Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 268 / 578

Managing the Password Policy
268 Netscape Directory Server Administrator’s Guide • August 2002
Setting User Passwords
An entry can be used to bind to the directory only if it has a
userpassword
attribute and if it has not been inactivated. Because user passwords are stored in
the directory, you can use whatever LDAP operation you normally use to update
the directory to set or reset the user passwords.
passwordHistory
This attribute indicates whether the directory stores a password history.
When set to on, the directory stores the number of passwords you specify
in the
passwordInHistory
attribute in a history. If a user attempts to
reuse one of the password, the password will be rejected.
When you set this attribute to
off
, any passwords stored in the history
remain there. When you set this attribute back to
on
, users will not be able
to reuse the passwords recorded in the history before you disabled the
attribute.
This attribute is
off
by default, meaning users can reuse old passwords.
passwordInHistory
This attribute indicates the number of passwords the directory stores in the
history. You can store from 2 to 24 passwords in the history. This feature is
not enabled unless the
passwordHistory
attribute is set to
on
.
This attribute is set to 6 by default.
passwordStorageScheme
This attribute specifies the type of encryption used to store Directory Server
passwords. The following encryption types are supported by Directory
Server:
•
SSHA
(Salted Secure Hash Algorithm). This method is recommends as it
is the most secure. This is the default method.
•
SHA
( Secure Hash Algorithm). A one-way hash algorithm that is the
default encryption schema in Directory Server 4.x.
•
crypt.
The UNIX crypt algorithm, provided for compatibility with
UNIX passwords.
•
clear
. This encryption type indicates that the password will appear in
plain text.
Note that passwords stored using crypt, SHA, or SSHA formats cannot be
used for secure login through SASL Digest MD5.
If you want to provide your own customized storage scheme, consult
Netscape Professional Services.
Table 7-1
Password Policy Attributes (Continued)
Attribute Name Definition