New subject: [Fedora-directory-users] MD5 for password hashes

24 Sep 2005


      Hi,
I did some digging on this issue.  I suspect I have found a bug
in Fedora Directory Server handling the importing of MD5 passwords,
either that or the current download versions don't support MD5.
The results are as follows:
--
Run this command on OpenLDAP to set a user's password:
ldappasswd -x -D 'uid=root,ou=People,dc=babel,dc=com,dc=au' -W -S 
'uid=del,ou=People,dc=babel,dc=com,dc=au'
Do a simple ldapsearch as that user, to verify that the password is correct:
ldapsearch -x -D 'uid=del,ou=People,dc=babel,dc=com,dc=au' -W 'uid=del'
If you have set your OpenLDAP permissions to be relatively transparent, 
the above ldapsearch will show a base64 representation of your password 
hash. It looks like this:
userPassword:: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=
You can un-base64 this hash with the following simple perl script:
#!/usr/bin/perl
#
# Usage:  $0 string
#
use MIME::Base64;
my $data = $ARGV[0];
print("Input string is " . $data . "n");
$decoded = decode_base64($data);
print("Decoded string is " . $decoded . "n");
You will see that the password contains the prefix {MD5}, which looks 
like this:
Decoded string is {MD5}asdfasdfasdfasdfasdf==
Import your OpenLDAP directory into Fedora Directory Server.  I used
LdapImport for this although I also tried it with ldif2db.
What happens during the process of LdapImport is:
* Passwords of type {CRYPT} are transferred across OK to the 
FedoraDirectoryServer.
* Passwords of type {MD5} appear in the FedoraDirectoryServer as strings 
beginning with {SSHA}. This can be verified by examining the directory 
using GQ or a similar LDAP tool, while bound as "cn=Directory Manager".
* Attempts to authenticate with the original password now fail.
* Attempting to authenticate as the full MD5 string (i.e. use the hash 
string '{MD5}asdfasdf...==' as extracted from the OpenLDAP server as the 
password for Fedora Directory Server) in fact works.
I expect that what has happened is that Fedora Directory Server has
failed to recognise the {MD5} at the beginning of the string as a valid
hash mechanism and re-encoded the entire string as an SSHA hash.
I see that on the FDS wiki there is mention of MD5 hashing support
being added on June 15th.  I have fedora-ds-7.1-2.RHEL4 installed from
the RPM I downloaded from the FDS web site.  How do I verify that this
version should have the MD5 support, or do I need a more recent version?
-- 
Del

Re: [Fedora-directory-users] MD5 for password hashes