0

我正在使用 OpenLDAP 和客户端浏览器作为 Apache 目录工作室。我做了任何需要对 openLDAP 用户执行 ppolicies 的操作，我仍然认为它缺少一些东西和一些软件。这是我的 ppolicy.ldif

       dn: dc=maxcrc,dc=com
       objectClass: top
       objectClass: domain
       dc: maxcrc

        dn: ou=People,dc=maxcrc,dc=com
       objectClass: organizationalUnit
       objectClass: top
       ou: People
       description: Container for user entries



      dn: ou=policies,dc=maxcrc,dc=com
      objectClass: top
      objectClass: organizationalUnit
      ou: policies

      dn: cn=default,ou=policies,dc=maxcrc,dc=com
      objectClass: pwdPolicy
      objectClass: top
      objectClass: device
      cn: default
      pwdAttribute: userPassword
      pwdAllowUserChange: TRUE
      pwdCheckQuality: 1
      pwdExpireWarning: 86400
      pwdInHistory: 6
      pwdLockout: TRUE
      pwdLockoutDuration: 1920
      pwdMaxAge: 172800
      pwdMaxFailure: 4
      pwdMinLength: 6
      pwdSafeModify: FALSE

      dn: uid=jery,dc=maxcrc,dc=com
      objectClass: pwdPolicy
      objectClass: posixAccount
      objectClass: top
      objectClass: account
      cn: maxcrc jery
      gidNumber: 1011
      homeDirectory: /home/jery
        pwdAttribute: userPassword
      uid: jery
    uidNumber: 1011
    pwdPolicySubentry:cn=strong,ou=policies,dc=maxcrc,dc=com      



      dn: cn=strong,ou=policies,dc=maxcrc,dc=com
     objectClass: device
     objectClass: top
      objectClass: pwdPolicy
      cn: strong
      pwdAttribute: userPassword
      pwdMaxAge: 1296000
     pwdMinLength: 4

它仍然允许从 apache directory studio 添加超过 4 个字符的 userPassword。谁能告诉我为什么会这样？提前致谢 。

下面是我的 sldap.config 文件

    # BDB Backend configuration file
    # See slapd.conf(5) for details on configuration options.
    # This file should NOT be world readable.
     ucdata-path    ./ucdata
     include        ./schema/core.schema
      include       ./schema/cosine.schema
     include        ./schema/nis.schema
      include       ./schema/inetorgperson.schema
       include      ./schema/openldap.schema
          include       ./schema/dyngroup.schema
          include       ./schema/ppolicy.schema

            moduleload      ppolicy.la
            moduleload      syncprov.la
            moduleload back_bdb.la
            moduleload back_ldap.la
             pidfile        ./run/slapd.pid
                argsfile    ./run/slapd.args
                   # Enable TLS if port is defined for ldaps


             TLSVerifyClient never
               TLSCipherSuite HIGH:MEDIUM:-SSLv2
            TLSCertificateFile ./secure/certs/server.pem
            TLSCertificateKeyFile ./secure/certs/server.pem
            TLSCACertificateFile ./secure/certs/server.pem

               #######################################################################
           # bdb database definitions
           #######################################################################
             database   monitor

            database    bdb
            suffix      "dc=maxcrc,dc=com"

             # invokes password policies for this DIT only
             overlay    ppolicy

             # Default ppolicy
                ppolicy_default "cn=strong,ou=policies,dc=maxcrc,dc=com"

            # Some ppolicy directives

             ppolicy_use_lockout
                ppolicy_hash_cleartext


           # ACL1


       #access to attrs=userPassword
       #      by self       write
       #    by anonymous  auth
        #   by group.exact="cn=Manager,dc=maxcrc,dc=com"
        #                 write
       #   by *          none
       # ACL3
  #access to *
     #    by self       write
       #   by group.exact="cn=Manager,dc=maxcrc,dc=com"
         #                write
       #   by users      read
     #   by *          none





          rootdn        "cn=Manager,dc=maxcrc,dc=com"
        # Cleartext passwords, especially for the rootdn, should
         # be avoid.  See slappasswd(8) and slapd.conf(5) for details.
          # Use of strong authentication encouraged.
            rootpw    secret



     # The database directory MUST exist prior to running slapd AND
       # should only be accessible by the slapd and slap tools.
       # Mode 700 recommended.
           directory ./data
          dirtyread
           searchstack 20
       # Indices to maintain
           index mail pres,eq
          index objectclass pres
       index default eq,sub
      index sn eq,sub,subinitial
       index telephonenumber
      index cn
4

1 回答 1

1

密码策略覆盖要求您不要以 rootDN 身份执行操作。您应该使用在 DIT 中定义的具有适当权限的管理员登录。

于 2013-10-26T08:49:18.723 回答