Join Log in
Score:0
avatar Server

How to check ldap password storage policy

cn flag
joaerl

How do I check how passwords are stored in a local running OpenLDAP server? I would prefer some sort of query that will state the used configuration. Alternatively, accessing the stored passwords to see that they are encrypted would also be acceptable. Just checking the config file is not sufficient.

I have listed the users with their passwords using ldapsearch

ldapsearch -x -b ou=people -H ldap://127.0.0.1 -D cn=admin -w <password>

and the passwords are not listed in clear text, but does that really confirm they are not stored in clear text, or do ldapsearch encrypt them before returning results?

262
0 + 0
Score:1
avatar Server
td flag
bob

I have listed the users with their passwords using ldapsearch and the passwords are not listed in clear text, but does that really confirm they are not stored in clear text?

Yes, no, maybe.

I think ldapsearch and for example a password policy overlay do not replace stored clear text passwords with an encrypted or hashed version in search responses. Encryption/hashing of cleartext passwords only occurs when passwords are set/updated. I think that in that regard you can trust what ldapsearch shows you.

But both ldapsearch and slapcat display userPassword in base64-encoded format. A double colon :: after the attribute name is used to indicate that the value is base64-encoded.

 userPassword:: c2VjcmV0LXBhc3N3b3JkCg==
 userPassword:: e1NTSEF9RGtNVHdCbCthLzNEUVR4Q1lFQXBkVXROWEdnZFVhYzMK

You won't actually know until you decode that base64 character string if the password is hashed or clear text. If you find only passwords in the form of {hash prefix}salt/value:

 userPassword: {SSHA}DkMTwBl+a/3DQTxCYEApdUtNXGgdUac3
 userPassword: {SSHA}d0Q0626PSH9VUld7yWpR0k6BlpQmtczb
 userPassword: {CRYPT}$1$czBJdDqS$TmkzUAb836oMxg/BmIwN.1
 userPassword: {MD5}Xr4ilOzQ4PCOq3aQ0qbuaQ==
 userPassword: {SMD5}4QWGWZpj9GCmfuqEvm8HtZhZS6E=

then you're good. Passwords without such a prefix are plain text.

Just checking the config file is not sufficient.

Indeed. When the password hashing/encryption is enabled/changed neither existing clear text passwords nor existing passwords encrypted with different algorithms are converted.
As far as I'm aware after changing the default password policy existing clear text and passwords hashed with other algorithms will also not stop working either, the ldap daemon simply iterates through all supported mechanisms whenever an authentication request is made.

To inspect the contents of the actual stored data in OpenLDAP the easiest is probably exporting the database to a readable LDIF format with slapcat ; extract all userPassword attribute values from that LDIF and base64 decode them.

0 + 0
cn flag
joaerl
Thank you so much Bob, this answers my question! I didn't realize it was base64 encoded. Also great tip on the prefixes and how existing passwords are not converted.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.