[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
RE: migrating already crypted passwords to ldif
Hi - thanks for the reply
On Mon, 2003-01-27 at 16:00, Jeff Costlow wrote:
> The double colons '::' means the client is base64 encoding the output. If you use perl or python to base64 decode you'll see.
>
Thanks for that!
> And you are correct to just place the {CRYPT} in front of the already crypted password before placing it into the directory. I have heard rumours that 2.1.x series has by default disabled crypt support, you may have to configure --enable-crypt.
>
Ok, then I'm expecting that as long as I configure everything else
right, users won't have to change their passwords from what they used
under NIS? I'll proceed and see how it goes I guess :-/
> Also check out:
> http://www.openldap.org/faq/data/cache/419.html
> http://www.openldap.org/software/man.cgi?query=slapd.conf search for the section of password-hash and password-crypt-salt-format. These will be useful when you want users to be able to use ldappasswd to modify their own password.
>
These aren't useful to me, because I'm not concerned here with
*generating* passwords, which is what these cover. What I'm concerned
with is how OpenLDAP performs the actual comparison! In other words, if
my NIS password is 'orange', then when I do 'ypmatch jonesy passwd'
it'll come back with a crypted string - which is what gets put into the
ldif file and subsequently imported into my directory.
Now, when I ssh to the LDAP server (a test box, mind you), I've told ssh
to use ldap for authentication. When I type my ssh password 'orange' at
the login prompt, I need to insure that this password is crypted
properly so that it matches LDAPs crypted version of the password -
otherwise I go nowhere. :)
Hope I'm being clear here. There seems to be an overabundance of
information on how to *generate* passwords. Docs on migrating them,
aside from 'execute 'migrate-all'...' appears to be somewhat lacking so
far as I can tell. Guess I'll write some myself when I get it all
straight.
Thanks a million for the help.
brian.
> -----Original Message-----
> From: Brian K. Jones [mailto:jonesy@CS.Princeton.EDU]
> Sent: Monday, January 27, 2003 12:43 PM
> To: ldap list
> Subject: migrating already crypted passwords to ldif
>
>
> Hi,
>
> I'm unclear on how to handle this. I have OpenLDAP 2.1.18 (built from
> source) running on Redhat 7.3. I also have the latest nss_ldap,
> pam_ldap and padl migration tools.
>
> I'm trying to migrate users from using NIS to using LDAP without forcing
> them to change their passwords. However, I haven't seen any clear
> documentation discussing how to enter passwords that are *already*
> crypted into my directory. If I put something like
>
> userPassword: {crypt}mYh45h3dPa55w0rD
>
> Then the result is, of course, a crypted version of the above. One
> additional note is that the above ldif entry, when viewed via
> ldapsearch, puts *two* colons after 'userPassword'. The end result looks
> something like this:
>
> userPassword:: e2Nye9Bf0RW1mN6sks03Sk
>
> Notice that {crypt} is now gone, there are two colons, and this is a
> crypted version of the already crypted string above.
>
> Eventually, this directory *will* be used for authentication, so if
> anyone can tell me how to get LDAP to read the incoming NIS passwords
> the same way that NIS did, I would be incredibly grateful.
>
> Pointers for RTFM welcome. However, I think I've already read them
> all.
> :-(
>
> brian