Re: userPasswd Attribute

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

Net Warrior writes:
> Hi there guys, what I'm going to ask may be is insane, and I'm
> awaiting the storm to come :)

Yes, it is:-)

> I know that there is a directive/option password-hash that allows me to
> store the password in plain taxt for example or whatever I want.

Not exactly.  If you modify a password with the Password Modify LDAP
operation, the server will hash it before storing it.  See the
password-hash directive in the slapd.conf(5) manpage for how, and which
hash scemes are available.  The one you ask for is {CLEARTEXT}.

OTOH when you store a userPassword with the regular LDAP Add or Modify
operations, it is stored exactly as you provided it.  E.g. in cleartext
if you sent it it cleartext.  Or as userPassword: {hash-scheme}hashvalue
if you send that.

> As far as I know, this only apllies to the server,

Looks like you mean the master server.

> If I set up a replication server, is there a way to tell the
> replication server to store in difefferent format , for exmaple, to
> store them in plain text?

Turning a hashed password into a cleartext password is known as cracking
the password.  If a server (master, replication server or client) can do
that, so can an attacker.

On the other hand if the master server has the cleartext password and
you want a slave server to have a hashed password, I suppose an overlay
in the slave could handle that.  Intercept modify/add operations and act
like Password Modify.  I seem to remember someone had written such an
overlay, but I don't remember where it is.

-- 
Hallvard