Let me repeat using different words which Howard and others have already explained to you.
Password-based mechanisms require the client to knowledge of the actual password. That password is either provided by a human or read from a password store. Hashed password stores are no useful to a client as they, by design, don't provide access to actual password. Encryption of the password store is pointless security wise. The decryption key would have to protected as it were the actual password. No OpenLDAP client, including slurpd, supports encrypted passwords stores. sasldb is not actually an encrypted password store. It's a store of actual passwords of multiple users. Access to sasldb should be restricted to the few SASL servers that need access to it. Kurt At 04:14 PM 8/11/2006, Steven Wong wrote: >My main point is to not have the passwd in "plain text" in my slapd.conf. I >want to have it encrypted. >I thought SASL would provide me with this facility, such that is would look at >the /etc/sasldb file for it on the master, then with it, then send >that/unencrypted to the slave ldap server for authentication. > >Or if this thought of mine is wrong, let me know what I need to do or correct >to make it possible.. > >Thanks, >Steven > >----- Original Message ---- >From: Kurt D. Zeilenga <[EMAIL PROTECTED]> >To: Steven Wong <[EMAIL PROTECTED]> >Cc: Howard Chu <[EMAIL PROTECTED]>; Aaron Richton <[EMAIL PROTECTED]>; >openLDAP software <[email protected]> >Sent: Tuesday, August 8, 2006 12:28:33 PM >Subject: Re: slurpd -d9 --- Invalid credentials > >At 11:54 AM 8/8/2006, Steven Wong wrote: >> I was wondering if there are any Howto's for LDAP, SSL, with SASL, without >> Kerberos. > >The basic OpenLDAP SASL tutorial is: > 1) get Cyrus SASL working first (using their client programs > with service set to "ldap" and daemon name set to "slapd"). > (use Cyrus SASL mailing list to resolve issues) > 2) then apply lessons learned in 1 to getting OpenLDAP working > >The basic OpenLDAP TLS/SSL tutorial is: > 1) get OpenSSL working first (using s_server/s_client) > (use OpenSSL list to resolve issues) > 2) then apply lessons learned in 1 to getting OpenLDAP working > >-- Kurt
