Hi all,
we are faced with strange issue (started in last 4-5months; tried to fix it ourselves - didn't worked):
our password policy require password change every 90 days... As soon as it reaches period (passwordExpirationTime) no one can log-in
until DM changes password (and thus resets passwordExpirationTime attribute).
So, how we can fix that (tried to search forums and Net, but no luck)?
Info:
$ uname -rosv
Linux 2.6.18-400.el5.028stab117.2 #1 SMP Wed Dec 17 17:19:54 MSK 2014 GNU/Linux
$ cat /etc/redhat-release
CentOS release 5.11 (Final)
$ rpm -qa | grep 389 | sort
389-admin-1.1.29-1.el5
389-admin-console-1.1.8-1.el5
389-admin-console-doc-1.1.8-1.el5
389-adminutil-1.1.20-1.el5
389-console-1.1.7-3.el5
389-ds-1.2.1-1.el5
389-ds-base-1.2.11.32-1.el5
389-ds-base-libs-1.2.11.32-1.el5
389-ds-console-1.2.6-1.el5
389-ds-console-doc-1.2.6-1.el5
389-dsgw-1.1.11-1.el5
[All 389 packages are installed from EPEL repository; SSLv3 disabled; only secure port is in use]
Our (in house) solution for password expiry notification is to get user's details from LDAP export (LDIF) file:
script greps for some attribute values from 'ou=People' and from 'cn=nsPwPolicyEntry' section for user and then check
passwordExpirationTime and passwordWarning attribute values and decide if e-mail to user has to be send in advance...
As soon as passwordExpirationTime value is reached, e.g. 20150201103158Z user is not able to authenticate against LDAP.
Case I have missed some existing solution, can someone point to it, or to any other suitable solution.
Thank you
Regards.
--
Predrag Zečević, Technical Support Analyst, 2e Systems GmbH
Telephone: +49 6196 9505 815, Facsimile: +49 6196 9505 894
Mobile: +49 174 3109 288, Skype: predrag.zecevic
E-mail: predrag.zecevic@xxxxxxxxxxxxxx
Headquarter: 2e Systems GmbH, Königsteiner Str. 87,
65812 Bad Soden am Taunus, Germany
Company registration: Amtsgericht Königstein (Germany), HRB 7303
Managing director: Phil Douglas
http://www.2e-systems.com/ - Making your business fly!
[***]===---
"Rembrandt's first name was Beauregard, which is why he never used it." -- Dave Barry
--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users
