Bug 47002 – The ppolicy attributes can only be adjusted via ldapmodify

Bug 47002 - The ppolicy attributes can only be adjusted via ldapmodify


Summary:	The ppolicy attributes can only be adjusted via ldapmodify

Status:	NEW

Product:	UCS
Classification:	Unclassified
Component:	LDAP
Version:	UCS 5.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	UCS maintainers
QA Contact:	UCS maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2018-05-14 12:16 CEST by Christina Scheinig
Modified:	2021-05-03 21:41 CEST (History)
CC List:	2 users (show)

See Also:	35809
What kind of report is it?:	Bug Report
What type of bug is this?:	2: Improvement: Would be a product improvement
Who will be affected by this bug?:	1: Will affect a very few installed domains
How will those affected feel about the bug?:	1: Nuisance – not a big deal but noticeable
User Pain:	0.011
Enterprise Customer affected?:	Yes
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:	2018050721000094
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Christina Scheinig

2018-05-14 12:16:22 CEST

We already have a SDB article how to activate ldap account locking. 
(https://help.univention.com/t/automatic-openldap-account-locking/6436)

It would be an improvement, if the customer can adjust the attributes pwdMaxFailure and pwdMaxFailureCountInterval via UMC. At the moment he needs to adjust the values via ldapmodify.

Comment 1 Arvid Requate

2018-05-14 14:45:14 CEST

It's also hard for customers (admins) to know and consider all the different mechanisms of password aging and lockout:

* ppolicy for LDAP binds (via ldapmodify)
* pam_tally for SSH (via UCR variables faillog/*)
* Samba passwordsettings (via umc settings/sambadomain)
* UDM policy pwhistory


Admins should be supported to configure this correctly in one place (Bug #35809).