Expiration Warning; Password Syntax Checking; Password Length - Netscape DIRECTORY SERVER 6.02 - DEPLOYMENT Deployment Manual

The server remembers the password expiration even if you turn the password
expiration feature off. This means that if you turn the password expiration option
back on, passwords are valid only for the duration you set before you last disabled
the feature. For example, suppose you set up passwords to expire every 90 days
and then decided to disable password expiration. When you decide to re-enable
password expiration, the default password expiration duration is 90 days because
that is what you had it set to before you disabled the feature.
By default, user passwords never expire.

Expiration Warning

If you choose to set your password policy so that user passwords expire after a
given number of days, it is a good idea to send users a warning before their
passwords expire. You can set your policy so that users are sent a warning 1 to
24,855 days before their passwords expire. The Directory Server displays the
warning when the user binds to the server. If password expiration is turned on, by
default, a warning is sent (via LDAP message) to the user one day before the user's
password expires, provided the user's client application supports this feature.

Password Syntax Checking

The password policy establishes some syntax guidelines for password strings, such
as the minimum password length guideline. The password syntax-checking
mechanism ensures that the password strings conform to the password syntax
guidelines established by the password policy. Also, the password syntax-checking
mechanism also ensures that the password is not a "trivial" word. A trivial word is
any value stored in the
entry.
By default, password syntax checking is turned off.

Password Length

The Directory Server allows you to specify a minimum length for user passwords.
In general, shorter passwords are easier to crack. You can require passwords that
are from 2 to 512 characters. A good length for passwords is 8 characters. This is
long enough to be difficult to crack, but short enough that users can remember the
password without writing it down.
By default, no minimum password length is set.
, , ,
uid cn sn givenName
Designing a Password Policy
, , or attribute of the user's
ou mail
Chapter 7 Designing a Secure Directory 131