Red Hat DIRECTORY SERVER 8.0, Руководство администратора

Страница: 237 / 552

Configuring the Account Lockout Policy
219
ldappasswd -h ldap.example.com -p 389 -ZZ -D "uid=jsmith,ou=People,dc=example,dc=com"
-w rootpassword -s newpassword
To change the password on an entry other than the one specified in the bind credentials, run
ldappasswd
as shown below, adding the
user
DN to the operation and providing separate
credentials, as follows:
ldappasswd -h server.example.com -p 389 -ZZ -D "cn=Directory Manager"
-w rootpassword -s newpassword "uid=jsmith,ou=People,dc=example,dc=com"
Access control is enforced for the password change operation. If the bind DN does not have rights to
change the specified password, the operation will fail with an
Insufficient rights
error.
7.1.4. Configuring the Account Lockout Policy
The lockout policy works in conjunction with the password policy to provide further security. The
account lockout feature protects against hackers who try to break into the directory by repeatedly
trying to guess a user's password. The password policy can be set so that a specific user is locked out
of the directory after a given number of failed attempts to bind.
Configuring the account lockout policy is described in the following sections:
•
Section 7.1.4.1, “Configuring the Account Lockout Policy Using the Console”
•
Section 7.1.4.2, “Configuring the Account Lockout Policy Using the Command-Line”
7.1.4.1. Configuring the Account Lockout Policy Using the Console
To set up or modify the account lockout policy for the Directory Server, do the following:
1. Select the
Configuration
tab and then the
Data
node.
2. In the right pane, select the
Account Lockout
tab.
3. To enable account lockout, select the Accounts may be locked out
checkbox.
4. Enter the maximum number of allowed bind failures in the Lockout account after X login
failures
text box. The server locks out users who exceed the limit specified here.
5. In the
Reset failure counter after X minutes
text box, enter the number of minutes for the server
to wait before resetting the bind failure counter to zero.
6. Set the interval for users to be locked out of the directory.
• Select the
Lockout Forever
radio button to lock users out until their passwords have been reset
by the administrator.
• Set a specific lockout period by selecting the
Lockout Duration
radio button and entering the
time (in minutes) in the text box.
7. Click
Save
.