Red Hat DIRECTORY SERVER 8.0, Руководство администратора

Страница: 239 / 552

Managing the Password Policy in a Replicated Environment
221
Attribute Name Definition
the number of failures specified by the
passwordMaxFailure
attribute. The account
is locked out for the interval specified in the
passwordLockoutDuration
attribute, after
which time the failure counter is reset to zero
(
0
). Because the counter's purpose is to gauge
when a hacker is trying to gain access to the
system, the counter must continue for a period
long enough to detect a hacker. However, if
the counter were to increment indefinitely over
days and weeks, valid users might be locked out
inadvertently. The reset password failure count
attribute is set
600
seconds by default.
Table 7.3. Account Lockout Policy Attributes
7.1.5. Managing the Password Policy in a Replicated Environment
Password and account lockout policies are enforced in a replicated environment as follows:
• Password policies are enforced on the data master.
• Account lockout is enforced on all servers participating in replication.
Some of the password policy information in the directory is replicated:
•
passwordMinAge
and
passwordMaxAge
•
passwordExp
•
passwordWarning
However, the configuration information is kept locally and is not replicated. This information includes
the password syntax and the history of password modifications. Account lockout counters and tiers are
not replicated, either.
When configuring a password policy in a replicated environment, consider the following points:
• Warnings from the server of an impending password expiration will be issued by all replicas. This
information is kept locally on each server, so if a user binds to several replicas in turn, they will be
issued the same warning several times. In addition, if the user changes the password, it may take
time for this information to filter to the replicas. If a user changes a password and then immediately
rebinds, he may find that the bind fails until the replica registers the changes.
• The same bind behavior should occur on all servers, including suppliers and replicas. Make sure to
create the same password policy configuration information on each server.
• Account lockout counters may not work as expected in a multi-mastered environment.
• Entries that are created for replication (for example, the server identities) need to have passwords
that never expire. To make sure that these special users have passwords that do not expire, add the
passwordExpirationTime
attribute to the entry, and give it a value of
20380119031407Z
(the
top of the valid range).