Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an OpenSolaris machine here; I'm using it for the first time because I want to try out ZFS. ZFS itself is working great, but I cannot get opensolaris to authenticate against our openldap directory running on Linux with md5 or sha passwords; only crypt passwords work. I'd prefer not to have to use crypt passwords; is there some magic setting I'm missing that will enable md5 passwords to authenticate?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

UNIX LDAP authentication via PAM can happen via two different modules.

The default (at least for *Solaris) is pam_unix, where the OS will actually pull back the passwords stored in LDAP and do a local comparison. In this case, the host OS has to understand the hash method, which is why crypt passwords work but the other hash types don't.

The other mechanism, which I think you need, is pam_ldap, where the task of validating the password is completely passed to the LDAP server. In that case, as long as the LDAP server understands how to do the comparison, you are fine.

The man page for pam_ldap will go into more detail.

You can find an example pam.conf using pam_ldap for opensolaris at: http://docs.oracle.com/cd/E19082-01/819-3194/schemas-111/index.html

Note: always make sure you are keeping a spare root window open when testing PAM changes since it is easy to accidentally break authentication

share|improve this answer
    
Actually, the pam_ldap module did no good for me; I think perhaps my openldap server isn't set up properly for it. However, this did steer me in the right direction, which was to enable md5crypt passwords instead of straight up md5 passwords, and then use pam_unix. Solaris apparently understands md5crypt just fine. In my particular case (I'm using the smbldap tools) this involves putting # Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT) hash_encrypt="CRYPT" crypt_salt_format='$1$%.8s' into smbldap.conf –  palmer Nov 25 '09 at 16:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.