Using Password Policy one can achieve

a. Password Expiration
b. Before Expiration User gets warning to change the password

Step1. Enable policy Overlay, It can be done by installing the schema.

Shell
1$ ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif

For Verification, whether it is done or not

Shell
1$ ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=schema,cn=config dn

Step2. We need to write to the directory where are all policies will be filename: policies_1.ldif

dn : ou = Policies , dc = ktree , dc = org
objectClass : top
objectClass : organizationalUnit
ou : Policies
description : policies come here

To apply to the directory  :

Shell
1$ ldapadd -D cn=admin,dc=ktree,dc=org -W -f policies_1.ldif

Step3. Now, We load the Modules handling the policies.

Plain text
1filename: policy_module.ldif
2dn : cn = module { 0 }, cn = config
3changetype : modify
4add : olcModuleLoad
5olcModuleLoad : ppolicy
Shell
1To apply to the directory :
2$ ldapadd -Y EXTERNAL -H ldapi:/// -f policy_module.ldif
Shell
1For verification, modules loaded?
2$ ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=module{0},cn=config

Step4. Now tell directory where to look for the policies.

filename: policy_overlay.ldif

Plain text
1dn : olcOverlay ={ 0 } ppolicy , olcDatabase ={ 1 } hdb , cn = config
2objectClass : olcOverlayConfig
3objectClass : olcPPolicyConfig
4olcOverlay : { 0 } ppolicy
5olcPPolicyDefault : cn = DefaultPPolicy , ou = Policies , dc = ktree , dc = org
Shell
1To apply to the directory
2$ ldapadd -Y EXTERNAL -H ldapi:/// -f policy_overlay.ldif
Shell
1For Verification, Overlays in use
2$ ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b olcDatabase={1}hdb,cn=config

Step5. Now we can create default policy objects.

filename: Default_Policies.ldiif

Plain text
1dn : cn = DefaultPPolicy , ou = Policies , dc = ktree , dc = org
2cn : DefaultPPolicy
3objectClass : pwdPolicy
4objectClass : device
5objectClass : top
6pwdAttribute : userPassword
7pwdMaxAge : 2592000
8pwdExpireWarning : 2160000
9pwdInHistory : 3
10pwdCheckQuality : 1
11pwdMinLength : 8
12pwdMaxFailure : 3
13pwdLockout : TRUE
14pwdLockoutDuration : 30
15pwdGraceAuthNLimit : 0
16pwdFailureCountInterval : 0
17pwdMustChange : TRUE
18pwdAllowUserChange : TRUE
19pwdSafeModify : FALSE

Note : Here pwdExpireAge, object tells us when to expire. It takes input in seconds. Here it is for 30 days. pwdExpireWarning gives tells us when to issue warning before password expiry i.e 25 days.

Shell
1To apply to the directory
2$ ldapadd -D cn=admin,dc=ktree,dc=org -W -f Default_Policies.ldif
Shell
1For Verification
2$ ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=DefaultPPolicy,ou=Policies,dc=ktree,dc=or

Testing

Choose an account from the directory, suppose

Plain text
1dn: uid=user1,ou=People,dc=ktree,dc=org

A. Now to check expiration date, modify timestamp before a month

Plain text
1filename: change_timestamp.ldif
2dn : uid = user1, ou = People, dc = ktree, dc = org
3changetype : modify
4replace : pwdChangedTime
5pwdChangedTime : 20150110192853Z

Note:Here syntax for pwdChanedTime: (YYYYMMDDHHMMSST)
T stands for time zone (GMT)

  • To apply to the directory
Shell
1$ ldapmodify -D cn=admin,dc=ktree,dc=org -W -e relax -f change_timestamp.ldif
  • For verification check with by login in with uid=user1
Shell
1$ ldapwhoami -e ppolicy -x -D uid=user1,ou=People,dc=ktree,dc=org -W
  • It will not allow you to login

B. To check for the password warning, put time stamp between (25th day to 30th day). and repeat the same steps, now it will throw a message saying “Password expires in somanyseconds” and allows you to login