Subject: [ldapext] possible denial of other users account (when pwdLockout=True)

From: jay alvarez <[email-masked]>
Date: Mon, 27 Mar 2006 20:18:43 -0800 (PST)

Hi,

when pwdLockout is set to True in ppolicy, then users
my use other users "username" and provide an invalid
password, login a couple of times until the account of
that poor user is locked.. Any suggestion about this?

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: Michael Ströder <[email-masked]>
Date: Tue, 28 Mar 2006 09:24:48 +0200

> that poor user is locked.. Any suggestion about this?

Many security people are not aware of this problem. In real life you
could lock down big companies with a small script if you know the user
IDs and such a "strict" password policy with infinite failure lock is in
effect.

I've argued so many times to let the server unlock the account
automatically after a short time (see pwdLockoutDuration). But people
does not seem to take this problem seriously enough.

Ciao, Michael.