10

I would like to store user credentials in an OpenLDAP or similar directory server.

A lot of online commentary about storing passwords in modern contexts recommends using password derivation schemes like PBKDF2, bcrypt and scrypt. It looks like OpenLDAP offers salted SHA1 as it's "most secure" storage option.

Two questions:

  • Is Salted SHA strong enough to protect passwords in the event of compromise?
  • What are my options for hardening password storage on OpenLDAP?
Improve this question

1 Answer 1

Reset to default
3

Ok, so I found some resources that are helping me to answer my question.

  • There is a module that allows you to use PBKDF2 with either SHA1, SHA256 or SHA 512. This is probably the best solution for most situations. (See: https://github.com/hamano/openldap-pbkdf2 )
  • Alternatively, you can use the local Unix/Linux crypt facility, and configure OpenLDAP to salt the passwords. YMMV will vary by platform. AlgorithmsAvailable hashes on RHEL 7.1 include MD5, Blowfish, SHA-256 and SHA-512 according to the crypt(3) manpage.

For my situation, salted general purpose hashes don't cut the mustard, so the first option is the best solution.

Improve this answer
1
  • This is not correct, let LDAP manage password hashing. That's why the password extend modify operation is for. See more here tech.wrighting.org/2013/06/… This way you don't have to worry about hashing password on client side as well as making sure ldap password hasing is configured the same way.
    – user1159819
    Apr 26, 2016 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .