
Chapter 9. Authentication in ThinLinc
Hiveconf parameter path Command line parameter Explanation
/utils/tl-nds/posixgroup/cachefilename--cachefilename The file name of the filename
where the last used gidNumber is
stored. The default is
/var/opt/thinlinc/utils/tl-nds/posixgroup/cache,
and generally, there’s no reason
to change this value. This file is
locked by a running
tl-nds-posixgroup process to
protect against duplicate
gidNumber values in LDAP.
/utils/tl-nds/posixgroup/excluded_dns--exclude_dn A list of entries in the LDAP tree
to ignore. If setting this in
hiveconf, use a space-separated
list of DNs. If setting on the
command line, give several
--exclude-dn with one DN after
each. This setting can be used if
there are places in your LDAP
tree where for example invalid
groups are stored. The DN itself
and all its leaves will be ignored.
/utils/tl-nds/posixgroup/ldapfilter--ldapfilter The LDAP filter (as defined in
RFC2254) to be used for finding
the groups that should be
modified. Default value is
(&(object-
class=groupOfNames)(!(objectclass=posixGroup))).
9.3.5. Forcing Users to Change Passwords in an eDirectory Environment
In most environments, forcing the users to regularly change password is a good security measure. This
section will describe how to do this with ThinLinc in an eDirectory environment.
9.3.5.1. Functionality
By activating forced password changes in ThinLinc, a graphical window will popup during the login
sequence if the password expire date is near, or if the password has expired. There is also support for the
"grace logins" functionality of eDirectory. The functionality can be summarized as below:
• At login, tl-nds-check-expired sends a query to the LDAP server defined in /etc/ldap.conf and
asks for information about password expiration.
• If the number of days until the password expires is less than warning_days (see below),
tl-nds-check-expired pops up a window and warns the user that the password is about to expire, and
99
Comentarios a estos manuales