Red Hat DIRECTORY SERVER 7.1, Руководство администратора, Страница: 282 / 652

Managing the Password Policy
282 Red Hat Directory Server Administrator’s Guide • May 2005
8.
If you want users to change their passwords periodically, select the
“Password expires after X days” radio button, and then enter the number of
days that a user password is valid.
The maximum value for the password age is derived by subtracting January
18, 2038, from today’s date. The value you enter must not be set to the
maximum value or too close to the maximum value. If you set the value to the
maximum value, Directory Server may fail to start because the number of
seconds will go past the epoch date. In such an event, the error log will
indicate that the password maximum age is invalid. To resolve this problem,
you must correct the
passwordMaxAge
attribute value in the
dse.ldif
file.
A common policy is to have passwords expire every 30 to 90 days. By default,
the password maximum age is set to
8640000
seconds (100 days).
9.
If you have selected the “Password expire after X days” radio button, you
need to specify how long before the password expires to send a warning to
the user. In the “Send Warning X Days Before Password Expires” text enter
the number of days before password expiration to send a warning.
10.
If you want the server to check the syntax of a user password to make sure it
meets the minimum requirements set by the password policy, select the
“Check Password Syntax” checkbox. Then, specify the minimum acceptable
password length in the “Password Minimum Length” text box.
11.
From the “Password Encryption” pull-down menu, select the encryption
method you want the server to use when storing passwords.
For detailed information about the encryption methods, refer to the
passwordStorageScheme
attribute in Table 7-1, on page 283.
The Password Encryption menu might contain other encryption methods, as
the directory dynamically creates the menu depending upon the existing
encryption methods it finds in your directory.
12.
When you have finished making changes to the password policy, click Save.
Configuring a Subtree/User Password Policy Using the Console
To set up the password policy for a subtree or user, you need to add the required
entries and attributes at the subtree or user level, set the appropriate values to the
password policy attributes, and enable fine-grained password policy checking.
1.
Enable fine-grained password policy.
a.
In the Directory Server Console, select the Configuration tab.
b.
In the navigation tree, select the Data node.