Re: password not expire 389

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 02/28/2017 02:25 AM, tuan88@xxxxxxxxx wrote:
h
passwordHistory is not set in your policy config, thus it is not beingen forced:
yes it is, i had set it the last many years
pls see the screendump in my first thread
But you are using subtree policies, these override the global policy.  You need set to passwordHistory in your subtree policy:
dn: cn=cn\3DnsPwPolicyEntry\2Cou\3DInfrastructure\2Cdc\3Dnnit,cn=nsPwPolicyContainer,ou=Infrastructure,dc=nnit
passwordStorageScheme: ssha
passwordGraceLimit: 1
passwordChange: on
passwordWarning: 86400
passwordMinAge: 0
passwordExp: on
passwordMustChange: on
passwordMaxAge: 86400
objectClass: ldapsubentry
objectClass: passwordpolicy
objectClass: top
cn: cn=nsPwPolicyEntry,ou=Infrastructure,dc=nnit
passwordHistory: 12

Also it looks like the passwords were never reset by the actual user.  Hence the passwordExpirationtime is still set to the EPOCH date. 

Note - the Directory Manager account completely bypasses password policy.  So if you change the password as directory manager it will let you do whatever you want.  So make sure you always change passwords as a "database user" if you expect password policies to be enforced.

This is why client applications should NEVER use directory manager - it is an unrestricted account.

Policy settings from GUI:
www.chezmoi.dk/389-passwd-not-expire.png

bt Tuan
_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx

_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx

[Index of Archives]     [Fedora User Discussion]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora News]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora QA]     [Fedora Triage]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Yosemite Photos]     [Linux Apps]     [Maemo Users]     [Gnome Users]     [KDE Users]     [Fedora Tools]     [Fedora Art]     [Fedora Docs]     [Maemo Users]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Fedora ARM]

  Powered by Linux