Jakub,

 

Thanks for the quick response, to answer your question I am using the built-in password policy features of 389-ds that allows us to use these features:

 

Maximum Number of Failures

Password Change After Reset

User-Defined Passwords

Password Expiration

Expiration Warning

Grace Login Limit

Password Syntax Checking

Password Length

Password Minimum Age

Password History

Password Storage Schemes

Password Last Change Time

 

Here is a sanitized version of ldap.conf that is used in our current environment:

 

===========================================================================

 

host ldap1 ldap2

URI ldap://ldap1:389 ldap://ldap2:389

 

base dc=some,dc=company,dc=com

#bind_timelimit 5

#>>

bind_timelimit 3

bind_policy soft

timelimit 3

#^^

ldap_version 3

 

pam_lookup_policy yes

pam_filter objectclass=posixAccount

pam_password md5

 

nss_base_passwd ou=People,dc=some,dc=company,dc=com?one

nss_base_passwd ou=Disabled Users,dc=some,dc=company,dc=com?one

nss_base_shadow ou=People,dc=some,dc=company,dc=com?one

nss_base_group  ou=Groups,dc=some,dc=company,dc=com?one?|(host=\2A)(host=osd)

#>>

nss_initgroups_ignoreusers root,ldap

#^^

 

ssl start_tls

#ssl on

tls_cacertdir /etc/openldap/cacerts

 

===========================================================================

 

Thanks,
Daniel Bright