(baseDN string, conn *ldap.Conn)
| 9 | ) |
| 10 | |
| 11 | func GetPwdPolicy(baseDN string, conn *ldap.Conn) (queryResult string) { |
| 12 | query := ("(objectClass=domainDNS)") |
| 13 | searchReq := Globals.LdapSearch(baseDN, query) |
| 14 | |
| 15 | result, err := conn.Search(searchReq) |
| 16 | if err != nil { |
| 17 | fmt.Printf("Query error, %s", err) |
| 18 | } |
| 19 | |
| 20 | if len(result.Entries) > 0 { |
| 21 | for domainDNSResult := range result.Entries { |
| 22 | minPwdLength := result.Entries[domainDNSResult].GetAttributeValue("minPwdLength") |
| 23 | pwdHistoryLength := result.Entries[domainDNSResult].GetAttributeValue("pwdHistoryLength") |
| 24 | maxPwdAge := result.Entries[domainDNSResult].GetAttributeValue("maxPwdAge") |
| 25 | minPwdAge := result.Entries[domainDNSResult].GetAttributeValue("minPwdAge") |
| 26 | lockoutThreshold := result.Entries[domainDNSResult].GetAttributeValue("lockoutThreshold") |
| 27 | lockoutDuration := result.Entries[domainDNSResult].GetAttributeValue("lockoutDuration") |
| 28 | lockOutObservationWindow := result.Entries[domainDNSResult].GetAttributeValue("lockOutObservationWindow") |
| 29 | pwdProperties := result.Entries[domainDNSResult].GetAttributeValue("pwdProperties") |
| 30 | pwdPropertiesResolved := getPwdProperties(pwdProperties) |
| 31 | //https://ldapwiki.com/wiki/PwdProperties#:~:text=PwdProperties%20attribute%20specifies%20an%20unsigned,Account%20Policies%5CPassword%20Policy%20folder. |
| 32 | |
| 33 | queryResult = fmt.Sprintf("\nMinimum Password Length: \t%s\n", minPwdLength) |
| 34 | queryResult += fmt.Sprintf("Password History Length: \t%s\n", pwdHistoryLength) |
| 35 | queryResult += fmt.Sprintf("Lockout Threshold: \t%s\n", lockoutThreshold) |
| 36 | |
| 37 | //check if lockout duration is 0 (until admin unlock ) |
| 38 | if lockoutDuration == "-9223372036854775808" { |
| 39 | queryResult += ("Lockout Duration: \tUntil Admin Unlock\n") |
| 40 | } else { |
| 41 | queryResult += fmt.Sprintf("Lockout Duration: \t%.0f\tminutes\n", Globals.ConvertToMinutes(lockoutDuration)) |
| 42 | } |
| 43 | |
| 44 | //check if min password age is None |
| 45 | queryResult += fmt.Sprintf("Reset Account Lockout Counter: \t%.0f\tminutes\n", Globals.ConvertToMinutes(lockOutObservationWindow)) |
| 46 | if minPwdAge == "0" { |
| 47 | queryResult += "Minimum Password Age: \tNone\n" |
| 48 | } else { |
| 49 | queryResult += fmt.Sprintf("Minimum Password Age: \t%.0f\tday(s)\n", Globals.ConvertToMinutes(minPwdAge)/60/24) |
| 50 | } |
| 51 | |
| 52 | queryResult += fmt.Sprintf("Maximum Password Age: \t%.0f\tday(s)\n", Globals.ConvertToMinutes(maxPwdAge)/60/24) |
| 53 | queryResult += fmt.Sprintf("\t\nPassword Complexity: \t%s", pwdPropertiesResolved) |
| 54 | } |
| 55 | } |
| 56 | return |
| 57 | } |
| 58 | |
| 59 | func getPwdProperties(pwdProperties string) (result string) { |
| 60 | pwdPropertiesInt, _ := strconv.Atoi(pwdProperties) |
no test coverage detected