[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: fedora and openldap
On 04/06/2011 02:44 PM, Aaron Richton wrote:
On Tue, 5 Apr 2011, Judith Flo Gaya wrote:
[with ldappasswd I get]
e01ENX1pMjcvdjYyeEFvNmI4R212YUdQeDZ3PT0=
[but with passwd I get]
e2NyeXB0fSQxJER1VDNiMEtQJE1GNmQ5UGo4YXhSQXp0RW9VNDVUNDA=
[after running]
authconfig --enableforcelegacy --disablecachecreds --enableldap
--enableldapauth --ldapserver=172.19.5.13
--ldapbasedn=dc=linux,dc=imppc,dc=org --disableldaptls --disablefingerprint
--disablewinbind --disablewins --disablesssd --disablesssdauth --disablenis
--enablecache --enablelocauthorize --usemd5 --updateall
This command takes care of all the pam.d files, and considering that the ssh
does work with the password set by the ldappasswd command, where is the
problem?
I find those hard to read, so:
$ echo e01ENX1pMjcvdjYyeEFvNmI4R212YUdQeDZ3PT0= | openssl enc -d -base64
{MD5}i27/v62xAo6b8GmvaGPx6w==
$ echo e2NyeXB0fSQxJER1VDNiMEtQJE1GNmQ5UGo4YXhSQXp0RW9VNDVUNDA= | openssl enc -d -base64
{crypt}$1$DuT3b0KP$MF6d9Pj8axRAztEoU45T40
sorry, i should have provide them
So, with ldappasswd you're getting MD5 userPassword values (and you seem
to be happy with that), but with passwd you're getting crypt userPassword
values (which are not using the MD5 scheme you seem to be happy with).
With that in mind, I'd propose the command that "takes care of all the
pam.d files" might not be as complete as you hoped. I'd check the
"password" pam stack and make sure that it's configured to generate MD5
passwords or, much better yet, use the LDAP Password Modify operation just
as your ldappasswd invocation does.
I did tried to add the md5 variable in the pam stack but unsuccessfully,
I also tried to change the authconfig command to generate md5 passwords
but they didn't fit the ones in the server.
In the end I changed the pam_ldap.conf file with this line:
pam_password exop
and it worked although I'm not pretty sure what is this option doing
(I'm reading the rfc now).
I'm also considering changing the encryption in the server side to match
this auth protocol.
So your real question going forward is: I've got an OpenLDAP installation
that happily uses the {MD5} scheme for userPassword attributes, how do I
get passwd(1) to write into that format? The exact methods for this depend
on your PAM stack and the available modules; you might be better off
asking the Fedora community (assuming they provided you with this
"authconfig" command) or the provider(s) of your PAM module(s) and/or your
passwd(1) command.
The command wasn't provided by the community, I was just exploring
different options to configure the autentication on client side (in an
scriptable way) and found this binary that changes all config files
instead of editing them all one by one.
But sure I can ask them.
Thanks a lot!
j
--
Judith Flo Gaya
Systems Administrator IMPPC
e-mail: jflo@imppc.org
Tel (+34) 93 554-3079
Fax (+34) 93 465-1472
Institut de Medicina Predictiva i Personalitzada del Càncer
Crta Can Ruti, Camí de les Escoles s/n
08916 Badalona, Barcelona,
Spain
http://www.imppc.org