Designing a Password Policy170 Red Hat Directory Server Deployment Guide • May 2005• Password Storage SchemePassword Change after ResetThe Directory Server password policy lets you decide whether users must changetheir passwords after the first login or after the password is reset by theadministrator.Often the initial passwords set by the administrator follow some sort ofconvention, such as the user’s initials, user ID, or the company name. Once theconvention is discovered, it is usually the first value tried by a hacker trying tobreak in. In this case, it is a good idea to require users to change their passwordsafter such a change. If you configure this option for your password policy, usersare required to change their password even if user-defined passwords aredisabled. (See “User-Defined Passwords,” on page 170, for information.)If you choose not to allow users to change their own passwords, administratorassigned passwords should not follow any obvious convention and should bedifficult to discover.By default, users do not need to change their passwords after reset.User-Defined PasswordsYou can set up your password policy either to allow or not to allow users tochange their own passwords. A good password is the key to a strong passwordpolicy. Good passwords do not use trivial words—any word that can be found ina dictionary, names of pets or children, birthdays, user IDs, or any otherinformation about the user that can be easily discovered (or stored in the directoryitself).Also, a good password should contain a combination of letters, numbers, andspecial characters. Often, however, users simply use passwords that are easy toremember. This is why some enterprises choose to set passwords for users thatmeet the criteria of a “good” password and do not allow the users to change thepasswords.However, assigning passwords to users takes a substantial amount of anadministrator’s time. In addition, by providing passwords for users rather thanletting them come up with passwords that are meaningful to them, and thereforemore easily remembered, you run the risk that the users will write theirpasswords down somewhere where they can be discovered.By default, user-defined passwords are allowed.
