Does openldap support pbkdf2 hash algorithm

hashopenldappassword

Since pbkdf2 (Password-Based Key Derivation Function 2) is a more secure hash function, so I wonder if current openldap implementation support pbkdf2 (pbkdf2_sha256 for example)?

I have found some information on google about pbkdf2 support in openldap, but I do not sure which openldap version it applies or I do not do it the right way:

I have build a openldap server with version 2.4.28 on ubuntu 12.04 and use python lib to generate a PBKDF2-SHA256 hashed password. Then I put this PBKDF2-SHA256 password into a new ldap user's userPassword field as follow:

userPassword: '{PBKDF2-SHA256}10000$LBwTpUPGqxdH$8pDqhAruY94IhhuCZLost471pGImy//wH0pS25LO/YI='

This did not work. No error reported in ldap log but still can not login with the original plain-text password.

I would greatly appreciate it if someone could kindly give me some comment or direction!!

Best Answer

Currently, OpenLDAP PBKDF2 module only support PBKDF2-SHA1. The schema name is {PBKDF2}. Probably, it have compatibility with Python Passlib. I have roadmap for PBKDF2-SHA256 and PBKDF2-SHA512. but not implemented yet.

EDIT: Now supported PBKDF2-SHA256 and PBKDF2-SHA512. https://github.com/hamano/openldap-pbkdf2

Related Solutions

Debian Security – Enable Blowfish-Based Hash Support for Crypt

The package you need to install in debian is libpam-unix2.

Then you will have to edit the following files under /etc/pam.d/, and change all pam_unix.so usage to pam_unix2.so:

common-account
common-auth
common-password
common-session

Finally, edit common-password file and replace "md5" parameter with "blowfish".

Passwords that are updated after these modifications are made will be hashed using blowfish. Existing shadow passwords are not modified. Source

To use blowfish in PHP, you provide a blowfish salt to crypt(). Like this:

crypt('sting', '$2a$07$' . substr('saltsaltsalt', 0, CRYPT_SALT_LENGTH) )

You should first check if CRYPT_BLOWFISH==1. And you'll need to use a long enough salt, which is equal to (or greater than) 22 characters. Source

Security – PBKDF2 (or BCrypt) hash implementation for Apache HTTPD or APR

So after further review, it seems that everything was a lot simpler than I'd imagined.

HTTPD uses the system provided crypt function, and so leverages its modularity.

http://en.wikipedia.org/wiki/Crypt_(Unix)#Modular_crypt.283.29_Algorithms

In theory it supports BCrypt directly (although I did not test it). I did test SHA-512 using the $6 prefix.

So setting a password as calculated below achieves the desired result:

salt = 'fGn9LR75';
puts 'quohjo5oor4ac3Deolei'.crypt('$6$' + salt);
=>    
"$6$fGn9LR75$juRSrMtKBa8pdZ8tbTouUvDItoF9Fp.LVk8Kqv2ZL5T.R.q/nUQNGePve1Ge/8rDf/xqUwgpY.3F1MQ0qtauf0"

Best Answer

Related Solutions

Debian Security – Enable Blowfish-Based Hash Support for Crypt

Security – PBKDF2 (or BCrypt) hash implementation for Apache HTTPD or APR

Related Topic