Re: Openldap support SHA-256 or SHA-3.

Subject: Re: Openldap support SHA-256 or SHA-3.

From: Giuseppe De Marco <giuseppe.demarco@unical.it>

Date: Tue, 7 Jan 2020 22:00:04 +0100

Cc: rammohan ganapavarapu <rammohanganap@gmail.com>, openldap-technical <openldap-technical@openldap.org>

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=unical-it.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:cc; bh=pXb3sP8x/vNcZlpGTZnnbHQGXNPvk8gfIZDvE5CXFhM=; b=BJ0u+ozkdd4bGRRNJV/e3WpYxcB0U0i01nJLPIIDqP8aVRe2Y7ce6X0pFD8MHSqRhE gX/7wQt7Mqlo/zbuH7fc4k6jImprdJR0cJvCE8kdtuBZWjXymHD6688ruQ8O+SPhIarB 3vwsN/NAmOIT6ZHmIZkBXDcs2sG0prDaPKpQKI3V6R8IOYeGqIc/3ZKz1iquwJthMbie 9302i88G6SB5Qk0tG3AYiaKBFS0tyUv7OyUJw7PIK04VYjxwkBEGZsjxigs6iLr3v42I C6Lz959swkzH4zBZSlnQBKe4lNlqobggZu+qhagUH1aub82S67mXy/s58krH7xyl92q1 mAeA==

In-reply-to: <1C6038D9E08BE216B90B3FF4@192.168.1.144>

References: <CALm_Vjh4vgOBu8kZrJzRheAyqbZVL0OoE-nRAvc1z+nb-Eow9Q@mail.gmail.com> <67753E9A5A2A2945F035E0CC@192.168.1.144> <CALm_Vji=Mok7kkZ96+EEAu_Osw0rVjBANBrdejKFs=fEr--3HQ@mail.gmail.com> <1C6038D9E08BE216B90B3FF4@192.168.1.144>

I made SSHA512 as default this way

	dn: olcDatabase={-1}frontend,cn=config
	replace: olcPasswordHash
	olcPasswordHash: SSHA512
	EOF

Once pw-sha2 module was loaded

https://github.com/peppelinux/ansible-slapd-eduperson2016/blob/master/roles/slapd_configure/templates/modules/pw-sha2.ldif

Il mar 7 gen 2020, 21:24 Quanah Gibson-Mount <quanah@symas.com> ha scritto:

--On Tuesday, January 7, 2020 11:52 AM -0800 rammohan ganapavarapu
<rammohanganap@gmail.com> wrote:

>
> Quanah,
>
>
> Thanks for the quick reply, is there any plans to make SSHA512 default?

No. As I said, SHA1 is mandated by RFC.

> also is there any migration steps to move from SHA-1 to SSHA512 ?

After deploying the sha2 module, all users must change their password so
the hash gets updated. There is no way to magically convert existing
hashes from SSHA1 to another scheme.

--Quanah

--

Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>