You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by "Alex Karasulu (JIRA)" <di...@incubator.apache.org> on 2006/01/07 11:01:48 UTC
[jira] Updated: (DIREVE-296) Storing user passwords other than in
clear
[ http://issues.apache.org/jira/browse/DIREVE-296?page=all ]
Alex Karasulu updated DIREVE-296:
---------------------------------
Priority: Blocker (was: Minor)
This is very important. I would not put an LDAP server into a production environement if passwords were in the clear even if I did have ACI to protect them. Just not a smart idea.
> Storing user passwords other than in clear
> ------------------------------------------
>
> Key: DIREVE-296
> URL: http://issues.apache.org/jira/browse/DIREVE-296
> Project: Directory Server
> Type: New Feature
> Reporter: Stefan Zoerner
> Assignee: Stefan Zoerner
> Priority: Blocker
>
> Because the admin user is allowed to see everything, I suggest to store the attribute values for user password other than in clear. I nice solution would be to make this configurable (other server products allow comparable functionality):
> * Configure a hash function to use for password storage (e.g. MD5, SSHA, ...)
> * Allow clients to store the value as a hashed value on their own as well (calculated with a function other than the configured one, if they like)
> * Enable simple bind with value in clear text (hash value calculated within the server and compared against the stored value)
> * Still allow clear passwords, because some authentication mechanisms need this (e.g. DIGEST-MD5)
> Hashed values does not add that much security, but at least is is harder for admin to catch a password and commit it to his/her memory.
> Some products even allow to encrypt the password (two-way), but I think the features above should do for the first run.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira