Matthias Apitz wrote: That's the wrong way to authenticate against credentials stored in an LDAP directory. You should just do an LDAP Bind. Probably you have some clients updating their entries with hashed passwords instead of letting slapd do all the hashing. Again, that is not a good practice. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

On Tue, Sep 29, 2015 at 09:31:20AM +0200, Matthias Apitz wrote: It requires read access to the password hash, which is a security risk. Most LDAP deployments prevent *anyone* from reading password hashes (except for the replication user etc). Hashing passwords and verifying them should be left to the LDAP server. Note also that SSHA is very weak in the face of brute-force attacks. You should be trying to use one of the hash schemes that were designed specifically to protect passwords. BCRYPT is probably the best, but any of the Linux $1$, $6$, $2a$ schemes will give immensely more protection than plain SSHA. Advise them to create the entry without a password hash, then to set the password using the password-change extended operation. See Net::LDAP::Extension::SetPassword for details. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------