I have a lot of boxes that are all local user accounts. We want to start consolidating them into an Active Directory system. (I know... I know.. It has to be Active Directory, not openldap, kerberos or anything like that) I am looking for some way to not only move the accounts, but most importantly move the passwords that are already encrypted.

Is there any sort of PAM libraries or other types of scripts that could be used to just move from one setup to another?

  • So, I guess the problem is that any way I look at this, AD needs to have the password in clear text before it can be added to an AD system. – RaginBajin Jul 21 '10 at 13:21

The issue that I see is that local unix passwords are salted hashes. I don't think ActiveDirectory does, and there is no way to get from a salted hash to a plaintext password. To do this you would have to essentially sniff the password as the user enters it and validates it against the hash. You can do this (it may or may not be easy), but it is wrong in principle.

Why are you so reluctant to change passwords? I would investigate that first, because it seems to me that whatever the reason behind that reluctance, it is probably a security concern.

  • We are reluctant to have them change passwords, because we have over 400 users and getting them to do anything takes a bit of organization. Also, We are only using AD for part of the infrastructure and not everything, so we are not going to link this AD system to any linux boxes. – RaginBajin Jul 21 '10 at 13:18
  • That makes sense, but it sounds like you have a password security issue brewing where people are likely to choose insecure passwords and leave them long enough that they might get guessed. – Slartibartfast Jul 22 '10 at 3:11

This seems impossible to me as well. This is why, for future reference, people put a lot of effort into Kerberos authentication on Linux boxes, or going full on Windows domain compatibility with Samba/Winbind. It nips this problem in the bud.

So, if your users already have parallel domain accounts they do not use on the Linux boxes, what would be easier is the reverse: getting Kerberos authentication that underlies AD to work on the Linux boxes, and change the PAM to prioritize authentication with AD/Kerb before local authentication subsystems. Not sure if that makes sense, but you have hope if that is possible for you. That is not as bad as it sounds.

  • They don't have any parallel systems in place. This would be an add on that we do to produce an AD network for people to use. Maybe if everyone thought the AD system was successful we could move it over, but that is a long way from a reality. – RaginBajin Jul 21 '10 at 13:19
  • @RaginBajin I hear you. I re-read the question and the comments. I have been in your position before, and those users live in their own little paradise as a result. Sorry if I was pedantic, it seems like you are well aware of alternatives based on your comments. – songei2f Jul 21 '10 at 13:43
  • No need to apologize. Thanks for the ideas though, I appreciate it. – RaginBajin Jul 21 '10 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.