Chapter 5. Configuring password policies

Procedure

1. Display the current settings:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy get
   Global Password Policy: cn=config
   ------------------------------------
   passwordstoragescheme: PBKDF2_SHA256
   passwordChange: on
   passwordMustChange: off
   passwordHistory: off
   passwordInHistory: 6
   ...

2. Adjust the password policy settings. For a full list of available settings, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy set --help

   For example, to enable password syntax checking and set the minimum length of passwords to 12 characters, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy set --pwdchecksyntax on --pwdmintokenlen 12

3. Enable the the account lockout feature for the password policy:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy set --pwdlockout on

Procedure

1. Open the Database Password Policies Global Policy menu.

2. Set the global password policy settings. You can set parameters in the following categories:

   • General settings, such as the password storage scheme
   • Password expiration settings, such as the time when a password expires
   • Account lockout settings, such as after how many failed login attempts an account should be locked

   • Password syntax settings, such as the minimum password length

     To display a tool tip and the corresponding attribute name in the cn=config entry for a parameter, hover the mouse cursor over the setting.

3. Click Save.

Procedure

1. Verify if a local password policy already exists for the subtree or user entry. For example:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp get "ou=People,dc=example,dc=com"
   Enter password for cn=Directory Manager on ldap://server.example.com:
   Error: No password policy was found for this entry

   If no local policy exists, create one:

   • To create a subtree password policy:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp addsubtree "ou=People,dc=example,dc=com"

   • To create a user password policy:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp adduser "uid=user_name,ou=People,dc=example,dc=com"

2. Set local policy attributes. For a full list of available settings, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp set --help

   For example, to enable password expiration and set the maximum password age to 14 days (1209600 seconds):

   • On a subtree password policy:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp set --pwdexpire on --pwdmaxage 1209600 "ou=People,dc=example,dc=com"

   • On a user password policy:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp set --pwdexpire on --pwdmaxage 1209600 "uid=user_name,ou=People,dc=example,dc=com"

Procedure

1. Select the instance.
2. Open the Database menu.
3. From the left list, select Local Policies under the Password Policies settings.
4. On the Local Password Policies configuration page, select the Create A Policy tab.
5. In the Password Policy Type field, select either Subtree Policy or User Policy.
6. In the Target DN field, set the distinguished name (DN) of the entry to apply the policy.

7. Set local policy attributes. For example, to enable password expiration, set the maximum password age to 14 days (1209600 seconds), and set the minimum password length to 10 characters:

   1. Expand Show Expiration Settings, check Enforce Password Expiration, and set Password Expiration Time to 1209600.
   2. Expand Show Syntax Settings, check Enable Password Syntax Checking, and set Minimum Length to 10.
8. Click Create New Policy.

Procedure

1. Select the instance.
2. Open the Database menu.

3. Disable all local policies or remove a particular local policy:

   1. To disable all local password policies:

      1. Select the Global Policy settings under Password Policies and uncheck Allow Local Password Policies.

      2. Click Save button to apply the configuration.

         With this, Directory Server sets the nsslapd-pwpolicy-local parameter in the cn=config entry to off.

   2. To remove a particular local policy, select Local Policies settings under Password Policies and delete the local policy by using the Options menu (⋮).

Procedure

1. Set the passwordTrackUpdateTime parameter to on:

   • For the global policy, run:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy set --pwdtrack on

   • For the subtree or user-level policy, run:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com localpwp set "ou=people,dc=example,dc=com" --pwdtrack on