Re: Antw: Expected operation of pwdFailureCountInterval

[Tom Jay <web@tomjay.co.uk>]

I think the documentation could do with being updated slightly.

This is taken from the slapo-ppolicy manual:

pwdFailureCountInterval

This  attribute  contains  the number of seconds after which old 
consecutive failed bind attempts are purged from the failure counter, 
even though no successful authentication has occurred.  If 
pwdFailureCountInterval is not present, or its value is zero (0), the 
failure counter will only  be  reset  by  a successful authentication.

What I think that means is that unless the account is locked, and there 
are no successful authentication attempts, failed bind attempts are 
cleared from the LDAP entry after the pwdFailureCountInterval time. If 
the account is locked, the pwdFailureTime entries remain until the 
account is unlocked manually (or the pwdLockoutDuration time) and a 
successful authentication attempt (if the account is not locked) will 
also clear the pwdFailureTime entries.

Tom

On 2019-02-28 15:00, Ulrich Windl wrote:
> > > > Tom Jay <web@tomjay.co.uk> schrieb am 27.02.2019 um 04:05 in 
> > > > Nachricht
> <19f2a950eb051ccafe5a4420752d8b84@tomjay.co.uk>:
> > Hello,
> >
> > Can someone explain the expected operation of the
> > pwdFailureCountInterval attribute please? The documentation seems to 
> > be
> > fairly clear, but if I add it to the password policy, along with some
> > other attributes, the account remains locked, even after the
> > pwdFailureCountInterval time. Despite authenticating with a valid
> > password, the pwdFailureTime entries remain and the account remains
> > locked.
>
> I think the mechanism is the other way round: As long as the account
> is not locked, failed counts are reset every (after?) 1200 seconds.
> Once an account is locked, it stays locked.
>
> Did you look at pwdLockoutDuration?
>
> Regards,
> Ulrich
>
> > These are the attributes in use:
> > pwdLockout: TRUE
> > pwdMaxFailure: 5
> > pwdFailureCountInterval: 1200
> >
> > Thanks.
> >
> > Tom