Well,working with LDAP again for user authentication and authorisation, which gave me back some good memories. But now, I'm a bit surprised.
I configured ldap and pam like that every user can change their ldap passwords via the simple "passwd" command.
When you use "passwd" with a local account (which uses simple /etc/passwd, /etc/shadow) you will get a password hash inside /etc/shadow with SHA512:
"shermann:$6$j7K1xdEK$1E1vfHvsjxOGBteIumC8nYMniUqLmJrWFFRVPPrkun/bPYPkHNPoPyMbIuk8fFBekeHHZb1tvdYAFMDrCxZT2.:14841:0:99999:7:::
"
$6$ tells us that this password is SHA512 hashed. The documentation about the different $$ meanings you can find in crypt(3):
NOTESGlibc NotesThe glibc2 version of this function supports additional encryption algorithms.If salt is a character string starting with the characters "$id$" followed by a string terminated by "$":$id$salt$encryptedthen instead of using the DES machine, id identifies the encryption method used and this then determines how the rest of the password string is interpreted. The fol‐lowing values of id are supported:ID | Method─────────────────────────────────────────────────────────1 | MD52a | Blowfish (not in mainline glibc; added in some| Linux distributions)5 | SHA-256 (since glibc 2.7)6 | SHA-512 (since glibc 2.7)So $5$salt$encrypted is an SHA-256 encoded password and $6$salt$encrypted is an SHA-512 encoded one."salt" stands for the up to 16 characters following "$id$" in the salt. The encrypted part of the password string is the actual computed password. The size of thisstring is fixed:MD5 | 22 charactersSHA-256 | 43 charactersSHA-512 | 86 charactersThe characters in "salt" and "encrypted" are drawn from the set [a–zA–Z0–9./]. In the SHA implementation the entire key is significant (instead of only the first 8bytes in MD5).
Now, when you do the same with an LDAP account, you only get a simple MD5 hash.
How can someone tell passwd and openldap to use the strong hash method with SHA512?
It would be great to use glibcs crypt possibilities even with LDAP without manual interaction on the LDAP server.
So, if somebody knows how to do that, please leave a comment or write an email to my known address.
Thanks!
