In the Directory Server Console, select the Configuration tab and then the Data node.

In the right pane, select the Passwords tab.

This tab contains the password policy for the entire Directory Server.

Check the Enable fine-grained password policy checkbox. Enabling the password policy makes the other sections on the screen active.

To require users to change their password the first time they log on, select the User must change password after reset checkbox. If this checkbox is selected, only the Directory Manager is authorized to reset the user's password. A regular administrative user cannot force the users to update their password.

To allow users to change their own passwords, select the User may change password checkbox.

To prevent users from changing their password for a specific duration, enter the number of days in the Allow changes in X day(s) text box.

For the server to maintain a history list of passwords used by each user, select the Keep password history checkbox. Enter the number of passwords for the server to keep for each user in the Remember X passwords text box.

If user passwords should not expire, select the Password never expires radio button.

To require users to change their passwords periodically, select the Password expires after X days radio button, and then enter the number of days that a user password is valid.

The maximum value for the password age is derived by subtracting January 18, 2038, from today's date. The entered value must not be set to the maximum value or too close to the maximum value. Setting the value to the maximum value can cause the Directory Server to fail to start because the number of seconds will go past the epoch date. In such an event, the error log will indicate that the password maximum age is invalid. To resolve this problem, correct the passwordMaxAge attribute value in the dse.ldif file.

A common policy is to have passwords expire every 30 to 90 days. By default, the password maximum age is set to 8640000 seconds (100 days).

If the Password expire after X days radio button is selected, specify how long before the password expires to send a warning to the user. In the Send Warning X Days Before Password Expires text enter the number of days before password expiration to send a warning.

For the server to check the syntax of a user password to make sure it meets the minimum requirements set by the password policy, select the Check Password Syntax checkbox. Then, specify required password complexity, such as the minimum length and required number of numeric and special characters. The password syntax requirements are described more in Table 7.1, “Password Policy Attributes”.

From the Password Encryption pull-down menu, select the encryption method for the server to use when storing passwords.

For detailed information about the encryption methods, refer to the passwordStorageScheme attribute in Table 7.1, “Password Policy Attributes”.

The Password Encryption menu might contain other encryption methods, as the directory dynamically creates the menu depending upon the existing encryption methods it finds in the directory.

Click Save.

Enable fine-grained password policy globally.

Create the local password policy for the subtree or user.

Add the required attributes to the subtree or user entries by running the ns-newpwpolicy.pl script.

The command syntax for the script is as follows:

ns-newpwpolicy.pl [-D rootDN] { -w password | -w - | -j filename }[-p port] [-h host] 
     -U userDN -S suffixDN

For updating a subtree entry, use the -S option. For updating a user entry, use the -U option. The ns-newpwpolicy.pl script accepts only one user or subtree entry at a time. It can, however, accept both user and suffix entries at the same time. For details about the script, see the Directory Server Configuration, Command, and File Reference.

The script adds the required attributes depending on whether the target entry is a subtree or user entry.

For a subtree (for example, ou=people, dc=example, dc=com), the following entries are added:

For a user (for example, uid=jdoe, ou=people, dc=example, dc=com), the following entries are added:

Assign the value of the above entry DN to the pwdpolicysubentry attribute of the target entry. For example, this assigns the password policy to the user entry:

dn: uid=jdoe,ou=people,dc=example,dc=com 
changetype: modify 
replace: pwdpolicysubentry 
pwdpolicysubentry: "cn=nsPwPolicyEntry,uid=jdoe,ou=people,dc=example,dc=com",
     cn=nsPwPolicyContainer,ou=people,dc=example,dc=com

Set the password policy attributes of subtree or user entry with the appropriate values.

Table 7.1, “Password Policy Attributes” describes the attributes available to configure the password policy. The ldapmodify utility can be used to change these attributes in the cn=config entry.

Stop the server. ^[7]

service dirsrv stop instance

Open the dse.ldif file in a text editor.

Set the value of nsslapd-pwpolicy-local to off, and save.

nsslapd-pwpolicy-local: off

Start the server.

service dirsrv start instance

Select the Configuration tab and then the Data node.

In the right pane, select the Account Lockout tab.

To enable account lockout, select the Accounts may be locked out checkbox.

Enter the maximum number of allowed bind failures in the Lockout account after X login failures text box. The server locks out users who exceed the limit specified here.

In the Reset failure counter after X minutes text box, enter the number of minutes for the server to wait before resetting the bind failure counter to zero.

Set the interval for users to be locked out of the directory.

Click Save.