Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using OpenLDAP 2.4.23 on Ubuntu 11.04. Every thing is working fine. I am using other server to authenticate via LDAP and that is working well. At the connecting server I am using a configuration file like this:

[ldap]
basedn = ou=Employees,dc=example,dc=com
basedn_filter = personStatus=1
bind_passwd = pass123
bind_user = cn=admin,dc=example,dc=com
cache_size = 100
cache_ttl = 900
enable = true
global_perms = false
group_bind = false
group_rdn =
groupattr = cn
groupmember = member
groupmemberisdn = false
groupname = groupofnames
#host = ldap.example.com
host = 192.168.2.127
manage_groups = false
port = 389

Is there any way I can encrypt the password used to bind to LDAP?

share|improve this question

2 Answers 2

You could use SSL (or TLS) to encrypt the traffic. The OpenLDAP 2.4 manual has a section on using TLS, as does the OpenLDAP FAQ. The Ubuntu 11.04 manual has a section on LDAP which includes using TLS/SSL. The FreeBSD project (home to some of the best manuals I've seen) has an article on LDAP Authentication which includes a section on configuring LDAP with TLS.

I found this information through a Google search...

share|improve this answer

No.

The plaintext password is needed to bind to LDAP, so even if it were encrypted in some way, you'd need the key to decrypt it on the system as well (a la having an encrypted SSL key and storing the password to the key in the web server config). Obscurity is not security; leaving the password in plaintext is no less secure than encrypting it with a key that's also in the config.

Set the permissions on your LDAP config to not be world-readable, and if the system can potentially be physically compromised, then use some kind of disk encryption.

share|improve this answer
    
Are you saying that you can't encrypt with SSL? The OpenLDAP docs, the Ubuntu docs, and the FreeBSD docs all disagree with you. –  Mei Jan 30 '12 at 23:04
    
@David No, you're absolutely right that SSL/TLS should be used any time you're doing a basic LDAP bind - but the way I interpreted the question is that he was looking for a way to encrypt the plaintext password in the config file. I think it's a little clearer in the original text of the question: Is there any way so than I can use encrypted password in the place of bind_passwd option. –  Shane Madden Jan 30 '12 at 23:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.