0

I am using OpenLDAP 2.4.23 on Ubuntu 11.04. Every thing is working fine. I am using other server to authenticate via LDAP and that is working well. At the connecting server I am using a configuration file like this:

[ldap]
basedn = ou=Employees,dc=example,dc=com
basedn_filter = personStatus=1
bind_passwd = pass123
bind_user = cn=admin,dc=example,dc=com
cache_size = 100
cache_ttl = 900
enable = true
global_perms = false
group_bind = false
group_rdn =
groupattr = cn
groupmember = member
groupmemberisdn = false
groupname = groupofnames
#host = ldap.example.com
host = 192.168.2.127
manage_groups = false
port = 389

Is there any way I can encrypt the password used to bind to LDAP?

Improve this question

3 Answers 3

Reset to default
2

You could use SSL (or TLS) to encrypt the traffic. The OpenLDAP 2.4 manual has a section on using TLS, as does the OpenLDAP FAQ. The Ubuntu 11.04 manual has a section on LDAP which includes using TLS/SSL. The FreeBSD project (home to some of the best manuals I've seen) has an article on LDAP Authentication which includes a section on configuring LDAP with TLS.

I found this information through a Google search...

Improve this answer
1

No.

The plaintext password is needed to bind to LDAP, so even if it were encrypted in some way, you'd need the key to decrypt it on the system as well (a la having an encrypted SSL key and storing the password to the key in the web server config). Obscurity is not security; leaving the password in plaintext is no less secure than encrypting it with a key that's also in the config.

Set the permissions on your LDAP config to not be world-readable, and if the system can potentially be physically compromised, then use some kind of disk encryption.

Improve this answer
2
  • Are you saying that you can't encrypt with SSL? The OpenLDAP docs, the Ubuntu docs, and the FreeBSD docs all disagree with you.
    – Mei
    Jan 30, 2012 at 23:04
  • @David No, you're absolutely right that SSL/TLS should be used any time you're doing a basic LDAP bind - but the way I interpreted the question is that he was looking for a way to encrypt the plaintext password in the config file. I think it's a little clearer in the original text of the question: Is there any way so than I can use encrypted password in the place of bind_passwd option.
    – Shane Madden
    Jan 30, 2012 at 23:07
1

If your client application allows TLS/EXTERNAL authentication (that is: x509 certificates-based), you could than dispose the clear-text password and substitute it with a client certificate. Please be warned the server requires a couple of configuration changes in order to accept SASL TLS/EXTERNAL.

Improve this answer
1
  • If you are really shy of having a clear-text password in a file, this the way to go. But it might be only cosmetic: as a evil user could read the file, could as well steal the key (if she has the access rights).
    – 473183469
    Nov 20, 2015 at 10:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .