FeministWiki:LDAP Schema: Difference between revisions

(One intermediate revision by the same user not shown)

Line 45:

For configuration, use {{C|-Y external -H ldapi://}} to connect directly with root permissions, so no actual LDAP domain login is needed.

For data, use {{C|-xy ~/pwd/ldap}} to use the LDAP domain admin password. The file {{C|~/.ldaprc}} should contain ~~{{C|BINDDN cn=admin,dc=feministwiki~~,~~dc=org}}~~ so you don't have to specify the domain admin explicitly every time.

For data, use {{C|-xy ~/pwd/ldap}} to use the LDAP domain admin password. The file {{C|~/.ldaprc}} should contain the following, so you don't have to specify the domain admin explicitly every time:

BINDDN cn=admin,dc=feministwiki,dc=org

=== Read-only user ===

Line 147:

Line 149:

pwdAttribute: userPassword

pwdLockout: TRUE

pwdFailureCountInterval: 3600

pwdLockoutDuration: 3600

pwdMaxFailure: 10

pwdMaxFailure: 30

~~pwdFailureCountInterval: 3600~~

EOF

Line 160:

Line 162:

EOF

With these settings, ~~ten~~ consecutive authentication failures with a username will lock the account for an hour. Login failures are also cleared after an hour~~. This means~~ it's possible to try ~~ten~~ passwords per hour ~~during a brute-force attack~~, which won't get ~~the~~ attacker ~~very~~ far.

With these settings, 30 consecutive authentication failures with a username will lock the account for an hour. Login failures are also cleared after an hour, meaning it's possible to try 30 passwords per hour, which won't get an attacker far.

=== Time of last login ===

@@ Line 45: / Line 45: @@
 For configuration, use {{C|-Y external -H ldapi://}} to connect directly with root permissions, so no actual LDAP domain login is needed.
-For data, use {{C|-xy ~/pwd/ldap}} to use the LDAP domain admin password.  The file {{C|~/.ldaprc}} should contain {{C|BINDDN cn=admin,dc=feministwiki,dc=org}} so you don't have to specify the domain admin explicitly every time.
+For data, use {{C|-xy ~/pwd/ldap}} to use the LDAP domain admin password.  The file {{C|~/.ldaprc}} should contain the following, so you don't have to specify the domain admin explicitly every time:
+ BINDDN cn=admin,dc=feministwiki,dc=org
 === Read-only user ===
@@ Line 147: / Line 149: @@
   pwdAttribute: userPassword
   pwdLockout: TRUE
+ pwdFailureCountInterval: 3600
   pwdLockoutDuration: 3600
-  pwdMaxFailure: 10
+  pwdMaxFailure: 30
- pwdFailureCountInterval: 3600
   EOF
@@ Line 160: / Line 162: @@
   EOF
-With these settings, ten consecutive authentication failures with a username will lock the account for an hour.  Login failures are also cleared after an hour.  This means it's possible to try ten passwords per hour during a brute-force attack, which won't get the attacker very far.
+With these settings, 30 consecutive authentication failures with a username will lock the account for an hour.  Login failures are also cleared after an hour, meaning it's possible to try 30 passwords per hour, which won't get an attacker far.
 === Time of last login ===