Configuring The Password Policy - Netscape DIRECTORY SERVER 6.2 - ADMINISTRATOR Administrator's Manual

Managing the Password Policy
Once you have established a password policy, which can be for the entire
directory, or for specific subtrees or users, you can protect your user passwords
from potential threats by configuring an account lockout policy. Account
lockout protects against hackers who try to break into the directory by
repeatedly guessing a user's password.
This section provides information about configuring your password and account
lockout policies:
•

Configuring the Password Policy

• Setting User Passwords
• Configuring the Account Lockout Policy
• Managing the Password Policy in a Replicated Environment
For an overview on password policy, check Netscape Directory Server
Deployment Guide.
Configuring the Password Policy
The 6.2 release of Directory Server supports fine-grained password policy,
enabling you to define a policy that can be applied to the entire directory (global
password policy), a particular subtree (subtree level or local password policy), or
a particular user (user level or local password policy).
Essentially, your password policy is comprised of the following information:
The type or level of password policy checks. This information indicates
whether the server should check for and enforce a global password policy or
local (subtree/user level) password policies.
Password add and modify information. The password information includes
password syntax and password history details.
Bind information. The bind information includes the number of grace logins
permitted, password aging attributes, and tracking bind failures.
The sections that follow describe the procedures for configuring your password
policy:
• Configuring a Global Password Policy Using the Console
• Configuring a Subtree/User Password Policy Using the Console
• Configuring a Global Password Policy Using the Command-Line
266 Netscape Directory Server Administrator's Guide • December 2003