On 7/6/10 11:44 PM, Bryan Boone wrote:

Hi everyone. I just read this information.

14.4. Password Storage LDAP passwords are normally stored in the userPassword attribute. RFC4519 specifies that passwords are not stored in encrypted (or hashed) form.

*encrypted*. Not encrypted *or* hashed.

Encrypted is really different from Hashed. Encryption means you have a way to decrypt the password. Hashing does not offer this possibility.

This allows a wide range of password-based authentication mechanisms, such as DIGEST-MD5 to be used. This is also the most interoperable storage scheme. However, it may be desirable to store a hash of password instead. slapd(8) supports a variety of storage schemes for the administrator to choose from.

If it is not typical to store passwords in LDAP in hashed form.

All the existing ldap servers support hashed passwords. Usually, the mechanism is stored in frm of the encrypted password like : {MD5}XXXXXXX or {crypt}YYYYYYYYY

Then how are you supposed to bind to LDAP without transmitting the clear text password across the network?

Even if the password is hashed ( you still have to pass the password in clear text ).

I understand that SSL and Kerberos will fix this problem, but what if a user just wants to use plain LDAP?

Ask this user his bank account number and his password... There is no reason for him to refuse to give you such information if he accepts the idea that his password will be transmitted in clear.

Hey, it's not like if this is a unsafe planet where some bad bad people are willing to use those information to spam or send scams. We are all living in a peaceful and honest world... ;)

Would I need to dictate to a customer that they must use a hash alg. in the userPassword in this case?

You just need to explain this customer the very basis of what is security.

Or may be point him to http://www.ietf.org/rfc/rfc4513.txt, 6.3.3. Password-Related Security Considerations :

"...The use of clear text passwords and other unprotected authentication credentials is strongly discouraged over open networks when the underlying transport service cannot guarantee confidentiality. LDAP implementations SHOULD NOT by default support authentication methods using clear text passwords and other unprotected authentication credentials unless the data on the session is protected using TLS or other data confidentiality and data integrity protection..."