Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup PAM/LDAP so that when a logged in SSH user changes their password using passwd, it encrypts the password with SHA1 before updating the LDAP entry. I have this

# /etc/ldap.conf
...
rootbinddn cn=Manager,dc=ourdomain,dc=com
rootpw secret
pam_crypt local

When a user changes their password using passwd, in LDAP, the entry looks something like this

{crypt}41H84HEld3

So it's coming over as crypt. I'm not sure how to force it to be SHA / SHA1. I tried adding

pam_password sha

to /etc/ldap.conf but then the password just comes over and is stored in LDAP as clear text.

share|improve this question
add comment

1 Answer

From this source, in RHEL|CentOS 5:

Display Current Hashing Algorithm

Type the following command: # authconfig --test | grep hashing

Sample outputs:

    password hashing algorithm is md5

Configure Linux Server To Use The SHA-512

To configure the Linux system to use the SHA-512 algorithm, enter: # authconfig --passalgo=sha512 --update

Note: users need to change their passwords in order to generate hashes using SHA-512. You can force users to change their password on next login:

    # chage -d 0 userName

I have not tried it (only have CentOS 4 handy), but hope it helps.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.