CentOS7安装OpenLdap设置默认的策略

策略明细

# default_ppolicy.ldif
dn: cn=default,ou=People,dc=ethnicity,dc=com
cn: default
objectClass: pwdPolicy
objectClass: person
objectClass: top
pwdAttribute: 2.5.4.35   //切记这里写版本号码不要按照网上的userPassword
pwdMinAge: 0
pwdMaxAge: 7776000
pwdInHistory: 5
pwdCheckQuality: 0
pwdMinLength: 5
pwdExpireWarning: 6480000
pwdGraceAuthNLimit: 5
pwdLockout: TRUE
pwdLockoutDuration: 300
pwdMaxFailure: 5
pwdFailureCountInterval: 30
pwdMustChange: FALSE
pwdAllowUserChange: TRUE
pwdSafeModify: FALSE
sn: dummy value
添加即可

ldapadd -x -D'cn=Manager,dc=ethnicity,dc=com' -W -H ldapi:/// -f default_ppolicy.ldif

添加默认策略的用户，这个可以根据具体情况调整

dn: uid=wulei,ou=People,dc=ethnicity,dc=com
objectClass: inetOrgPerson
uid: wulei
cn: wu lei
sn: lei
mail: wulei@gdy.com
pwdPolicySubentry: cn=default,ou=People,dc=ethnicity,dc=com
ldapadd -x -D'cn=Manager,dc=ethnicity,dc=com' -W -H ldapi:/// -f abc.ldif

# cat  /etc/openldap/slapd.conf
modulepath /usr/lib/openldap
modulepath /usr/lib64/openldap
moduleload ppolicy.la
overlay ppolicy
ppolicy_default cn=default,ou=People,dc=ethnicity,dc=com
ppolicy_hash_cleartext
ppolicy_use_lockout

标签：cn,default,ppolicy,dc,默认,CentOS7,OpenLdap,com,ethnicity
来源： https://blog.csdn.net/ethnicitybeta/article/details/122415994