Chapter 5. Configuring password policies

Procedure

1. Display the current settings:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy get
   Global Password Policy: cn=config
   ------------------------------------
   passwordstoragescheme: PBKDF2_SHA256
   passwordChange: on
   passwordMustChange: off
   passwordHistory: off
   passwordInHistory: 6
   ...

2. Adjust the password policy settings. For a full list of available settings, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy set --help

   For example, to enable password syntax checking and set the minimum length of passwords to 12 characters, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy set --pwdchecksyntax on --pwdmintokenlen 12

3. Enable the the account lockout feature for the password policy:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy set --pwdlockout on

Procedure

1. Open the Database Password Policies Global Policy menu.

2. Set the global password policy settings. You can set parameters in the following categories:

   • General settings, such as the password storage scheme
   • Password expiration settings, such as the time when a password expires
   • Account lockout settings, such as after how many failed login attempts an account should be locked

   • Password syntax settings, such as the minimum password length

     To display a tool tip and the corresponding attribute name in the cn=config entry for a parameter, hover the mouse cursor over the setting.

3. Click Save.

Procedure

1. Verify if a local password policy already exists for the subtree or user entry. For example:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp get "ou=People,dc=example,dc=com"
   Enter password for cn=Directory Manager on ldap://server.example.com:
   Error: No password policy was found for this entry

   If no local policy exists, create one:

   • To create a subtree password policy:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp addsubtree "ou=People,dc=example,dc=com"

   • To create a user password policy:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp adduser "uid=user_name,ou=People,dc=example,dc=com"

2. Set local policy attributes. For a full list of available settings, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp set --help

   For example, to enable password expiration and set the maximum password age to 14 days (1209600 seconds):

   • On a subtree password policy:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp set --pwdexpire on --pwdmaxage 1209600 "ou=People,dc=example,dc=com"

   • On a user password policy:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp set --pwdexpire on --pwdmaxage 1209600 "uid=user_name,ou=People,dc=example,dc=com"

Procedure

1. Set the passwordTrackUpdateTime parameter to on:

   • For the global policy, run:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy set --pwdtrack on

   • For the subtree or user-level policy, run:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp set "ou=people,dc=example,dc=com" --pwdtrack on