[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Antw: Passwords, Hashing, and Binds



Hi,
I need some help getting this SSHA512 support. I found the module in the contrib directory passwd/sha2 but the README is still the old readme. It is doesn't explain how to install the module after compliation.

This is what I was able to do so far

On a clean CentOS VM make OpenLDAP 2-4-40
sudo yum -y install git
mkdir openldap && cd openldap
git clone git://git.openldap.org/openldap.git .
git tag -l
git checkout tags/OPENLDAP_REL_ENG_2_4_40
sudo yum -y install gcc
export CXXFLAGS="$CXXFLAGS -fPIC"
sudo yum -y install db4 db4-devel
./configure
make depend
sudo make
sudo make install


Make the sha2 module
cd ~/openldap/contrib/slapd-modules/passwd/sha2
sed -i.bak s/-Wall -g/-Wall -g fPIC/g Makefile
make

This results in a number of files pw-sha2.la  sha2.lo  sha2.o  slapd-sha2.lo  slapd-sha2.o

The question now is how to install this on my target OpenLDAP server. I put the files in /usr/lib64/openldap en dan tried to add the following
dn: cn=module{0},cn=config
changetype: modify
replace: olcModuleLoad
olcModuleLoad: slapd-sha2.la

This give me an error message

+ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f sha2.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
ldap_add: Other (e.g., implementation specific) error (80)
additional info: <olcModuleLoad> handler exited with 1
adding new entry "cn=module{0},cn=config"

The readme only describes how this used to work. I followed the readme for older version of OpenLDAP 2.4.23. This produces one file slapd-sha2.o exactly as described in the readme. I was able to install this module using this readme. Problem is that I need SSHA-512 which the older module does not support.

Any tips or suggestions will be much appriacted  

Thanks and Regards,
Onno

On Fri, Aug 29, 2014 at 9:15 AM, Quanah Gibson-Mount <quanah@zimbra.com> wrote:
--On Friday, August 29, 2014 9:55 AM +0200 Ulrich Windl <Ulrich.Windl@rz.uni-regensburg.de> wrote:

Bram Cymet <bcymet@cbnco.com> schrieb am 28.08.2014 um 22:26 in
Nachricht
<53FF9080.1050209@cbnco.com>:
Hi,

I am storing users passwords in a userPassword attribute. When the
passwords are hashed with MD5 I can bind as the user just fine. If I
hash the password with sha-256 I get invalid credentials.

I wonder: My slappasswd only knows about {SHA} and {SSHA}, {MD5} and
{SMD5}, {CRYPT}, and {CLEARTEXT}. Section 14.4 of the manual indicates
that hashed passwords are non-standard anyway. So implement the
non-standard on your clients.

It takes 5 seconds to look in the contrib directory shipped with the source and find:

SHA-2 OpenLDAP support
----------------------

slapd-sha2.c provides support for SSHA-512, SSHA-384, SSHA-256,
SHA-512, SHA-384 and SHA-256 hashed passwords in OpenLDAP. For
instance, one could have the LDAP attribute:

userPassword: {SHA512}vSsar3708Jvp9Szi2NWZZ02Bqp1qRCFpbcTZPdBhnWgs5WtNZKnvCXdhztmeD2cmW192CF5bDufKRpayrW/isg==

or:

userPassword: {SHA384}WKd1ukESvjAFrkQHznV9iP2nHUBJe7gCbsrFTU4//HIyzo3jq1rLMK45dg/ufFPt

or:

userPassword: {SHA256}K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=

all of which encode the password 'secret'.

(etc).  As I already stated, there's a module for this.  I use it on my systems to add SSHA512 suport.

--Quanah



--

Quanah Gibson-Mount
Server Architect
Zimbra, Inc.
--------------------
Zimbra ::  the leader in open source messaging and collaboration