ldapopenldapsalt-cryptographysha512sha2

Is possible to configure OpenLDAP Crypt passwords without using a salt?


From the docs I got this config that works but use a salt,

password-hash {CRYPT} password-crypt-salt-format "$6$%.16s"

and I need to store passwords in the LDAP directory that have been generated without salt encryption.


Solution

  • You had better to use another password storage scheme that does not do salting like {SHA} or {MD5} instead of {CRYPT} :

    password-hash {SHA}
    

    If using {CRYPT} is a requirement :

    See slapd.conf(5)

    Note that a lack of salt exposes your system to dictionary attacks.