Re: [ApacheDS] Hash question

[Linus van Geuns <li...@vangeuns.name>]

Hey!

On Fri, Oct 8, 2010 at 3:07 PM, Martin Schuster (IFKL IT OS DS CD)
<Ma...@infineon.com> wrote:
> On 10/07/2010 09:22 PM, Jason Russler wrote:
>>   Can the (MD5) password hashes from a shadow file be re-encoded to
>> something Apache DS can understand
>>
> re-encoding is not possible, but you can check which algorithm is used
> in your shadow-file (e.g. if the passwords there start with $1$ it's
> MD5, see crypt(3) for a list), and then check if ApacheDirServer knows
> that algorithm.
>
> Using DirectoryStudio I can see the following hash-algos when setting
> a userPassword: SHA, SSHA, MD5, SMD5, CRYPT
> (don't know if that list is queried from the server or hardcoded into
> DirStudio)
>
> So if you currently have
> $1$PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/
> in /etc/shadow, you can try
> {MD5}PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/

As your example hash is salted, it should be:
{SMD5}PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/

(AFAIK)

Regards, Linus

Re: [ApacheDS] Hash question

[Emmanuel Lecharny <el...@gmail.com>]

  On 10/8/10 3:43 PM, Jason Russler wrote:
>
>>>
>>> So if you currently have
>>> $1$PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/
>>> in /etc/shadow, you can try
>>> {MD5}PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/
>>
>> As your example hash is salted, it should be:
>> {SMD5}PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/
>
> This isn't going to work.  I think Apache DS uses a different sized 
> salt for SMD5 than a typical shadow file - either that or a larger 
> resultant hash value.  Ah, well, I suppose I can use the "migrate" 
> feature of the pam_ldap module.  Too bad, Apache DS appears to be a 
> lot easier to deal with (in every other respect) than the other LDAP 
> systems I've dealt with.  I've very new to it....
>
FYI, we are using the Java MessageDiggest class to encode the password 
in Studio, and we assume in the server that the salt is 8 bytes long :

...
         int algoLength = encryptionMethod.algorithm.getName().length() + 2;
...
             case HASH_METHOD_SMD5:
                 try
                 {
                     // The password is associated with a salt. Decompose it
                     // in two parts, after having decoded the password.
                     // The salt will be stored into the 
EncryptionMethod structure
                     // The salt is at the end of the credentials, and 
is 8 bytes long
                     byte[] passwordAndSalt = Base64.decode( new String( 
credentials, algoLength, credentials.length
                         - algoLength, "UTF-8" ).toCharArray() );

                     int saltLength = passwordAndSalt.length - MD5_LENGTH;
                     encryptionMethod.salt = new byte[saltLength];
                     byte[] password = new byte[MD5_LENGTH];
                     split( passwordAndSalt, 0, password, 
encryptionMethod.salt );

                     return password;
                 }

Here, algoLength is the length for the string "{SMD5}" or whatever 
algorithm you used.

However, you should *not* use MD5 as it's considered broken...

-- 
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com

Re: [ApacheDS] Hash question

[Jason Russler <jr...@helix.nih.gov>]

> Im using OpenLDAP (slapd) and they support shadow hashes at least for
> MD5,SMD5,SHA1,SSHA1.
> You just need to put the correct tag in front of your [salted] hash
> value from /etc/shadow before saving it to userPassword attribute.
>
> Regards, Linus

Yeah, it also comes with migration scripts.  I'm trying to decide on 
which LDAP server to use at our site.  We're running RedHat 5, which 
means I'll have to build OpenLDAP, along with some dependencies to get 
multi-mastering.  Which is fine, but the cleanest solution wins in this 
case.  I may have to go the OpenLDAP  direction though to keep migration 
easy.  Thanks for your help!

-Jason

Re: [ApacheDS] Hash question

[Linus van Geuns <li...@vangeuns.name>]

On Fri, Oct 8, 2010 at 3:43 PM, Jason Russler <jr...@helix.nih.gov> wrote:
>
>>>
>>> So if you currently have
>>> $1$PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/
>>> in /etc/shadow, you can try
>>> {MD5}PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/
>>
>> As your example hash is salted, it should be:
>> {SMD5}PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/
>
> This isn't going to work.  I think Apache DS uses a different sized salt for
> SMD5 than a typical shadow file - either that or a larger resultant hash
> value.  Ah, well, I suppose I can use the "migrate" feature of the pam_ldap
> module.  Too bad, Apache DS appears to be a lot easier to deal with (in
> every other respect) than the other LDAP systems I've dealt with.  I've very
> new to it....

Im using OpenLDAP (slapd) and they support shadow hashes at least for
MD5,SMD5,SHA1,SSHA1.
You just need to put the correct tag in front of your [salted] hash
value from /etc/shadow before saving it to userPassword attribute.

Regards, Linus

Re: [ApacheDS] Hash question

[Jason Russler <jr...@helix.nih.gov>]

>>
>> So if you currently have
>> $1$PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/
>> in /etc/shadow, you can try
>> {MD5}PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/
>
> As your example hash is salted, it should be:
> {SMD5}PzZV2WYK$Asd3JtTFOwR3JnNTPjxDq/

This isn't going to work.  I think Apache DS uses a different sized salt 
for SMD5 than a typical shadow file - either that or a larger resultant 
hash value.  Ah, well, I suppose I can use the "migrate" feature of the 
pam_ldap module.  Too bad, Apache DS appears to be a lot easier to deal 
with (in every other respect) than the other LDAP systems I've dealt 
with.  I've very new to it....