On Tue, 2018-01-16 at 23:22 +0000, Mitch Patenaude wrote:
So the problems were
1) I needed to set 'passwordUnlock: on' even though that's supposed
to be the default value
2) In 'cn=config' I needed to set 'passwordIsGlobalPolicy: on' on
every server to enable replication of lockout params.
I wonder if either of these are bugs. Mark?
Thanks to Kevin Kelly for pointing me in the right direction. The
relevant documentation can be found here:
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Serve
r/8.2/html/Administration_Guide/Managing_the_Password_Policy-
Configuring_the_Account_Lockout_Policy.html
-- Mitch
On 1/16/18, 1:44 PM, "Mitch Patenaude" <mpatenaude(a)shutterfly.com>
wrote:
I'm trying to implement account lockouts for <n> failed login
attempts in a multi-master environment.
I used something like the following ldif to enable to lockouts:
dn:
cn="cn=nsPwPolicyEntry,ou=people,dc=example,dc=com",cn=nsPwPolicyCont
ainer,ou=people,dc=example,dc=com
changetype: modify
add: passwordLockout
passwordLockout: on
-
add: passwordMaxFailure
passwordMaxFailure: 5
-
add: passwordResetFailureCount
passwordResetFailureCount: 1800
-
add: passwordLockoutDuration
passwordLockoutDuration: 1800
It works (kind of), but there are 2 problems:
1) Even though the passwordLockoutDuration is only 30 minutes, it
locks the user out indefinitely (i.e. accountUnlockTime:
19700101000000Z)
2) The accountUnlockTime attribute doesn't get replicated, so the
user is only locked out of 1 of the 4 master servers.
Any idea what I am doing wrong?
Thanks,
-- Mitch Patenaude mpatenaude(a)shutterfly.com systems
engineer
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproje
ct.org
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.o
rg
--
Sincerely,
William Brown
Software Engineer
Red Hat, Australia/Brisbane