On 7/6/10 11:44 PM, Bryan Boone wrote:
Hi everyone. I just read this information.
14.4. Password Storage
LDAP passwords are normally stored in the userPassword attribute. RFC4519
specifies that passwords are not stored in encrypted (or hashed) form.
*encrypted*. Not encrypted *or* hashed.
Encrypted is really different from Hashed. Encryption means you have a
way to decrypt the password. Hashing does not offer this possibility.
This allows a wide range of password-based authentication mechanisms, such as
DIGEST-MD5 to be used. This is also the most interoperable storage scheme.
However, it may be desirable to store a hash of password instead. slapd(8)
supports a variety of storage schemes for the administrator to choose from.
If it is not typical to store passwords in LDAP in hashed form.
All the existing ldap servers support hashed passwords. Usually, the
mechanism is stored in frm of the encrypted password like :
{MD5}XXXXXXX
or
{crypt}YYYYYYYYY
Then how are you supposed to bind to LDAP without transmitting the clear
text password across the network?
Even if the password is hashed ( you still have to pass the password in
clear text ).
I understand that SSL and Kerberos will fix this problem, but what if a user
just wants to use plain LDAP?
Ask this user his bank account number and his password... There is no
reason for him to refuse to give you such information if he accepts the
idea that his password will be transmitted in clear.
Hey, it's not like if this is a unsafe planet where some bad bad people
are willing to use those information to spam or send scams. We are all
living in a peaceful and honest world... ;)
Would I need to dictate to a customer that they must use a hash alg. in the
userPassword in this case?
You just need to explain this customer the very basis of what is security.
Or may be point him to http://www.ietf.org/rfc/rfc4513.txt, 6.3.3.
Password-Related Security Considerations :
"...The use of clear text passwords and other unprotected authentication
credentials is strongly discouraged over open networks when the
underlying transport service cannot guarantee confidentiality. LDAP
implementations SHOULD NOT by default support authentication methods
using clear text passwords and other unprotected authentication
credentials unless the data on the session is protected using TLS or
other data confidentiality and data integrity protection..."
--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com
