Editing RDM Implementation Details in a Single html (section)

==Openldap Password Policy on 172.20.1.24==

--------------------------
Openldap Password Policy on 172.20.1.24
--------------------------

Password Policy is defined on the 172.20.1.24 server. Every day it will generate the email alerts for the locked and expired email accounts.
The attributes of this policy is as follows

pwdMinAge: 1 minute
pwdMaxAge: 45 days
pwdMinLength: 7
pwdExpireWarning: 40 days
pwdGraceAuthNLimit: 3
pwdLockoutDuration: 10 minute
pwdMaxFailure: 5


The policy can be change by http://172.20.1.24/phpldapadmin/htdocs/index.php and select "cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in" and do the required change e.g. 

pwdExpireWarning, pwdGraceAuthNLimit, pwdLockoutDuration, pwdMinAge etc.

--------------------------
Openldap Password Policy on 172.20.1.24
--------------------------

yum install openldap-servers-overlays


vi /etc/openldap/slapd.conf
---------------------------
add below lines

include /etc/ldap/schema/ppolicy.schema

moduleload ppolicy


overlay ppolicy
ppolicy_default "cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in"
ppolicy_use_lockout
ppolicy_hash_cleartext

---------------------------


vi ppolicy.ldif
---------------------------
dn: ou=Policies,dc=rdm,dc=co,dc=in
ou: Policies
description: Directory policies.
objectclass: organizationalUnit

dn: cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in
cn: Standard
description: Standard password policy.
pwdAttribute: 2.5.4.35
pwdMinAge: 60
# 30 days: 60 sec * 60 min * 24 hr * 30 days
pwdMaxAge: 2592000
pwdCheckQuality: 1
pwdMinLength: 7
# Warn three days in advance
pwdExpireWarning: 2160000
pwdGraceAuthNLimit: 3
pwdLockout: TRUE
pwdLockoutDuration: 1200
pwdMaxFailure: 5
pwdFailureCountInterval: 1200
pwdMustChange: TRUE
pwdAllowUserChange: TRUE
pwdSafeModify: TRUE
objectclass: device
objectclass: pwdPolicy
---------------------------

ldapadd -acvx -D"cn=manager,dc=rdm,dc=co,dc=in" -w rdmsecret4u001 -f ppolicy.ldif

/etc/init.d/ldap restart


Email Alert Scripting
----------------------

vim /root/ppolicy/ppolicy.sh 
----------------------
#!/bin/sh
#search qmail users
ldapsearch  -x '(&(objectclass=qmailUser))' uid|grep uid:|tr -d ' '|cut -d: -f2 > /root/ppolicy/email_users
#turncat user_expire and locked_user files.
echo > /root/ppolicy/user_expire
echo > /root/ppolicy/locked_user
#search for account expired users
for i in `cat /root/ppolicy/email_users`
do
ldapsearch  -x "(&(objectclass=qmailUser)(uid=$i)(pwdChangedTime<=`date '+%Y%m%d%k%M%SZ' -d "30 days ago"`))" uid|grep uid: |tr -d ' ' |cut -d: -f2 >> /root/ppolicy/user_expire
#search for account locked users
locked=`ldapsearch  -x "(&(objectclass=qmailUser)(uid=$i))" pwdGraceUseTime -LL |grep -c pwdGraceUseTime`
if [ "$locked" == "3" ]
then
echo $i >> /root/ppolicy/locked_user
fi
done
#generate alerts
sh /root/ppolicy/expireAlert.sh
----------------------

vim /root/ppolicy/expireAlert.sh 
----------------------
#!/bin/sh
#send email password expiration alert to user and edp
for i in `cat /root/ppolicy/user_expire`
do
cat /root/ppolicy/expiremsg |mail -s "Password Expiration Notice" $i@rdm.co.in
done
#send email to edp about locked users
cat /root/ppolicy/locked_user | mail -s "Email Account Locked Users " edp@rdm.co.in
----------------------