I'm trying to setup PAM/LDAP so that when a logged in SSH user changes their password using passwd
, it encrypts the password with SHA1
before updating the LDAP entry. I have this
# /etc/ldap.conf
...
rootbinddn cn=Manager,dc=ourdomain,dc=com
rootpw secret
pam_crypt local
When a user changes their password using passwd
, in LDAP, the entry looks something like this
{crypt}41H84HEld3
So it's coming over as crypt
. I'm not sure how to force it to be SHA / SHA1
. I tried adding
pam_password sha
to /etc/ldap.conf
but then the password just comes over and is stored in LDAP as clear text.