Re: Strong password checks

Graham Leggett wrote:
> Mike Jackson wrote:
> 
>>> Most DSAs include modules or overlays to enforce password
>>> strength/policy,  including OpenLDAP.  This should be up to the DSA.
> 
> 
>> There is nothing in RFC 2251 about password complexity, which means 
>> that if we support it then we support it in a different way for every 
>> directory server. It is not transparent.
> 
> 
> As I understood the original question, password complexity meant 
> distinguishing between "hUjd63*kg" (good) and "passw0rd" (bad), and 
> rejecting the password based on the admin's chosen policy.

Hi Graham,
  I don't mean to split hairs here, but the question was asking about integrating DA password 
changing functionality with a server (DSA) which enforces password policy via the use of 
overlay/plugins, and not about the client (DUA). This would mean establishing a "password changing" 
protocol with the server or something...

client: "change my password to 'foo'"
server-a: "unsuitable password"
client: "change my password to 'foo'"
server-a: "unsuitable password"
client: "piss off"

client: "change my password to 'foo'"
server-b: "bad password: too short"
client: "change my password to 'foobar'"
server-b: "bad password: too simple"
client: "change my password to 'foobar99'"
server-b: "bad password: too simple"

on and on and on...

> Optionally linking DA to cracklib should do the trick.

Yes, if you want to enforce policy at the DUA, then that seems like the way to do it. I support 
that suggestion.

BTW: I am currently working on migrating away from sf.net to a dedicated devenv on 
diradmin.open-it.org. Words can not express how much I dislike sf.net. Hopefully we will release 
the samba3 stuff soon. We are also moving to use Subversion.

BR,
--
mike


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl