usr/share/horde/passwd/locale/tr/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/zh_CN
/usr/share/horde/passwd/locale/zh_CN/LC_MESSAGES
/usr/share/horde/passwd/locale/zh_CN/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/locale/zh_TW
/usr/share/horde/passwd/locale/zh_TW/LC_MESSAGES
/usr/share/horde/passwd/locale/zh_TW/LC_MESSAGES/passwd.mo
/usr/share/horde/passwd/scripts
/usr/share/horde/passwd/scripts/passwd-expect
/usr/share/horde/passwd/scripts/passwd-expect-kerberos
/usr/share/horde/passwd/templates
/usr/share/horde/passwd/templates/index.html.php
/usr/share/horde/passwd/themes
/usr/share/horde/passwd/themes/default
/usr/share/horde/passwd/themes/default/graphics
/usr/share/horde/passwd/themes/default/graphics/favicon.ico
/usr/share/horde/passwd/themes/default/graphics/passwd.png
/usr/share/tests/pear/passwd
/usr/share/tests/pear/passwd/Passwd
/usr/share/tests/pear/passwd/Passwd/AllTests.php
/usr/share/tests/pear/passwd/Passwd/Autoload.php
/usr/share/tests/pear/passwd/Passwd/TestCase.php
/usr/share/tests/pear/passwd/Passwd/Unit
/usr/share/tests/pear/passwd/Passwd/Unit/Driver
/usr/share/tests/pear/passwd/Passwd/Unit/Driver/SqlTest.php
/usr/share/tests/pear/passwd/Passwd/Unit/Factory
/usr/share/tests/pear/passwd/Passwd/Unit/Factory/DriverTest.php
/usr/share/tests/pear/passwd/Passwd/bootstrap.php
/usr/share/tests/pear/passwd/Passwd/phpunit.xml
/var/lib/pear/pkgxml/php-horde-passwd.xml

Konfiguration

Backend-/IMAP-Server

Neben der Konfiguration der Anwendung selbst, müssen wir der Anwendung Passwd auch noch mitteilen, welches Backend-Modul es verwenden und welche Passwortanforderung es geben soll.

Die mitgelieferte Konfigurationsdatei backends.php lassen wir unangetastet. Die Konfiguration nehmen wir über die lokale Kopie backends.local.php vor. 

 # cp -a /etc/horde/passwd/backends.php /etc/horde/passwd/backends.local.php

Als erstes aktivieren wir den ersten Standardeintrag für das Horde Authentication Backend und definieren dann noch, welche policy also welche Anforderungen wir an das Passwort stellen. 

 # vim  /etc/horde/passwd/backends.local.php
/etc/horde/passwd/backends.local.php
<?php
/**
 * This file provides defaults for backends people use to change their
 * passwords.
 *
 * IMPORTANT: DO NOT EDIT THIS FILE!
 * Local overrides MUST be placed in backends.local.php or backends.d/.
 * If the 'vhosts' setting has been enabled in Horde's configuration, you can
 * use backends-servername.php.
 *
 * Properties that can be set for each server:
 * ===========================================
 *
 * disabled: (boolean) If true, the config entry is disabled.
 *
 * name: (string) This is the plaintext name displayed if using the server
 *       list (also displayed on the main page).
 *
 * driver: The driver used to change the password. Valid drivers:
 *     - adsi: ADSI COM interface.
 *     - expect: Expect script.
 *     - horde: Horde authentication driver.
 *     - ldap: LDAP server.
 *     - pine: Pine-encoded file.
 *     - poppassd: Poppassd server.
 *     - servuftp: Servuftp server.
 *     - smbldap: LDAP server for both LDAP -and- Samba auth.
 *     - smbpasswd: Smbpasswd command.
 *     - sql: SQL authentication.
 *     - vmailmgr: Local vmailmgr daemon.
 *     - vpopmail: SQL based vpopmail.
 *
 *     - composite: Allows you to chain multiple drivers together (see example
 *                  below).
 *
 * policy: (array) The password policies for this backend. You are responsible
 *   for the sanity checks of these options. Options are:
 *     - maxLength: (integer) Maximum length of the password.
 *     - maxSpace: (integer) Maximum number of white space characters.
 *     - minAlpha: (integer) Minimum number of alphabetic characters.
 *     - minAlphaNum: (integer) Minimum number of alphanumeric characters.
 *     - minLength: (integer) Minimum length of the password.
 *     - minLower: (integer) Minimum number of lowercase characters.
 *     - minNonAlpha: (integer) Minimum number of non-alphabetic characters
 *     - minNumeric: (integer) Minimum number of numeric characters (0-9).
 *     - minSymbol: (integer) Minimum number of punctuation / symbol characters.
 *     - minUpper: (integer) Minimum number of uppercase characters.
 *
 *   Alternatively/additionally, the minimum number of character classes can
 *   be configured by setting 'minClasses'. The valid range is 0 through 4
 *   character classes may be required for a password. The available classes:
 *     - lower
 *     - number
 *     - symbol
 *     - upper
 *
 *   For example: a password of 'p@ssw0rd' satisfies three classes ('number',
 *   'lower', and 'symbol'), while 'passw0rd' only satisfies two classes
 *   ('lower' and 'number').
 *
 * logout: (boolean) If true, this backend changes the password associated
 *         with at least one Horde application. On a successful password
 *         change the current session will be destroyed and the page will
 *         redirect to the login screen. You CANNOT continue to use Horde
 *         since the old password may be cached, which will cause errors.
 *
 * params: (array) Additional information that a driver needs. See examples
 *        below for further details.
 *
 * preferred: (string) Useful if you want to use the same backend.php file
 *            for different machines. If the hostname of the Passwd Machine is
 *            identical to one of those in the preferred list, then the
 *            corresponding option in the select box will include SELECTED,
 *            i.e. it is selected per default. Otherwise the first entry in
 *            the list is selected.
 */
 
/* Backend Hordeauth */
// Django : 2014-09-13
// default: 'disabled' => true,
$backends['hordeauth']['disabled'] = false;
$backends['hordeauth']['name'] = 'Horde Authentication';
$backends['hordeauth']['driver'] = 'Horde';
$backends['hordeauth']['policy']['minLength'] = 10;
$backends['hordeauth']['policy']['minNumeric'] = 2;
$backends['hordeauth']['logout']= true;

Applikation via WEB-GUI

Die Konfiguration der Applikation Passwd erfolgt dann über die GUI des Web-Frameworks. Dazu rufen wir unseren angelegten VHOST im Webbrowser auf. 

 $ firefox https://horde.sec-mail.guru/admin/config/

Bild: Bildschirmhardcopy Horde "Configuration"

Um zur Konfiguration von Passwd zu gelangen, klicken wir nun auf den Punkt Passwort (passwd).

Bild: Bildschirmhardcopy Horde "Configuration"

Auf dieser Seite erfolgt die Konfiguration der Horde-Applikation Passwd.

Backend Settings

$conf[backend][backend_list]                                                   [hidden]
$conf[user][change]                                                            [ ]
$conf[user][refused]                                                           root, bin, daemon, adm, lp, shutdown, halt, uucp, ftp, anonymous, nobody, httpd
$conf[password][strengthtests]                                                 [✔]

Am Ende unserer Konfigurationsarbeit sichern wir die Konfiguration mit einem Klick auf die Schaltfläche Bild: Schaltfläche "Passwort-Konfiguration erzeugen".

Bild: Bildschirmhardcopy Horde "Configuration"

Passwortänderung über die WEB-GUI

Unsere Mailboxnutzer haben nun die Möglichkeit über die Webanwendung Ihr Passwort zu ändern. Den betreffenden Menüpunkt Passwort für Horde Authentication ändern erreicht man die Änderungsmaske.

Bild: Schaltfläche "Passwort-Konfiguration erzeugen"

Zu Änderung ist neben dem alten Passwort, das neue 2x einzugeben.

Bild: Schaltfläche "Passwort-Konfiguration erzeugen"

Zum Abspeichern des neuen Passwortes klickt man dann auf die Schaltfläche Bild: Schaltfläche "Passwort ändern".

Links