Red Hat DIRECTORY SERVER 8.0, Administration Manual

Page: 306 / 552

Chapter 8. Managing Replication
288
Variable Definition
consumer_hostname
Hostname of the current consumer.
consumer_portnumber
LDAP port in use on the consumer.
Table 8.4. Replicate_Now Variables
For the update operation to occur over an SSL connection, modify the
ldapmodify
command in
the script with the appropriate parameters and values. For more information on the
ldapmodify
command, see
Section 2.2, “Managing Entries from the Command-Line”
and the
Directory Server
Configuration, Command, and File Reference
.
8.12. Replicating Account Lockout Attributes
Account lockout policies will block a user ID from being able to access the Directory Server if the login
attempt fails a set number of times. This prevents hackers or other malicious people from illegitimately
accessing the Directory Server by guessing a password. Password policies are set locally, and
generally account lockout attributes are local to each replica. This means that a person can attempt to
log in to one replica until the account lockout count is reached, then try again immediately on another
replica. The way to prevent that is to replicate the attributes related to the account lockout counts
for an entry, so that the malicious user is locked out of every supplier and consumer replica in the
configuration if a login attempt fails on a single master.
By default, three password policy attributes are not replicated, even if other password attributes are.
These attributes are related to of login failures and lockout periods:
•
passwordRetryCount
•
retryCountResetTime
•
accountUnlockTime
8.12.1. Configuring Directory Server to Replicate Password Policy
Attributes
A special core configuration attribute controls whether password policy operational attributes are
replicated. This is the
passwordIsGlobalPolicy
attribute, which is enabled in the consumer
Directory Server configuration to allow the consumer to accept password policy operational attributes.
By default, this attribute is set to
off
.
To enable these attributes to be replicated, change the
passwordIsGlobalPolicy
configuration
attribute on the consumer:
ldapmodify -h consumer1.example.com -p 389 -D "cn=directory manager" -w password
dn: cn=config
changetype: modify
replace: passwordIsGlobalPolicy
passwordIsGlobalPolicy: on
Changing that value to
on
allows the
passwordRetryCount
,
retryCountResetTime
, and
accountUnlockTime
to be replicated. No other configuration is necessary for the attributes to be
included with the replicated attributes.