LDAP-UX password hashing on OpenLDAP

[Markus Gerber]

Hello everybody,

I'm authenticating HP-UX und Linux users against an OpenLDAP 2.4.8 server. The setup of the Linux servers was no Problem. But the HP-UX machines needed a little bit more effort. Now also her the authentication works.

But using the passwd command under HP-UX to change the users password, the password stored within the server is not hashed. It is simply stored with BASE64 encoding (what can be decoded very easy).

Is there a way for the LDAP-UX Software to use the extened operation from the OpenLDAP server? Or is there another way to hash the password?

Thanks in advance for all help.

Regards, Markus

[Weltman, Ulf · Accepted solution]

Hello, no, current LDAP-UX (4.x) releases do not support the password change extop, only userPassword mod-replace.
With the latter method some LDAP servers will hash the userPassword values, but I believe OpenLDAP does not.

[Markus Gerber]

So you see no way to hash the password?

What would be necessary to make it possible? Install OpenLDAP on HPUX or should I use a different LDAP Server?

[Weltman, Ulf]

I'm not an expert on OpenLDAP and don't know of any way of doing it. It's possible they have an overlay for it.

If you're not tied to OpenLDAP then running Directory Server on HP-UX certainly works well with LDAP-UX. It's the most thoroughly tested combination as Directory Server is also fully supported by HP. It should be part of your OE but you may want to update to the most recent release (there should be a link to the NDS/RHDS documentation there too):

http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=NSDirSvr7