Home | History | Annotate | Line # | Download | only in ppm 
      1 # Example of ppm configuration
      2 
      3 # Such configuration must be stored into pwdCheckModuleArg attribute
      4 # of a password policy entry
      5 # See slapo-ppolicy for more details
      6 # Here is an example of such password policy:
      7 #   dn: cn=default,ou=policies,dc=my-domain,dc=com
      8 #   objectClass: pwdPolicy
      9 #   objectClass: top
     10 #   objectClass: pwdPolicyChecker
     11 #   objectClass: person
     12 #   pwdCheckQuality: 2
     13 #   pwdAttribute: userPassword
     14 #   sn: default
     15 #   cn: default
     16 #   pwdMinLength: 6
     17 #   pwdCheckModule: /usr/local/lib/ppm.so
     18 #   pwdCheckModuleArg:: bWluUXVhbGl0eSAzCmNoZWNrUkROIDAKY2hlY2tBdHRyaWJ1dGVzCmZvcmJpZGRlbkNoYXJzCm1heENvbnNlY3V0aXZlUGVyQ2xhc3MgMAp1c2VDcmFja2xpYiAwCmNyYWNrbGliRGljdCAvdmFyL2NhY2hlL2NyYWNrbGliL2NyYWNrbGliX2RpY3QKY2xhc3MtdXBwZXJDYXNlIEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaIDAgMSAwCmNsYXNzLWxvd2VyQ2FzZSBhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5eiAwIDEgMApjbGFzcy1kaWdpdCAwMTIzNDU2Nzg5IDAgMSAwCmNsYXNzLXNwZWNpYWwgPD4sPzsuOi8hwqfDuSUqwrVewqgkwqPCsibDqX4iIyd7KFstfMOoYF9cw6dew6BAKV3CsD19KyAwIDEgMAo=
     19 #
     20 # Different parameters are separated by a linefeed (\n)
     21 # Parameters starting with a # are ignored
     22 # Use a base64 tool to code / decode the content of pwdCheckModuleArg
     23 
     24 
     25 
     26 # Parameters
     27 
     28 # minQuality parameter
     29 # Format:
     30 # minQuality [NUMBER]
     31 # Description:
     32 # One point is granted for each class for which MIN_FOR_POINT criteria is fulfilled.
     33 # defines the minimum point numbers for the password to be accepted.
     34 minQuality 3
     35 
     36 # checkRDN parameter
     37 # Format:
     38 # checkRDN [0 | 1]
     39 # Description:
     40 # If set to 1, password must not contain a token from the RDN.
     41 # Tokens are separated by these delimiters : space tabulation _ - , ; 
     42 checkRDN 0
     43 
     44 # checkAttributes parameter
     45 # Format:
     46 # checkAttributes [ATTR1,ATTR2,...]
     47 # Description:
     48 # Password must not contain a token from the values in the given list of attributes
     49 # Tokens are substrings of the values of the given attributes,
     50 # delimited by: space tabulation _ - , ; @
     51 # For example, if uid="the wonderful entry",
     52 # password must not contain "the", nor "wonderful", nor "entry"
     53 checkAttributes
     54 
     55 # forbiddenChars parameter
     56 # Format:
     57 # forbiddenChars [CHARACTERS_FORBIDDEN]
     58 # Description:
     59 # Defines the forbidden characters list (no separator).
     60 # If one of them is found in the password, then it is rejected.
     61 forbiddenChars 
     62 
     63 # maxConsecutivePerClass parameter
     64 # Format:
     65 # maxConsecutivePerClass [NUMBER]
     66 # Description:
     67 # Defines the maximum number of consecutive character allowed for any class
     68 maxConsecutivePerClass 0
     69 
     70 # useCracklib parameter
     71 # Format:
     72 # useCracklib [0 | 1]
     73 # Description:
     74 # If set to 1, the password must pass the cracklib check
     75 useCracklib 0
     76 
     77 # cracklibDict parameter
     78 # Format:
     79 # cracklibDict [path_to_cracklib_dictionary]
     80 # Description:
     81 # directory+filename-prefix that your version of CrackLib will go hunting for
     82 # For example, /var/pw_dict resolves as /var/pw_dict.pwd,
     83 # /var/pw_dict.pwi and /var/pw_dict.hwm dictionary files
     84 cracklibDict /var/cache/cracklib/cracklib_dict
     85 
     86 # classes parameter
     87 # Format:
     88 # class-[CLASS_NAME] [CHARACTERS_DEFINING_CLASS] [MIN] [MIN_FOR_POINT]
     89 # Description:
     90 # [CHARACTERS_DEFINING_CLASS]: characters defining the class (no separator)
     91 # [MIN]: If at least [MIN] characters of this class is not found in the password, then it is rejected
     92 # [MIN_FOR_POINT]: one point is granted if password contains at least [MIN_FOR_POINT] character numbers of this class
     93 # [MAX]: if > [MAX] occurrences of characters from this class are found, then the password is rejected (0 means no maximum)
     94 class-upperCase ABCDEFGHIJKLMNOPQRSTUVWXYZ 0 1 0
     95 class-lowerCase abcdefghijklmnopqrstuvwxyz 0 1 0
     96 class-digit 0123456789 0 1 0
     97 class-special <>,?;.:/!%*^$&~"#'{([-|`_\^@)]=}+ 0 1 0
     98