We have a bunch of linux servers authenticating via an ldap server. We have set a password complexity policy on the ldap server. However, the local system policy overrides the policy set on the ldap server. Would setting up a complexity requirement in /etc/pam.d/system-auth enforce the clients to adhere to the same policy setup on the ldap server?


Setting password complexity in PAM is purely a client side configuration, which you need to replicate on each client.

Using PAM on to set password complexity on the host running the OpenLDAP server is not the same enforcing password complexity in the OpenLDAP server.

You need to configure the password overlay feature as described in section 12.10 of the manual

Using the policy overlay OpenLDAP will then simply reject weak passwords, regardless of what your client settings are.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.