I'm trying to setup PAM/LDAP so that when a logged in SSH user changes their password using passwd, it encrypts the password with SHA1 before updating the LDAP entry. I have this

# /etc/ldap.conf
rootbinddn cn=Manager,dc=ourdomain,dc=com
rootpw secret
pam_crypt local

When a user changes their password using passwd, in LDAP, the entry looks something like this


So it's coming over as crypt. I'm not sure how to force it to be SHA / SHA1. I tried adding

pam_password sha

to /etc/ldap.conf but then the password just comes over and is stored in LDAP as clear text.


From this source, in RHEL|CentOS 5:

Display Current Hashing Algorithm

Type the following command: # authconfig --test | grep hashing

Sample outputs:

    password hashing algorithm is md5

Configure Linux Server To Use The SHA-512

To configure the Linux system to use the SHA-512 algorithm, enter: # authconfig --passalgo=sha512 --update

Note: users need to change their passwords in order to generate hashes using SHA-512. You can force users to change their password on next login:

    # chage -d 0 userName

I have not tried it (only have CentOS 4 handy), but hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.