Is it possible to convert linux salted sha512 password hash to LDAP format?
We have an LDAP server which stores passwords and other user data.
The server is not used for authentication of client machines though but only for authentication of client apps.
So users change their passwords locally on their clients.
As long as we used crypt I could just store the linux hashes as {CRYPT}$hash in LDAP and it worked fine.
Now the passwords are stored as salted sha512 hashes
and the password format in /etc/shadow is like this:
printf( "$6$%s$%s", $salt, $hash )
$salt seems to be just an ASCII string
I think $hash the base64 encoded result of the sha512 digest from the concatenation of $plainPW and $salt but I am not sure.
LDAP instead stores password hashes like this:
printf( "{SSHA512}%s", $_96byteString )
where $_96byteString is the base64 encoded result of the concatenation of 512bits of the $saltedPWhash and $salt
I tried to base64_decode the $hash, append the $salt, base64_encode the result and store it as the $_96byteString in the above LDAP format.
Alas LDAP fails to authenticate with this, a simple ldapbind just fails.
Does anybody know how to convert linux sha512 hashes so that the LDAP server accepts it as valid?
I have found that linux crypt uses a different base64 encoding than standard mime.
The standard uses [A-Za-z0-9+/] whereas crypt uses [./0-9A-Za-z].
So I tried to convert with tr but the result still fails :-(
password character-encoding ldap base64
edited Mar 21 '16 at 7:24
user167328
31
asked Mar 8 '16 at 12:43
user333869user333869
493
bumped to the homepage by Community♦ 15 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
We have an LDAP server which stores passwords and other user data.
The server is not used for authentication of client machines though but only for authentication of client apps.
So users change their passwords locally on their clients.
As long as we used crypt I could just store the linux hashes as {CRYPT}$hash in LDAP and it worked fine.
Now the passwords are stored as salted sha512 hashes
and the password format in /etc/shadow is like this:
printf( "$6$%s$%s", $salt, $hash )
$salt seems to be just an ASCII string
I think $hash the base64 encoded result of the sha512 digest from the concatenation of $plainPW and $salt but I am not sure.
LDAP instead stores password hashes like this:
printf( "{SSHA512}%s", $_96byteString )
where $_96byteString is the base64 encoded result of the concatenation of 512bits of the $saltedPWhash and $salt
I tried to base64_decode the $hash, append the $salt, base64_encode the result and store it as the $_96byteString in the above LDAP format.
Alas LDAP fails to authenticate with this, a simple ldapbind just fails.
Does anybody know how to convert linux sha512 hashes so that the LDAP server accepts it as valid?
I have found that linux crypt uses a different base64 encoding than standard mime.
The standard uses [A-Za-z0-9+/] whereas crypt uses [./0-9A-Za-z].
So I tried to convert with tr but the result still fails :-(
password character-encoding ldap base64
edited Mar 21 '16 at 7:24
user167328
31
asked Mar 8 '16 at 12:43
user333869user333869
493
bumped to the homepage by Community♦ 15 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
Not sure what is you intend, user change password usingpasswdon any client, then a shell script insert new password in AD ? It might be easiest (altough not that simple) to authenticate user using AD.
– Archemar
Mar 8 '16 at 13:44
Yes, users change passwords using passwd on any client + shell script inserting new password in local LDAP (not AD). Linux users are not allowed in AD in our company. Our LDAP server is not high available and we do not authenticate logins against it but only some applications. As long as we used crypt, the passwords could be inserted into ldap as is and everything worked fine. With ssha512 the format in linux is different to ldap and I don't know how to convert it.
– user333869
Mar 9 '16 at 7:44
Today I created a hash with perl{SHA512}" . MIME::Base64::encode( Digest::SHA::sha512( $plainPW ), '' )and this works with LDAP. So it is just the salt that gives me headaches.
– user333869
Mar 9 '16 at 11:25
add a comment |
We have an LDAP server which stores passwords and other user data.
The server is not used for authentication of client machines though but only for authentication of client apps.
So users change their passwords locally on their clients.
As long as we used crypt I could just store the linux hashes as {CRYPT}$hash in LDAP and it worked fine.
Now the passwords are stored as salted sha512 hashes
and the password format in /etc/shadow is like this:
printf( "$6$%s$%s", $salt, $hash )
$salt seems to be just an ASCII string
I think $hash the base64 encoded result of the sha512 digest from the concatenation of $plainPW and $salt but I am not sure.
LDAP instead stores password hashes like this:
printf( "{SSHA512}%s", $_96byteString )
where $_96byteString is the base64 encoded result of the concatenation of 512bits of the $saltedPWhash and $salt
I tried to base64_decode the $hash, append the $salt, base64_encode the result and store it as the $_96byteString in the above LDAP format.
Alas LDAP fails to authenticate with this, a simple ldapbind just fails.
Does anybody know how to convert linux sha512 hashes so that the LDAP server accepts it as valid?
I have found that linux crypt uses a different base64 encoding than standard mime.
The standard uses [A-Za-z0-9+/] whereas crypt uses [./0-9A-Za-z].
So I tried to convert with tr but the result still fails :-(
password character-encoding ldap base64
edited Mar 21 '16 at 7:24
user167328
31
asked Mar 8 '16 at 12:43
user333869user333869
493
We have an LDAP server which stores passwords and other user data.
The server is not used for authentication of client machines though but only for authentication of client apps.
So users change their passwords locally on their clients.
As long as we used crypt I could just store the linux hashes as {CRYPT}$hash in LDAP and it worked fine.
Now the passwords are stored as salted sha512 hashes
and the password format in /etc/shadow is like this:
printf( "$6$%s$%s", $salt, $hash )
$salt seems to be just an ASCII string
I think $hash the base64 encoded result of the sha512 digest from the concatenation of $plainPW and $salt but I am not sure.
LDAP instead stores password hashes like this:
printf( "{SSHA512}%s", $_96byteString )
where $_96byteString is the base64 encoded result of the concatenation of 512bits of the $saltedPWhash and $salt
I tried to base64_decode the $hash, append the $salt, base64_encode the result and store it as the $_96byteString in the above LDAP format.
Alas LDAP fails to authenticate with this, a simple ldapbind just fails.
Does anybody know how to convert linux sha512 hashes so that the LDAP server accepts it as valid?
I have found that linux crypt uses a different base64 encoding than standard mime.
The standard uses [A-Za-z0-9+/] whereas crypt uses [./0-9A-Za-z].
So I tried to convert with tr but the result still fails :-(
password character-encoding ldap base64
password character-encoding ldap base64
edited Mar 21 '16 at 7:24
user167328
31
asked Mar 8 '16 at 12:43
user333869user333869
493
edited Mar 21 '16 at 7:24
user167328
31
asked Mar 8 '16 at 12:43
user333869user333869
493
edited Mar 21 '16 at 7:24
user167328
31
edited Mar 21 '16 at 7:24
user167328
31
edited Mar 21 '16 at 7:24
user167328
31
31
asked Mar 8 '16 at 12:43
user333869user333869
493
asked Mar 8 '16 at 12:43
user333869user333869
493
asked Mar 8 '16 at 12:43
user333869user333869
493
493
bumped to the homepage by Community♦ 15 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 15 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
Not sure what is you intend, user change password usingpasswdon any client, then a shell script insert new password in AD ? It might be easiest (altough not that simple) to authenticate user using AD.
– Archemar
Mar 8 '16 at 13:44
Yes, users change passwords using passwd on any client + shell script inserting new password in local LDAP (not AD). Linux users are not allowed in AD in our company. Our LDAP server is not high available and we do not authenticate logins against it but only some applications. As long as we used crypt, the passwords could be inserted into ldap as is and everything worked fine. With ssha512 the format in linux is different to ldap and I don't know how to convert it.
– user333869
Mar 9 '16 at 7:44
Today I created a hash with perl{SHA512}" . MIME::Base64::encode( Digest::SHA::sha512( $plainPW ), '' )and this works with LDAP. So it is just the salt that gives me headaches.
– user333869
Mar 9 '16 at 11:25
add a comment |
Not sure what is you intend, user change password usingpasswdon any client, then a shell script insert new password in AD ? It might be easiest (altough not that simple) to authenticate user using AD.
– Archemar
Mar 8 '16 at 13:44
Yes, users change passwords using passwd on any client + shell script inserting new password in local LDAP (not AD). Linux users are not allowed in AD in our company. Our LDAP server is not high available and we do not authenticate logins against it but only some applications. As long as we used crypt, the passwords could be inserted into ldap as is and everything worked fine. With ssha512 the format in linux is different to ldap and I don't know how to convert it.
– user333869
Mar 9 '16 at 7:44
Today I created a hash with perl{SHA512}" . MIME::Base64::encode( Digest::SHA::sha512( $plainPW ), '' )and this works with LDAP. So it is just the salt that gives me headaches.
– user333869
Mar 9 '16 at 11:25
Not sure what is you intend, user change password using
passwd on any client, then a shell script insert new password in AD ? It might be easiest (altough not that simple) to authenticate user using AD.– Archemar
Mar 8 '16 at 13:44
Not sure what is you intend, user change password using
passwd on any client, then a shell script insert new password in AD ? It might be easiest (altough not that simple) to authenticate user using AD.– Archemar
Mar 8 '16 at 13:44
Yes, users change passwords using passwd on any client + shell script inserting new password in local LDAP (not AD). Linux users are not allowed in AD in our company. Our LDAP server is not high available and we do not authenticate logins against it but only some applications. As long as we used crypt, the passwords could be inserted into ldap as is and everything worked fine. With ssha512 the format in linux is different to ldap and I don't know how to convert it.
– user333869
Mar 9 '16 at 7:44
Yes, users change passwords using passwd on any client + shell script inserting new password in local LDAP (not AD). Linux users are not allowed in AD in our company. Our LDAP server is not high available and we do not authenticate logins against it but only some applications. As long as we used crypt, the passwords could be inserted into ldap as is and everything worked fine. With ssha512 the format in linux is different to ldap and I don't know how to convert it.
– user333869
Mar 9 '16 at 7:44
Today I created a hash with perl
{SHA512}" . MIME::Base64::encode( Digest::SHA::sha512( $plainPW ), '' ) and this works with LDAP. So it is just the salt that gives me headaches.– user333869
Mar 9 '16 at 11:25
Today I created a hash with perl
{SHA512}" . MIME::Base64::encode( Digest::SHA::sha512( $plainPW ), '' ) and this works with LDAP. So it is just the salt that gives me headaches.– user333869
Mar 9 '16 at 11:25
add a comment |
1 Answer
1
active
oldest
votes
The short answer is no, you can't directly recode one password hash to another if you don't know original passwords and don't use brute force or any other attacks. But you can build transparent layer, that convert hashes if password is correct.
The question has been asked many times, like here.
In my software I use passlib library which can do this operation without my interception.
answered Mar 21 '16 at 14:33
Eir NymEir Nym
1501110
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f268379%2fis-it-possible-to-convert-linux-salted-sha512-password-hash-to-ldap-format%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The short answer is no, you can't directly recode one password hash to another if you don't know original passwords and don't use brute force or any other attacks. But you can build transparent layer, that convert hashes if password is correct.
The question has been asked many times, like here.
In my software I use passlib library which can do this operation without my interception.
answered Mar 21 '16 at 14:33
Eir NymEir Nym
1501110
add a comment |
The short answer is no, you can't directly recode one password hash to another if you don't know original passwords and don't use brute force or any other attacks. But you can build transparent layer, that convert hashes if password is correct.
The question has been asked many times, like here.
In my software I use passlib library which can do this operation without my interception.
answered Mar 21 '16 at 14:33
Eir NymEir Nym
1501110
add a comment |
The short answer is no, you can't directly recode one password hash to another if you don't know original passwords and don't use brute force or any other attacks. But you can build transparent layer, that convert hashes if password is correct.
The question has been asked many times, like here.
In my software I use passlib library which can do this operation without my interception.
answered Mar 21 '16 at 14:33
Eir NymEir Nym
1501110
The short answer is no, you can't directly recode one password hash to another if you don't know original passwords and don't use brute force or any other attacks. But you can build transparent layer, that convert hashes if password is correct.
The question has been asked many times, like here.
In my software I use passlib library which can do this operation without my interception.
answered Mar 21 '16 at 14:33
Eir NymEir Nym
1501110
answered Mar 21 '16 at 14:33
Eir NymEir Nym
1501110
answered Mar 21 '16 at 14:33
Eir NymEir Nym
1501110
answered Mar 21 '16 at 14:33
Eir NymEir Nym
1501110
1501110
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f268379%2fis-it-possible-to-convert-linux-salted-sha512-password-hash-to-ldap-format%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Not sure what is you intend, user change password using
passwdon any client, then a shell script insert new password in AD ? It might be easiest (altough not that simple) to authenticate user using AD.– Archemar
Mar 8 '16 at 13:44
Yes, users change passwords using passwd on any client + shell script inserting new password in local LDAP (not AD). Linux users are not allowed in AD in our company. Our LDAP server is not high available and we do not authenticate logins against it but only some applications. As long as we used crypt, the passwords could be inserted into ldap as is and everything worked fine. With ssha512 the format in linux is different to ldap and I don't know how to convert it.
– user333869
Mar 9 '16 at 7:44
Today I created a hash with perl
{SHA512}" . MIME::Base64::encode( Digest::SHA::sha512( $plainPW ), '' )and this works with LDAP. So it is just the salt that gives me headaches.– user333869
Mar 9 '16 at 11:25