search

joshua-d-miller / macOSLAPS

Swift binary that will change a local administrator password to a random generated password. Similar behavior to LAPS for Windows
MIT License
387 stars 58 forks source link

macOS 10.14 Mojave Unable to connect to local directory or change password #22

Closed irahodges closed 5 years ago

irahodges commented 6 years ago

When run with the -resetPassword flag, it updates the pw on the AD but not locally.

joshua-d-miller commented 6 years ago

Hi,

This may have something to do with TCC are you receiving any kind of error message?

Thanks!

401cf609a3a217ec commented 6 years ago

I am seeing the same issue on Mojave. It writes the new password to AD but doesn't change it locally.

From the macOSLAPS logs:

Info|Tue Oct 30, 2018 01:51:11 PM|macOSLAPS|Password Change is required as the LAPS password for admin has expired Info|Tue Oct 30, 2018 01:51:11 PM|macOSLAPS|Password change has been completed for local admin admin. New expiration date is Mon Jan 28, 2019 01:51:11 PM Error|Tue Oct 30, 2018 01:51:11 PM|macOSLAPS|Unable to connect to local directory or change password. Exiting...

From the system logs:

2018-10-30 13:51:11.281293-0700 localhost sudo[17557]: username : TTY=ttys000 ; PWD=/Users/username ; USER=root ; COMMAND=/usr/local/laps/macOSLAPS -resetPassword 2018-10-30 13:51:11.296512-0700 localhost macOSLAPS[17558]: (CFOpenDirectory) Created Activity ID: 0x38080, Description: Open a given node 2018-10-30 13:51:11.298147-0700 localhost macOSLAPS[17558]: (CFOpenDirectory) Created Activity ID: 0x38081, Description: Querying records from directories 2018-10-30 13:51:11.306372-0700 localhost macOSLAPS[17558]: (CFOpenDirectory) Created Activity ID: 0x38082, Description: Open a given node 2018-10-30 13:51:11.306835-0700 localhost macOSLAPS[17558]: (CFOpenDirectory) Created Activity ID: 0x38083, Description: Retrieve record from node 2018-10-30 13:51:11.306836-0700 localhost macOSLAPS[17558]: (CFOpenDirectory) Created Activity ID: 0x38084, Parent ID: 0x8000000000038083, Description: Querying records from directories 2018-10-30 13:51:11.308062-0700 localhost macOSLAPS[17558]: (CFOpenDirectory) Created Activity ID: 0x38085, Description: Set value of an attribute 2018-10-30 13:51:11.312416-0700 localhost macOSLAPS[17558]: (CFOpenDirectory) Created Activity ID: 0x38086, Description: Set value of an attribute 2018-10-30 13:51:11.317303-0700 localhost macOSLAPS[17558]: (CFOpenDirectory) Created Activity ID: 0x38087, Description: Change password for record 2018-10-30 13:51:11.317612-0700 localhost opendirectoryd[99]: Created Activity ID: 0x37fa8, Parent ID: 0x8000000000038087, Description: Internal request 2018-10-30 13:51:11.319480-0700 localhost opendirectoryd[99]: (PlistFile) [com.apple.opendirectoryd:auth] Change password failed with ODErrorRecordPermissionError 2018-10-30 13:51:11.319612-0700 localhost opendirectoryd[99]: [com.apple.opendirectoryd:session] ODRecordChangePassword failed with result ODErrorRecordPermissionError 2018-10-30 13:51:11.321701-0700 localhost macOSLAPS[17558]: (CFOpenDirectory) Created Activity ID: 0x38088, Description: Closing a node reference 2018-10-30 13:51:11.323156-0700 localhost opendirectoryd[99]: Created Activity ID: 0x37fa9, Description: Internal request 2018-10-30 13:51:11.932729-0700 localhost opendirectoryd[99]: Created Activity ID: 0x37faa, Description: Kernel Request 2018-10-30 13:51:11.933300-0700 localhost opendirectoryd[99]: Created Activity ID: 0x37fab, Description: Kernel Request

mpdonovan commented 6 years ago

I am seeing the same issue when the user is created with sysadminctl. I have a policy in Jamf that creates the user and installs the client that user works fine. Both are on 10.14.

ghost commented 6 years ago

Just curious, has there been any resolution that has worked for the local password change with Mojave clients? I am seeing the same thing in our logs.

Info|Mon Oct 15, 2018 04:18:18 PM|macOSLAPS|Password Change is required as the LAPS password for localadmin has expired Info|Mon Oct 15, 2018 04:18:18 PM|macOSLAPS|Password change has been completed for local admin localadmin. New expiration date is Wed Nov 14, 2018 04:18:18 PM Error|Mon Oct 15, 2018 04:18:18 PM|macOSLAPS|Unable to connect to local directory or change password. Exiting...

ghost commented 6 years ago

Just an update. And apologies if this is incorrect but I modified the PWChange file to print out the unexpected error and received the following:

Unexpected error: Error Domain=com.apple.OpenDirectory Code=4001 "Operation was denied because the current credentials do not have the appropriate privileges." UserInfo={NSLocalizedDescription=Operation was denied because the current credentials do not have the appropriate privileges., NSLocalizedFailureReason=Operation was denied because the current credentials do not have the appropriate privileges.}.

joshua-d-miller commented 6 years ago

@Sbacon2 Are you running macOSLAPS as the root user or an admin user that can make changes to the local directory?

strydub commented 6 years ago

I have the same issue and I'm logged in as the root user. Plus the file edu.psu.macoslaps.plist doesn't exist in /Library/Preferences/. Do you have any suggestion of what it can be done to resolve the issue?

jkeller13 commented 6 years ago

Just an FYI there is an issue that has been submitted to Apple related to this. (It applies to changes in 10.14) If you disable the secure token for the user, the password change works locally. With the secure token enabled, it fails to reset password due to 'not having appropriate privileges'. There is a PI with Jamf and an issue submitted with Apple as this is most likely not expected behavior on Apple's side.

ghost commented 6 years ago

@joshua-d-miller I have tested running it as both root and an admin user with the same results.

ghost commented 6 years ago

@jkeller13 Do you have anymore information on this submission? Perhaps a link?

jkeller13 commented 6 years ago

@Sbacon2 I don't have a link because I did not file the bug in Apple's Radar system

joshua-d-miller commented 6 years ago

Ah, that would make a lot of sense. Our local admin user doesn't have a secure token and that would be why I can't replicate this issue. So it sounds like that this will be addressed in a later version of macOS I'm assuming and it not expected behavior (At least not at this time). I'll leave this open and have you test when the next version fo 10.14 comes out and hopefully the radar was fulfilled.

joshua-d-miller commented 5 years ago

One thing @bartreardon and I kind of figured out was the account created via MDM through DEP could not change the password however if the account was created via something like pycreateuserpkg or just on the system it worked fine. Please see if this is the issue for you and let me know.

Thanks!

pmex commented 5 years ago

I'm not using macOSLAPS, yet, so I can't give you any log output from your code. However, if your user has a secure toke (typically when created through DEP enrolment) it can't have its password changed with sysadminctl -resetPasswordFor username. A user without a secure token (typically created by scripts/pkg) can have its password reset that way, though.

To be able to continuously change an admin password with SecureToken you probably need to find a way to store the password locally (which I totally understand that you want to avoid as long as possible).

I hope this helps

rg717 commented 5 years ago

Hi, we are running into the same issue "Unable to connect to local directory or change password.". We are using Mojave and DEP.

Is there any update? Or do you have any information when we can expect a solution for that problem?

joshua-d-miller commented 5 years ago

Hi,

The way I see it is we are going to have to figure out a way to store the current LAPS password on the system as we will not be able to read it from Active Directory. We will need to figure out how to store it securely as this is a security vulnerability and if the password was found it could be used in a bad way. Since secureToken accounts (Admin accounts created with DEP) require us to know the old password, we will need to perform this. I'm currently evaluating the best possible way to do this and will update everyone if I find a way that is best.

Thanks for your patience!

Edwinterb commented 5 years ago

Thanks for persisting with this @joshua-d-miller . I really want to use this on our systems, but unfortunately we FileVault encrypt all our devices so this SecureToken issue is annoying to say the least! Looking forward to any developments you make.

joshua-d-miller commented 5 years ago

Hello everyone,

Please try the latest build and let me know if it resolves the issues.

Thanks!

Edwinterb commented 5 years ago

hi @joshua-d-miller, I did some quick testing today, and it worked very well. Thanks for the fix, I'll report back if I see any issues in further tests.

irahodges commented 5 years ago

Same here! It is working in both 10.14.2 and 10.14.3. On first password attempt I get the message: "Nothing was retrieved from the keychain. Status code -25300". But it works as expected and subsequent password changes work as well!

Also if run from a local user account that doesn't have the permissions to write to the specified log file, the password get's changed locally, but not saved in keychain or reported to AD and the command hangs.

joshua-d-miller commented 5 years ago

I'm glad things are working. I also took care of that status message when loading the keychain entry. It should no longer display. Please try the latest build and let me know.

joshua-d-miller commented 5 years ago

I'm going to call this issue closed now since we determined that DEP accounts with secureToken were the issue and this has since been resolved.

cbruce2 commented 5 years ago

Hi, Can your code be implemented using JAMF Pro? I've never worked with .swift files.

bartreardon commented 5 years ago

Hi, Can your code be implemented using JAMF Pro? I've never worked with .swift files.

There's a script that implements LAPS in jamf here https://github.com/ducksrfr/LAPSforMac/blob/master/LAPS.sh

jamf pro already does password randomisation for their admin account - there are a couple of FR's out there asking to expose it in the interface (e.g. https://www.jamf.com/jamf-nation/feature-requests/7901/jamf-managment-account-password-retrieval)

that said - writing back to jamf from this version is something I've been interested in looking at as well (if I ever get the time to play with it 😜 )

cbruce2 commented 5 years ago

Hi, I am using the LAPS.sh script that you mentioned above and it works flawlessly if there is a password stored in the JSS already. This is a new build and it errors out as seen below because it does not find a password stored. Is there a method to get past this and store a password in the JSS, so your script can randomize it?

Script result: XXXXX is a local user on the ComputerJAMF Binary is /usr/local/bin/jamf No Password is stored in LAPS. ======== Aborting LAPS Update ========

Error running script: return code was 1.