How do you turn on password hashing (SSHA) in openLDAP

user_1459958 0
Viewed 43831

For the life of me, I cannot seem to find this anywhere and if anyone can even just give me a link I would be very appreciative.

We are trying to turn on SSHA hashing in openLDAP. By default it stores passwords in plaintext, which I think is criminal but hey I am an AD guy so what do I know. But you would think that they would make it easy to find the information needed to turn on hashing if you so choose. And wouldn't you choose?

ssha openldap hash salt passwords
5 Answers

This is an old question, but still relevant. It's no longer recommended to use SSHA (ie. SHA-1) due to its relatively easy brute-forcing.

A more secure hashing algorithm is SHA-512. A stronger hash can be generated on the client side with OpenSSL 1.1 like this:

_generate_password_hash() {
  local plaintext; plaintext="$1"

  command printf "{CRYPT}%s" "$(openssl passwd -6 -stdin <<< "${plaintext}")"
}

This will output a string such as:

{CRYPT}$6$SGIWzAbjh.3WoQQJ$vEFlcRBQpd2fJ8dxcbojr83pjQcXcJ.InRMzNRryTQ//fMYJoCRFWAPn22EvJyDikG.MNuUqRYqQtI97Clj2F0

Notice the {CRYPT} instead of {SSHA} in the beginning.

You may apply the password for example with ldapmodify:

ldapmodify -h "${LDAP_HOST}" -D cn=user,dc=example,dc=com -W <<EOF
dn: cn=user,dc=example,dc=com
changetype: modify
replace: userPassword
userPassword: $(_generate_password_hash NEW_PASSWORD_HERE)
EOF

Notice that LibreSSL has a different set of hashing algorithms available. Check your actual OpenSSL version with openssl version if openssl passwd --help doesn't show the -6 option.

user_4228480
Related