Configuring Subtree/User Password Policy Using The Command-Line - Red Hat DIRECTORY SERVER 7.1 - ADMINISTRATOR Administrator's Manual

Managing the Password Policy
Password Policy Attributes (Continued)
Table 7-1
Attribute Name
passwordHistory
passwordInHistory
passwordStorageScheme

Configuring Subtree/User Password Policy Using the Command-Line

To configure a subtree or user level password policy:
286 Red Hat Directory Server Administrator's Guide • May 2005
Definition
This attribute indicates whether the directory stores a password history.
When set to on, the directory stores the number of passwords you specify
in the passwordInHistory attribute in a history. If a user attempts to
reuse one of the passwords, the password will be rejected.
When you set this attribute to off, any passwords stored in the history
remain there. When you set this attribute back to on, users will not be able
to reuse the passwords recorded in the history before you disabled the
attribute.
This attribute is off by default, meaning users can reuse old passwords.
This attribute indicates the number of passwords the directory stores in the
history. You can store from 2 to 24 passwords in the history. This feature is
not enabled unless the passwordHistory attribute is set to on.
This attribute is set to 6 by default.
This attribute specifies the type of encryption used to store Directory Server
passwords. The following encryption types are supported by Directory
Server:
• SSHA (Salted Secure Hash Algorithm). This method is recommended as
it is the most secure. This is the default method.
• SHA ( Secure Hash Algorithm). A one-way hash algorithm; it is
supported only forbackwards compatibility with Directory Server 4.x
and should not be used otherwise.
• crypt. The UNIX crypt algorithm, provided for compatibility with
UNIX passwords.
• clear. This encryption type indicates that the password will appear in
plain text.
Passwords stored using crypt, SHA, or SSHA formats cannot be used for
secure login through SASL Digest MD5.
If you want to provide your own customized storage scheme, consult Red
Hat Professional Services.