Hello,
I'm using pam_ldap on a Solaris 10 client and an OpenLDAP server. Everything works great, with one little exception.
I can create new accounts from an LDIF specifying the password as {SSHA} and everything works fine. Users can login, etc. However, if a user changes their password from Solaris ('passwd -r ldap') the password is now stored in the directory as plaintext. The user can still login, change their password, etc, it works fine... but I don't want plaintext passwords in the directory.
I tried adding "password-hash {SSHA}" to slapd.conf, but that didn't do anything... nor would I expect it to because its the default setting.
Can anyone point me in the right direction?
benr.
On Monday, 22 November 2010 10:24:59 Ben Rockwood wrote:
Hello,
I'm using pam_ldap on a Solaris 10 client and an OpenLDAP server. Everything works great, with one little exception.
I can create new accounts from an LDIF specifying the password as {SSHA} and everything works fine. Users can login, etc. However, if a user changes their password from Solaris ('passwd -r ldap') the password is now stored in the directory as plaintext. The user can still login, change their password, etc, it works fine... but I don't want plaintext passwords in the directory.
I tried adding "password-hash {SSHA}" to slapd.conf, but that didn't do anything... nor would I expect it to because its the default setting.
This affects: -the default hash used by slappasswd -the hash used by clients when they perform a PASSMOD operation.
Can anyone point me in the right direction?
For a normal modify, nothing is done by default. However you can (ab)use the ppolicy overlay, and the 'ppolicy_hash_cleartext' option, which will result in the 'password-hash' being applied to cleartext values of userPassword on modifies.
Regards, Buchan
On 11/22/10 3:39 AM, Buchan Milne wrote:
On Monday, 22 November 2010 10:24:59 Ben Rockwood wrote:
Hello,
I'm using pam_ldap on a Solaris 10 client and an OpenLDAP server. Everything works great, with one little exception.
I can create new accounts from an LDIF specifying the password as {SSHA} and everything works fine. Users can login, etc. However, if a user changes their password from Solaris ('passwd -r ldap') the password is now stored in the directory as plaintext. The user can still login, change their password, etc, it works fine... but I don't want plaintext passwords in the directory.
I tried adding "password-hash {SSHA}" to slapd.conf, but that didn't do anything... nor would I expect it to because its the default setting.
This affects: -the default hash used by slappasswd -the hash used by clients when they perform a PASSMOD operation.
Can anyone point me in the right direction?
For a normal modify, nothing is done by default. However you can (ab)use the ppolicy overlay, and the 'ppolicy_hash_cleartext' option, which will result in the 'password-hash' being applied to cleartext values of userPassword on modifies.
Works beautifully, thanks Buchan!
benr.
openldap-technical@openldap.org
-
Ben Rockwood -
Buchan Milne