[SOLVED] OpenLDAP sha512 shadow does not work

vahab · 04-17-2014, 01:06 PM

Hello,
I have configured openldap 2.4 for authenticating linux clients.
When I set the shadow of a user with "ssha" algorithm it works fine but when I change it to SHA512 it does not work.
My client is redhat 6.4 and it accepts SHA512 shadows for local accounts but for LDAP accounts it does not work.
Do I need to add something to my LDAP server ?

Thanks in advance,
Vahab

TB0ne · 04-17-2014, 02:12 PM

Quote:

Originally Posted by vahab

Hello,
I have configured openldap 2.4 for authenticating linux clients. When I set the shadow of a user with "ssha" algorithm it works fine but when I change it to SHA512 it does not work. My client is redhat 6.4 and it accepts SHA512 shadows for local accounts but for LDAP accounts it does not work.
Do I need to add something to my LDAP server ?

Did you try looking at the openLDAP documentation, where it tells you how to configure this, and how to test it??
http://www.openldap.org/devel//cvswe...0&sortbydate=1

And since you're using RHEL 6.4, have you contacted Red Hat for assistance, since you're PAYING FOR RHEL, right?? They also have a set of openLDAP documentation on their knowledgebase, which (as a paying subscriber), you have access to.

vahab · 04-17-2014, 08:02 PM

No I just googled and there was nothing useful. I will follow based on doc then.

actually where I live there is no support for RHEL or professionals like you to help and here is my only hope to find a clue and in this case I think is enough to proceed.
Thank you

vahab · 04-17-2014, 08:53 PM

It worked and to let the others who are reading this know :

You need to obtain openldap source

cd openldap-2.4.39
cd ./contrib/slapd-modules/passwd/sha2
make
cp .libs/pw-sha2.so /usr/lib64/openldap

Then you need to load it this way :
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModuleLoad: pw-sha2
olcModulePath: /usr/lib64/openldap

/etc/init.d/slapd restart

From now on, SHA512 hashes would work !

TB0ne · 04-18-2014, 09:21 AM

Quote:

Originally Posted by vahab

No I just googled and there was nothing useful. I will follow based on doc then.

Sorry, but Google has LOTS of information that is useful, and reading/following the instructions should be the absolute FIRST thing you do for ANY problem.

Quote:

actually where I live there is no support for RHEL or professionals like you to help and here is my only hope to find a clue and in this case I think is enough to proceed.

Sorry, that's wrong. Anyone can call Red Hat on the phone, from anywhere in the world. You can also email them from anywhere with an Internet connection (which you obviously have), and you can also get online help. If you're paying for RHEL, you have MANY options on how to contact them.

ariveamar · 03-11-2016, 12:41 AM

But in this section actually you need to edit file "Makefile" and specify LDAP source root right ?
I already specified the soruce root openldap on the path "/etc/openldap/" but still erorr like below :

[root@mail sha2]# make
../../../../libtool --mode=compile gcc -g -O2 -Wall -I../../../../include -I../../../../include -I../../../../servers/slapd -c slapd-sha2.c
make: ../../../../libtool: Command not found
make: *** [slapd-sha2.lo] Error 127

Anyone can help me to solve this case.

Thanks & Regards,

Arief

Quote:

Originally Posted by vahab

It worked and to let the others who are reading this know :

You need to obtain openldap source

cd openldap-2.4.39
cd ./contrib/slapd-modules/passwd/sha2
make
cp .libs/pw-sha2.so /usr/lib64/openldap

Then you need to load it this way :
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModuleLoad: pw-sha2
olcModulePath: /usr/lib64/openldap

/etc/init.d/slapd restart

From now on, SHA512 hashes would work !

anyk · 09-14-2016, 09:19 AM

Quote:

Originally Posted by ariveamar

[root@mail sha2]# make
../../../../libtool --mode=compile gcc -g -O2 -Wall -I../../../../include -I../../../../include -I../../../../servers/slapd -c slapd-sha2.c
make: ../../../../libtool: Command not found
make: *** [slapd-sha2.lo] Error 127

Anyone can help me to solve this case.

Go to the openldap source root directory and run `./configure` first. That creates the libtool script your compiler was complaining about. When you did not compile openldap before, doing so by running `make` is the easiest way to get the dependencies compiled.

e.g. on Debian

Code:

apt-get install git-core build-essential libtool

git clone git://git.openldap.org/openldap.git /usr/src/openldap
cd /usr/src/openldap
./configure
make

cd contrib/slapd-modules/passwd/sha2
make

cp .libs/pw-sha2.so /usr/lib/ldap/