Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running openldap 2.3.43.el5 on RHEL 5.3 I am trying to find a simple command that will tell you when the password for an ldap user will expire, any help would be greatly appreciated.This would be an equivalent of chage -l (for local linux accounts.

I have just managed to change the pwdmaxAge attribute in our environment and need a definite way to check if the change has taken effect (not just by querying the atribute pwdMaxAge with ldapsearch

Help Please ?

share|improve this question
What is your problem with ldapsearch? – quanta Aug 30 '12 at 16:03

There isn't one. The only thing that can help you is the operational attribute pwdChangedTime, which you can see via ldapsearch. When this gets older than pwdMaxAge in the password policy, the password expires. The only way to test it exactly is to wait out the expiration periond.

share|improve this answer
Thanks very much for your help anyway..i have reset my pwdmaxAge t 90 days , i guess i have to wait until then to see if it worked or not.Thanks – Dominiqs Aug 31 '12 at 13:20
@Dominiqs You don't have to wait that long. Make yourself a test password policy with max age 1 day, make a test account with that policy, change its password, wait a day, ... – EJP Sep 1 '12 at 0:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.