[Date Prev][Date Next]
Re: (ITS#7784) Client stores bindpw in cleartext
> Full_Name: Yo Lau
> Version: 2.3.32
> OS: SUSE Linux Enterprise Server 10
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (188.8.131.52)
OpenLDAP 2.3.32 is over 6 years old and long since unsupported.
nss_ldap is not a piece of OpenLDAP software. Contact SuSE for support, this
ITS will be closed.
> When nss_ldap uses LDAP authentication with binding method, the bindpw stored in
> ldap.conf is clear text.
> However on Solaris NS_LDAP_BINDPASSWD could be stored in encrypted string. There
> is no password obfuscation with nss_ldap.
> So we considered it is a security issue and will affect the result of security
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/