Http://guodayong.blog.51cto.com/263451/d-2 Guo Dayong's Blog
1: Modify the configuration file
Open the comment in front moduleload Ppolicy.lamodulepath/usr/lib/openldapmodulepath/usr/lib64/openldap also precede the database config with these two paragraphs Access to Attrs=userpassword by self write by anonymous auth by dn= "cn=captain,dc=le,dc=com" write by * None access to * by dn= ' cn=captain,dc=le,dc=com ' write by * read at the end add
Overlay PpolicyPpolicy_default cn=captain,ou=policy,dc=le,dc=com 2: Rebuild the database and load SLAPDRm-rf/etc/openldap/slapd.d/*[[email protected] ~]# slaptest-f/etc/openldap/slapd.conf-f/etc/openldap/ Slapd.dconfig file testing Succeeded[[email protected] ~]# chown-r ldap.ldap/etc/openldap/*[[email protected] ~]# chown -R ldap.ldap/var/lib/ldap[[email protected] ~]#/ETC/INIT.D/SLAPD Restart 3: You can see that the ppolicy.la module is already loaded, and you can see that it's in there. 4: Edit Cat 1.ldif dn:ou=pwpolicies,dc=le,dc=comobjectclass:organizationalunitou:pwpolicies ldapadd-x-D "CN=CAPTAIN,DC =le,dc=com "-w-f 1.ldif added to see more from Phpldapadmin
Add Some property values for this cn=captain,ou=pwpolicies,dc=le,dc=com [[email protected] ~]# cat 2.ldif dn:cn=captain,ou=pwpolicies,dc=le,dc=comcn:captainobjectclass: PwdPolicyobjectClass:personpwdAllowUserChange:TRUEpwdAttribute:userPasswordpwdExpireWarning: 259200pwdfailurecountinterval:0pwdgraceauthnlimit:5pwdinhistory:5pwdlockout:truepwdlockoutduration: 300pwdmaxage:2592000pwdmaxfailure:5pwdminage:0pwdminlength:8pwdmustchange:truepwdsafemodify:truesn:dummy value& nbsp; then import: Ldapadd-x-D "cn=captain,dc=le,dc=com"-w-f 2.ldif then modifies the user's properties [[email protected] ~]# Cat modify.ldif dn:uid=test5,ou=people,dc=le,dc=comchangetype:modifyreplace:pwdresetpwdreset:true Ldapmodify-x-D "cn=captain,dc=le,dc=com"-w-f modify.ldif Import ldapwhoami-x-D UID=TEST5,OU=PEOPLE,DC=LE,DC =com-w-E ppolicy-v View policy information for TEST5 users then test: SSH [email protected], always error, not change: This is because the configuration file changed: this content does not use the LDAP correct form: If passwd cannot change the password, it is because, did not add, Samba is followed by the addition of Samba SambalmpassworD,sambantpassword access to attrs=userpassword by self write by Ano Nymous auth by dn= ' cn=captain,dc=le,dc=com ' write by * NONE ACC ESS to * by self write by dn= "Cn=captain,dc=le,dc=com" write & nbsp by * read
OpenLDAP, change password on login system
