Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Shouldn't it be enough to execute the following? Or do I need to do anything special to my users, like adding or having a specific objectClass or something?

ldapadd -H ldaps://ldap.syco.net -x -D "cn=admin,cn=config" -w secret << EOF
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap/
olcModuleLoad: ppolicy.la

dn: ou=pwpolicies,dc=syco,dc=net
objectClass: organizationalUnit
objectClass: top
ou: policies

dn: cn=default,ou=pwpolicies,dc=syco,dc=net
cn: default
objectClass: pwdPolicyChecker
objectClass: pwdPolicy
objectClass: person
objectClass: top
pwdAllowUserChange: TRUE
pwdCheckModule: crackcheck.so
pwdCheckQuality: 2
pwdExpireWarning: 604800
pwdFailureCountInterval: 30
pwdGraceAuthNLimit: 0
pwdInHistory: 10
pwdLockout: TRUE
pwdLockoutDuration: 3600
pwdMaxAge: 7776000
pwdMaxFailure: 5
pwdMinAge: 3600
pwdMinLength: 12
pwdMustChange: FALSE
pwdSafeModify: FALSE
sn: dummy value

dn: olcOverlay=ppolicy,olcDatabase={1}bdb,cn=config
olcOverlay: ppolicy
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcPPolicyDefault: cn=default,ou=pwpolicies,dc=syco,dc=net
olcPPolicyHashCleartext: TRUE
olcPPolicyUseLockout: FALSE

My LDAP-setup can be found here (now slightly modified on my own server)

How do I configure LDAP on Centos 6 for user authentication in the most secure and correct way?

Update 1

Hmm it might be enough. I get some log messages that indicates that ppolicy_bind does things for me. Need some further investigation on my end.

The reason why I think I'm missing something in my configuration is because I get the following message in my sssd logs. But that might be OK, if I can trust info from 2006 in the openldap mailing list.

(Mon Oct 24 23:23:35 2011) [sssd[be[default]]] [sdap_control_create] (3): Server does not support the requested control [].

Update 2

I was to fast to file a question. It works. One of the problem i did, was that I did add my users before the password policy. I think that did mess up something. But I still get that sssd error.

share|improve this question
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.