Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup PAM/LDAP so that when a logged in SSH user changes their password using passwd, it encrypts the password with SHA1 before updating the LDAP entry. I have this

# /etc/ldap.conf
rootbinddn cn=Manager,dc=ourdomain,dc=com
rootpw secret
pam_crypt local

When a user changes their password using passwd, in LDAP, the entry looks something like this


So it's coming over as crypt. I'm not sure how to force it to be SHA / SHA1. I tried adding

pam_password sha

to /etc/ldap.conf but then the password just comes over and is stored in LDAP as clear text.

share|improve this question

From this source, in RHEL|CentOS 5:

Display Current Hashing Algorithm

Type the following command: # authconfig --test | grep hashing

Sample outputs:

    password hashing algorithm is md5

Configure Linux Server To Use The SHA-512

To configure the Linux system to use the SHA-512 algorithm, enter: # authconfig --passalgo=sha512 --update

Note: users need to change their passwords in order to generate hashes using SHA-512. You can force users to change their password on next login:

    # chage -d 0 userName

I have not tried it (only have CentOS 4 handy), but hope it helps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.