1

I have an OpenSolaris machine here; I'm using it for the first time because I want to try out ZFS. ZFS itself is working great, but I cannot get opensolaris to authenticate against our openldap directory running on Linux with md5 or sha passwords; only crypt passwords work. I'd prefer not to have to use crypt passwords; is there some magic setting I'm missing that will enable md5 passwords to authenticate?

1 Answer 1

1

UNIX LDAP authentication via PAM can happen via two different modules.

The default (at least for *Solaris) is pam_unix, where the OS will actually pull back the passwords stored in LDAP and do a local comparison. In this case, the host OS has to understand the hash method, which is why crypt passwords work but the other hash types don't.

The other mechanism, which I think you need, is pam_ldap, where the task of validating the password is completely passed to the LDAP server. In that case, as long as the LDAP server understands how to do the comparison, you are fine.

The man page for pam_ldap will go into more detail.

You can find an example pam.conf using pam_ldap for opensolaris at: http://docs.oracle.com/cd/E19082-01/819-3194/schemas-111/index.html

Note: always make sure you are keeping a spare root window open when testing PAM changes since it is easy to accidentally break authentication

1
  • Actually, the pam_ldap module did no good for me; I think perhaps my openldap server isn't set up properly for it. However, this did steer me in the right direction, which was to enable md5crypt passwords instead of straight up md5 passwords, and then use pam_unix. Solaris apparently understands md5crypt just fine. In my particular case (I'm using the smbldap tools) this involves putting # Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT) hash_encrypt="CRYPT" crypt_salt_format='$1$%.8s' into smbldap.conf
    – palmer
    Nov 25, 2009 at 16:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .