Chapter 16. Synchronizing account lockout attributes across all servers in a replication environment Directory Server stores account lockout attributes locally. In an environment with multiple servers, configure replication for these attributes to prevent attackers from attempting to log in to one server until the account lockout count is reached and then continue on other servers. 16.1. How Directory Server handles password and account lockout policies in a replication environment Directory Server enforces password and account lockout policies as follows: Password policies are enforced on the data supplier Account lockout policies are enforced on all servers in a replication topology Directory Server replicates the following password policy attributes: passwordMinAge passwordMaxAge passwordExp passwordWarning However, by default, Directory Server does not replicate the general account lockout attributes: passwordRetryCount retryCountResetTime accountUnlockTime To prevent attackers from attempting to log in to one server until the account lockout count is reached and then continue on other servers, replicate these account lockout attributes. Additional resources Configuring Directory Server to replicate account lockout attributes 16.2. Configuring Directory Server to replicate account lockout attributes If you use an account lockout policy or password policy that updates the passwordRetryCount , retryCountResetTime , or accountUnlockTime attributes, configure Directory Server to replicate these attributes so that their values are the same across all servers. Perform this procedure on all suppliers in the replication topology. Prerequisites You configured an account lockout policy or a password policy that updates one or more of the mentioned attributes. You use Directory Server in a replication environment. Procedure Enable replication of password policy attributes: # dsconf -D " cn=Directory Manager " ldap://server.example.com pwpolicy set --pwdisglobal="on" If you use fractional replication, display the list of attributes that are excluded from replication: # dsconf -D " cn=Directory Manager " ldap://server.example.com repl-agmt get --suffix " dc=example,dc=com " example-agreement | grep "nsDS5ReplicatedAttributeList" Using the default settings, no output is shown, and Directory Server replicates the account lockout attributes. However, if the command returns a list of excluded attributes, such as in the following example, verify the attribute list: nsDS5ReplicatedAttributeList: (objectclass=*) USD EXCLUDE accountUnlockTime passwordRetryCount retryCountResetTime example1 example2 In this example, the accountUnlockTime , passwordRetryCount , and retryCountResetTime lockout policy attributes are excluded from replication, along with two other attributes. If the output of the command lists any of the account lockout attributes, update the fractional replication settings to only include attributes other than the lockout policy attributes: # dsconf -D " cn=Directory Manager " ldap://server.example.com repl-agmt set --suffix " dc=example,dc=com " --frac-list " example1 example2 " example-agreement Verification Attempt to perform a search as a user using an invalid password: # ldapsearch -H ldap://server.example.com -D " uid=example,ou=People,dc=example,dc=com " -w " invalid-password " -b " dc=example,dc=com " -x ldap_bind: Invalid credentials (49) Display the passwordRetryCount attribute of the user: # ldapsearch -H ldap://server.example.com -D " cn=Directory Manager " -W -b " uid=example,ou=People,dc=example,dc=com " -x passwordRetryCount ... dn: uid=example,ou=People,dc=example,dc=com passwordRetryCount: 1 Run the command on a different server in the replication topology. If the value of the passwordRetryCount attribute is the same, Directory Server replicated the attribute. Additional resources Configuring a password-based account lockout policy

Commands:
dsconf -D " cn=Directory Manager " ldap://server.example.com pwpolicy set --pwdisglobal="on"
dsconf -D " cn=Directory Manager " ldap://server.example.com repl-agmt get --suffix " dc=example,dc=com " example-agreement | grep "nsDS5ReplicatedAttributeList"
nsDS5ReplicatedAttributeList: (objectclass=*) USD EXCLUDE accountUnlockTime passwordRetryCount retryCountResetTime example1 example2
dsconf -D " cn=Directory Manager " ldap://server.example.com repl-agmt set --suffix " dc=example,dc=com " --frac-list " example1 example2 " example-agreement
ldapsearch -H ldap://server.example.com -D " uid=example,ou=People,dc=example,dc=com " -w " invalid-password " -b " dc=example,dc=com " -x ldap_bind: Invalid credentials (49)
ldapsearch -H ldap://server.example.com -D " cn=Directory Manager " -W -b " uid=example,ou=People,dc=example,dc=com " -x passwordRetryCount dn: uid=example,ou=People,dc=example,dc=com passwordRetryCount: 1