ppolicy module should be used to enforce ubuntu's default password policy

[Rick Clark]

Binary package hint: slapd

The ppolicy module should be used to enforce ubuntu's default policy of min=4 max=8 set in the pam configs. The openldap module and schema are already included in the slapd package, there is just configuration work that needs to be done.

If this was deemed necessary to enforce in pam it should be enforced in openldap as well.

This is in openldap2.3-2.3.30

[Rick Clark (dendrobates)]

I am using this bug as a training exercise and will fix it myself.

[PaulSchulz (paulschulz)]

Is this where openldap is serving as an authentication source for pam?

[Rick Clark (dendrobates)]

Yes. this would enforce the password policy regardless of the method used to change it. Currently, it would be possible to do a ldap_modify to change your password to a 1 character password that would let you authenticate to any clients, including pam_ldap.

I plan on fixing this in gutsy.

[Loye Young (loyeyoung)]

On servers, I think it's essential to have strong passwords. I usually change the default policy on my builds to require complex passwords longer than 8 characters. What I would really like is for openldap and/or pam ask for permission to enforce password complexity and migrate that setting throughout.

Loye Young
Laredo, Texas