Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm struggling to get CentOS to authenticate users via ApacheDS when the userPassword is encrypted with SSHA or SHA. Crypt works fine but due to restrictions of other services I really need this authd by SSHA.

Has anyone else had this problem? I'm sure I'm missing something but I can't see a value to set for allowing pam_ldap to authd by SSHA.

Cheers, -Ed

share|improve this question
up vote 0 down vote accepted

Sorry, I figured out what the problem was.

You can authenticate just fine using {crypt} in userPassword for a posixAccount even if you don't add in the relevant changes to /etc/pam.d/system-auth. I was thrown off by this.

Once I added:

auth        sufficient use_first_pass
account     sufficient
password    sufficient ssha use_authtok use_first_pass
session     optional

It worked just fine against {SHA} and {SSHA} encrypted userPassword in each posixAccount.

Also, oddly enough doing getent shadow <user> will only show the password if you have a {crypt} encrypted userPassword in the posixAccount. It never shows up for anything else.

Cheers, -Ed

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.