Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to find how to change some password policy settings in openLDAP (on a system-wide level - not on a per user level) such that ALL LDAP account users (ie existing and new users) have their passwords set to expire after 90 days.

I know the main parameter that controls this is the maxPasswdAge parameter but I am not sure how to set this.

We are running openldap 2.3.43 on RHel 5.3.

Can anyone share their experience on this?

share|improve this question
How is the system using LDAP to pull this information? Is pam-ldap or nss-ldap being used? –  Tim Jan 13 '12 at 14:42
Thanks for your reply .. think its using pam_ldap –  Dominiqs Jan 16 '12 at 8:23

1 Answer 1

Your "user" entry in the LDAP directory needs to have 2 attributes:

passwordExp: on
passwordMaxAge: 8640000

8640000 = 100 days.

share|improve this answer
Tim Thanks very much but how do you change these attributes , what command will you use exactly –  Dominiqs Jan 17 '12 at 15:00
Tim, still havent found out how to do this , i have had no solution or reply , any more suggestions .How do i set these attributes please –  Dominiqs Mar 13 '12 at 10:21
which directory or config file are we talking about openldap.conf –  Dominiqs Mar 23 '12 at 14:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.