User manual REDHAT NETSCAPE DIRECTORY SERVER 6.1 ADMINISTRATOR

[. . . ] Administrator's Guide Netscape Directory Server Version 6. 1 August 2002 Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed by the license agreement for the Software and applicable copyright law. Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is prohibited and constitutes a punishable violation of the law. [. . . ] A value of zero indicates that the user can change the password immediately. The default value of this attribute is 0. Chapter 7 User Account Management 267 Managing the Password Policy Table 7-1 Password Policy Attributes (Continued) Definition Attribute Name passwordHistory This attribute indicates whether the directory stores a password history. When set to on, the directory stores the number of passwords you specify in the passwordInHistory attribute in a history. If a user attempts to reuse one of the password, the password will be rejected. When you set this attribute to off, any passwords stored in the history remain there. When you set this attribute back to on, users will not be able to reuse the passwords recorded in the history before you disabled the attribute. This attribute is off by default, meaning users can reuse old passwords. passwordInHistory This attribute indicates the number of passwords the directory stores in the history. You can store from 2 to 24 passwords in the history. This feature is not enabled unless the passwordHistory attribute is set to on. This attribute is set to 6 by default. passwordStorageScheme This attribute specifies the type of encryption used to store Directory Server passwords. The following encryption types are supported by Directory Server: · SSHA (Salted Secure Hash Algorithm). This method is recommends as it is the most secure. A one-way hash algorithm that is the default encryption schema in Directory Server 4. x. · crypt. The UNIX crypt algorithm, provided for compatibility with UNIX passwords. This encryption type indicates that the password will appear in plain text. Note that passwords stored using crypt, SHA, or SSHA formats cannot be used for secure login through SASL Digest MD5. If you want to provide your own customized storage scheme, consult Netscape Professional Services. Setting User Passwords An entry can be used to bind to the directory only if it has a userpassword attribute and if it has not been inactivated. Because user passwords are stored in the directory, you can use whatever LDAP operation you normally use to update the directory to set or reset the user passwords. 268 Netscape Directory Server Administrator's Guide · August 2002 Managing the Password Policy For information on creating and modifying directory entries, see Chapter 2, "Creating Directory Entries. " For information on inactivating user accounts, refer to"Inactivating Users and Roles, " on page 272. You can also use the Users and Groups area of the Netscape Administration Server or the Directory Server Gateway to set or reset user passwords. For information on how to use the Users and Groups area, see the online help that is available in the Netscape Administration Server. For information on how to use the Gateway to create or modify directory entries, see the online help that is available in the Gateway. Configuring the Account Lockout Policy The lockout policy works in conjunction with the password policy to provide further security. The account lockout feature protects against hackers who try to break into the directory by repeatedly trying to guess a user's password. [. . . ] DES is an example of a symmetric encryption algorithm. Cannot be deleted or modified as it is essential to Directory Server target In the context of access control, the target identifies the directory information to which a particular ACI applies. target entry The entries within the scope of a CoS. TCP/IP Transmission Control Protocol/Internet Protocol. The main network protocol for the Internet and for enterprise (company) networks. [. . . ]