4

I'm trying to setup PAM/LDAP so that when a logged in SSH user changes their password using passwd, it encrypts the password with SHA1 before updating the LDAP entry. I have this

# /etc/ldap.conf
...
rootbinddn cn=Manager,dc=ourdomain,dc=com
rootpw secret
pam_crypt local

When a user changes their password using passwd, in LDAP, the entry looks something like this

{crypt}41H84HEld3

So it's coming over as crypt. I'm not sure how to force it to be SHA / SHA1. I tried adding

pam_password sha

to /etc/ldap.conf but then the password just comes over and is stored in LDAP as clear text.

1 Answer 1

3

From this source, in RHEL|CentOS 5:

Display Current Hashing Algorithm

Type the following command: # authconfig --test | grep hashing

Sample outputs:

    password hashing algorithm is md5

Configure Linux Server To Use The SHA-512

To configure the Linux system to use the SHA-512 algorithm, enter: # authconfig --passalgo=sha512 --update

Note: users need to change their passwords in order to generate hashes using SHA-512. You can force users to change their password on next login:

    # chage -d 0 userName

I have not tried it (only have CentOS 4 handy), but hope it helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .