Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm struggling to get CentOS to authenticate users via ApacheDS when the userPassword is encrypted with SSHA or SHA. Crypt works fine but due to restrictions of other services I really need this authd by SSHA.

Has anyone else had this problem? I'm sure I'm missing something but I can't see a value to set for allowing pam_ldap to authd by SSHA.

Cheers, -Ed

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Sorry, I figured out what the problem was.

You can authenticate just fine using {crypt} in userPassword for a posixAccount even if you don't add in the relevant changes to /etc/pam.d/system-auth. I was thrown off by this.

Once I added:

auth        sufficient    pam_ldap.so use_first_pass
account     sufficient    pam_ldap.so
password    sufficient    pam_ldap.so ssha use_authtok use_first_pass
session     optional      pam_ldap.so

It worked just fine against {SHA} and {SSHA} encrypted userPassword in each posixAccount.

Also, oddly enough doing getent shadow <user> will only show the password if you have a {crypt} encrypted userPassword in the posixAccount. It never shows up for anything else.

Cheers, -Ed

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.