[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Antw: Passwords, Hashing, and Binds



--On Monday, November 24, 2014 12:22 PM +0100 Onno van der Straaten <onno.van.der.straaten@gmail.com> wrote:

sudo make install

I'd generally advise you really read over the options to configure, and build a better set of binaries. For example, leave out back-bdb/hdb, and enable building things modularly.

My options are:

       --with-cyrus-sasl \
       --with-tls=openssl \
       --enable-dynamic \
       --enable-slapd \
               --enable-modules \
       --enable-backends=mod \
               --disable-shell \
               --disable-sql \
               --disable-bdb \
               --disable-hdb \
               --disable-ndb \
       --enable-overlays=mod \
       --enable-debug \
       --enable-spasswd \
       --enable-crypt; \

Make the sha2 module
cd ~/openldap/contrib/slapd-modules/passwd/sha2
sed -i.bak s/-Wall -g/-Wall -g fPIC/g Makefile
make


I do:

       (cd openldap-$(LDAP_VERSION)/contrib/slapd-modules/passwd/sha2; \
$(MAKE) prefix=/usr/local LIBS="-L$(LDAP_LIB_DIR) -lldap_r -llber" install STRIP=""; \
  	)

And then it installs it for me in the same location. Just make sure you use the same prefix here.

This results in a number of files pw-sha2.la  sha2.lo  sha2.o
 slapd-sha2.lo  slapd-sha2.o

The question now is how to install this on my target OpenLDAP server. I
put the files in /usr/lib64/openldap en dan tried to add the following
dn: cn=module{0},cn=config
changetype: modify
replace: olcModuleLoad
olcModuleLoad: slapd-sha2.la

I'm not sure that replacing olcModuleLoad is correct. If you already have values in there, you probably want to keep them. I generally *add* an additional values. In any case, your value for the attribute is incorrect. The .la file is named, as in your email, pw-sha2.la, not slapd-sha2.la . If you want to add it as an additional module to load, then you would do

changetype: modify
add: olcModuleLoad
olcModuleLoad: pw-sha2.la


My loaded modules are:

dn: cn=module{0}
objectClass: olcModuleList
cn: module{0}
olcModulePath: /opt/zimbra/openldap/sbin/openldap
olcModuleLoad: {0}back_mdb.la
olcModuleLoad: {1}back_monitor.la
olcModuleLoad: {2}syncprov.la
olcModuleLoad: {3}accesslog.la
olcModuleLoad: {4}dynlist.la
olcModuleLoad: {5}unique.la
olcModuleLoad: {6}noopsrch.la
olcModuleLoad: {7}pw-sha2.la


for example.


now, if you want to make something like say, SHA512 the default, then you need to modify the frontend config db:

dn: olcDatabase={-1},cn=config
changetype: modify
replace: olcPasswordHash
olcPasswordHash: {SSHA512}

--Quanah

--

Quanah Gibson-Mount
Server Architect
Zimbra, Inc.
--------------------
Zimbra ::  the leader in open source messaging and collaboration