diff --git a/README.md b/README.md index 98081bd..c30061a 100644 --- a/README.md +++ b/README.md @@ -640,12 +640,27 @@ changetype: modify add: pwdCheckQuality pwdCheckQuality: 2 ``` -Execute the .ldif file... +Execute the update_policy_quality.ldif file... ``` root@example:/# ldapmodify -x -H ldap:/// -D "cn=admin,dc=example,dc=com" -w 1234 -f update_policy_quality.ldif modifying entry "cn=default,ou=policies,dc=example,dc=com" ``` -We need to specify who we want to apply this new policy (change it from how it was by default before), let's use the user reimu +While we are setting up the password complexity level, we can learn how to set the password minimum length since it's similar: +``` +root@example:/# vim update_policy_minlength.ldif +dn: cn=default,ou=policies,dc=example,dc=com +changetype: modify +replace: pwdMinLength +pwdMinLength: 10 +``` +The attribute pwdMinLength being the password minimum characters. +Now execute the update_policy_minlength.ldif file... +``` +root@example:/# ldapmodify -x -H ldap:/// -D "cn=admin,dc=example,dc=com" -w 1234 -f update_policy_minlength.ldif +modifying entry "cn=default,ou=policies,dc=example,dc=com" +``` + + Now let's try changing the password to one too easy, _newreimupass_ being the user's password and _weak_ the newpassword: ``` root@example:/# # ldappasswd -x -H ldap:/// -D "uid=reimu,ou=Supergirls,dc=example,dc=com" -w newreimupass -s weak "uid=reimu,ou=Supergirls,dc=example,dc=com" Result: Constraint violation (19) ``` We get an "Constraint violation" error, meaning the new password did not comply with the minimum requirements, and since we setup the pwdPolicyQuality to 2, it got rejected. + +Let's try changing the password to one too short, _reimupass_ being the user's password, to _reimu_ being the newpassword: +``` +root@example:/etc/ldap/slapd.d# ldappasswd -x -H ldap:/// -D "uid=reimu,ou=Supergirls,dc=example,dc=com" -w reimupass -s reimu "uid=reimu,ou=Supergirls,dc=example,dc=com" +Result: Constraint violation (19) +``` +We get again a "Constraint violation" error, the new password did not comply with the minimum requirements, this time the pwdMinLength being 10 as we defined in update_policy_minlength.ldif. + \ Note that getting a constraint violation while trying to change a password, **does not add a pwdFailureTime attribute entry to the user**, as if we would try to do something with the user, like changing some attribute, using the wrong original password. + ## _Show Organizational Units, users, and attributes_ ### _Show LDAP server directories with the data_