第 14 章 配置基于密码的帐户锁定策略

验证

1. 显示 passwordmaxfailure 设置的值：

   # dsconf -D "cn=Directory Manager" ldap://server.example.com pwpolicy get passwordmaxfailure
   passwordmaxfailure: 2

   Copy to Clipboard Toggle word wrap

2. 尝试绑定使用无效密码的时间超过 passwordmaxfailure 中设置的值：

   # ldapsearch -H ldap://server.example.com -D "uid=example,ou=People,dc=example,dc=com" -w invalid-password -b "dc=example,dc=com" -x
   ldap_bind: Invalid credentials (49)
   
   # ldapsearch -H ldap://server.example.com -D "uid=example,ou=People,dc=example,dc=com" -w invalid-password -b "dc=example,dc=com" -x
   ldap_bind: Invalid credentials (49)
   
   # ldapsearch -H ldap://server.example.com -D "uid=example,ou=People,dc=example,dc=com" -w invalid-password -b "dc=example,dc=com" -x
   ldap_bind: Constraint violation (19)
   	additional info: Exceed password retry limit. Please try later.

   Copy to Clipboard Toggle word wrap

   禁用旧密码后，目录服务器会在第二次尝试后锁定帐户，并进一步尝试使用 ldap_bind: Constraint violation (19) ）错误。