MD5 Password Support in DS5.2

I need to import accounts form an Oracle Directory (OID) to the Sun Directory 5.2p6. The passwords in the accounts use MD5. From what I read, MD5 is supported, but I am not finding how to configure it to work :).
I do see a plugin called:NS-MTA-MD5, but not just MD5. I tried using NS-MTA-MD5 but that does not work.
An example MD5 password is: {MD5}SCyBHaXVtLxtSX/6mEkeOA==
cleartext: password123
Any help is appreciated.
Thanks,
Eric

There is no default support for an MD5 hashing scheme.
Provided the algorithm used by Oracle Directory is publicly documented, it should be pretty straightforward to implement a new Password Storage Scheme Plug-in to support both Authentication and hashing new passwords in MD5 format.
Directory Server ships with a sample plug-in that can be used as a template.
Regards,
Ludovic.

Similar Messages

Sun Management Console doesn't support MD5 passwords?

I recently converted all our Sun systems to use MD5 passwords, using the Linux-BSD algorithm. I chose the Linux-BSD algorithm for compatibility reasons. After giving root a new password, now stored in MD5 format, I can no longer log in to the Sun Management Console (smc). I had the same problem with DB2. Switching root's password back to CRYPT fixed the issue.
Is this a known problem that Sun is working on? And how does this happen? Shouldn't the application leave authentication to the OS?
Mark

IIRC the Solaris 10 Basic admin guide talks about this issue.
alan

LDAP authentication with MD5 passwords

Hi,
in one of our Linux servers we have MD5 passwords stored in /etc/shadow. We want to implement pam_ldap on that machine, and move passwords to an LDAP database.
I know it is to be done with {crypt} storage scheme.
This works with DS 5.2 running on a Linux box, but under Solaris 8 I couldn't get it working. I know that Solaris 8 doesn't support MD5 passwords in its crypt(3) function, and I suppose Directory Server uses that. Somewhere I read that, however crypt() in Solaris 9 does support MD5.
Can you confirm that after upgrading to Solaris 9, authentication with MD5-hashed passwords will be possible? Has anyone tried it?
Thanks in advance,
Kristof

Thanks you for your reply.
Our openldap version is openldap-2.3.39
And all passwords are encrypted with : Base 64 encoded md5
Below is a sample password:
{md5}2FeO34RYzgb7xbt2pYxcpA==Thanks again for any help..

Solaris & MD5 Passwords ?

Hi!
We've got a linux NIS domain inhouse, and would like to also integrate our sun boxes to this domain. The Problem is that RedHat Linux uses MD5 encryption for pam password, and it seems that solaris isn't able to encrypt passwords this way...
Anyone knows a solve, or perhaps a lib which supports md5 ?
Thanks...
-- Mirko

One way of doing this:
You have a solaris resource adapater configured and is working properly.
Create a variable and map this variable to the password attribute on the solaris adapater schema mapping.
Within the form that is used when a create or update is processed, add a field with the name of the 'global.YOURVARIABLE'. Within the expansion of this field select expression and use the <script> tag to use the MD5 password javascript for instance.
A better way of doing, is putting the <script> in a rule, test the rule, and call the rule from the expansion.
Good luck!
Elger.

Solaris 10 openldap authentication with md5 passwords

Hello to everyone,
We are trying to enable ldap authentication with pam_ldap and md5 passwords on a Solaris 10 system to an openldap server. If passwords are stored using crypt, everything works correctly. But if the password in openldap is in md5, then authentication fails.
We have installed openldap client along with pam_ldap and nss_ldap from padl (http://www.padl.com/pam_ldap.html)
The error messages when trying to 'su -' to the ldap user are:
Jun 1 18:35:23 servername su: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
Jun 1 18:35:23 servername su: [ID 810491 auth.crit] 'su ldapuser' failed for mike on /dev/pts/4and for ssh:
Jun 1 18:35:54 servername sshd[14197]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
Jun 1 18:35:54 servername sshd[14191]: [ID 800047 auth.error] error: PAM: Authentication failed for ldapuser from pc7395.sa.example.int
Jun 1 18:36:00 servername sshd[14224]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
Jun 1 18:36:00 servername sshd[14191]: [ID 800047 auth.error] error: PAM: Authentication failed for ldapuser from pc7395.sa.example.int
Jun 1 18:36:02 servername sshd[14278]: [ID 800047 auth.info] Accepted publickey for scponly from 10.24.4.52 port 35390 ssh2
Jun 1 18:36:04 servername sshd[14270]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
Jun 1 18:36:04 servername sshd[14191]: [ID 800047 auth.error] error: PAM: Authentication failed for ldapuser from pc7395.sa.example.int
Jun 1 18:36:04 servername sshd[14191]: [ID 800047 auth.info] Failed keyboard-interactive/pam for ldapuser from 192.168.1.25 port 41075 ssh2
Jun 1 18:36:08 servername sshd[14191]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
Jun 1 18:36:08 servername sshd[14191]: [ID 800047 auth.info] Failed password for ldapuser from 192.168.1.25 port 41075 ssh2
Jun 1 18:36:12 servername sshd[14191]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
Jun 1 18:36:12 servername sshd[14191]: [ID 800047 auth.info] Failed password for ldapuser from 192.168.1.25 port 41075 ssh2
Jun 1 18:36:17 servername sshd[14191]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate()
Jun 1 18:36:17 servername sshd[14191]: [ID 800047 auth.info] Failed password for ldapuser from 192.168.1.25 port 41075 ssh2Below are the configuration files (pam.conf, nsswitch.conf, ldap.conf) and anything else that I imagine could help (comments of the files have been removed).
Please feel free to ask for any other configuration file:
*/etc/pam.conf*
login   auth requisite        pam_authtok_get.so.1
login   auth required         pam_dhkeys.so.1
login   auth required         pam_unix_cred.so.1
login   auth required         pam_dial_auth.so.1
login   auth sufficient       pam_unix_auth.so.1 server_policy debug
login   auth required           /usr/lib/security/pam_ldap.so.1 debug
rlogin auth sufficient       pam_rhosts_auth.so.1
rlogin auth requisite        pam_authtok_get.so.1
rlogin auth required         pam_dhkeys.so.1
rlogin auth required         pam_unix_cred.so.1
rlogin auth required          pam_unix_auth.so.1 use_first_pass
rsh    auth sufficient       pam_rhosts_auth.so.1
rsh    auth required         pam_unix_cred.so.1
rsh    auth required         pam_unix_auth.so.1
ppp     auth requisite        pam_authtok_get.so.1
ppp     auth required         pam_dhkeys.so.1
ppp     auth required         pam_dial_auth.so.1
ppp     auth sufficient       pam_unix_auth.so.1 server_policy
other   auth sufficient         /usr/lib/security/pam_ldap.so.1 debug
other   auth required           pam_unix_auth.so.1 use_first_pass debug
passwd auth sufficient          pam_passwd_auth.so.1 server_policy
passwd auth required           /usr/lib/security/pam_ldap.so.1 debug
cron    account required      pam_unix_account.so.1
other   account requisite     pam_roles.so.1
other   account sufficient       pam_unix_account.so.1 server_policy
other   account required        /usr/lib/security/pam_ldap.so.1 debug
other   session required      pam_unix_session.so.1
other   password required     pam_dhkeys.so.1
other   password requisite    pam_authtok_get.so.1
other   password requisite    pam_authtok_check.so.1
other   password required     pam_authtok_store.so.1 server_policy*/etc/ldap.conf*
base ou=users,ou=Example,dc=staff,dc=example
ldap_version 3
scope sub
pam_groupdn [email protected],ou=groups,ou=Example,dc=staff,dc=example
pam_member_attribute memberUid
nss_map_attribute uid displayName
nss_map_attribute cn sn
pam_password_prohibit_message Please visit https://changepass.exapmle.int/ to change your password.
uri ldap://ldapserver01/
ssl no
bind_timelimit 1
bind_policy soft
timelimit 10
nss_reconnect_tries 3
host klnsds01
nss_base_group         ou=system_groups,ou=Example,dc=staff,dc=example?sub
pam_password md5*/etc/nsswitch.conf*
passwd:     files ldap
group:      files ldap
hosts:      files dns
ipnodes:   files dns
networks:   files
protocols: files
rpc:        files
ethers:     files
netmasks:   files
bootparams: files
publickey: files
netgroup:   files
automount: files
aliases:    files
services:   files
printers:       user files
auth_attr: files
prof_attr: files
project:    files
tnrhtp:     files
tnrhdb:     files*/etc/security/policy.conf*
AUTHS_GRANTED=solaris.device.cdrw
PROFS_GRANTED=Basic Solaris User
CRYPT_ALGORITHMS_DEPRECATE=__unix__
LOCK_AFTER_RETRIES=YES
CRYPT_ALGORITHMS_ALLOW=1,2a,md5
CRYPT_DEFAULT=1Thanks in advance for any response...!!

Thanks you for your reply.
Our openldap version is openldap-2.3.39
And all passwords are encrypted with : Base 64 encoded md5
Below is a sample password:
{md5}2FeO34RYzgb7xbt2pYxcpA==Thanks again for any help..

Disable password support in Safari 6?

I use a third-party password manager, so would like to disable automatic password support in Safari 6. It doesn't appear possible to do this in Preferences (or I missed it). Has anyone identified a way to do this (e.g., via a defaults setting), so that I don't constantly see drop-down sheets when I enter a password on a website?
Also, I can't seem to edit all of the passwords that *are* in Safari (where I accidentally hit return when the sheet appeared). I can delete one password, but then when I try to highlight others and delete them, nothing happens.
Thanks.

It is a little odd but they did not put the option in the passwords options but instead in the AutoFill options.
Simply open the safari > preferences > autofill and uncheck the "User names and passwords" checkbox. I found the solutions here:
http://www.infiniteloopmobile.com/2012/07/safari-6-0-tweak-turn-off-save-passwor d-prompts/

Migration Users with MD5 Passwords to Directory Server 6.1 on Solaris 10

Hi,
We are currently in a requirement of migrating some users to a application database to inside LDAP. Currently Application maintained the passwords in the MD5 hash form. Typical 32 digit Hex value - 41da76f0fc3ec62a6939e634bfb6a342
Is there a way we can migrate these Users password to directory Server as-is so that they don't end up facing the prospect of resetting post migration.
I have done some of the initial ground work but seems to be missing other critical info if at all it's possible.
I believe it's possible to have CRYPT password policy (which directory server uses from underlying OS) as one of the plug-ins to configure in a way that underlying CRYPT utility starts to process/provide/support MD5 hashes. I got it to work, my using the below command on DSEE instance:
dsconf set-plugin-prop -p 389 CRYPT argument:'$md5$'
But for some reasons the MD5 hash (Sun MD5 library) provides does not match with the original hash value. It's 22 char long (as I have not specified any salt length) so I am assuming it's Base64 encoded. I have a perl script which converts the original 32-digit hex values to a base64 encoded representation (which I have also verified with other open source tools)
Is there a way I can tweak CRYPT utility or something so that it understands typical standard MD5 hashes. (Confused between Sun MD5 and BSD (Linux) MD5 - none of them seems to match standard MD5 generated value).
Any leads on this would be really helpful ?

Just to reclarify or throw more information:
a password - cleartext value - testuser1 has 32-digit HEX value as - 41da76f0fc3ec62a6939e634bfb6a342
Same password when converted to Base64 pattern becomes - Qdp28Pw+xippOeY0v7ajQg==
But when I use pwdhash utility in DSE after configuring CRYPT to use MD5 hashes it becomes -
{crypt}$md5$$LiB/H70zXr3xfQPoXVuUQ1
I used below command :
pwdhash -D /opt/SUNWdsee/dsee6/ds6/slapd-oha-dev -s CRYPT testuser1
Actual hash value of pwdhash is -LiB/H70zXr3xfQPoXVuUQ1 with rest of the prefix is to meet RFC standard and salt and algo name separator.
I am wondering if Sun MD5 default uses any salt even when I haven't used or DS does it. Or if any other MD5 option is there which can be used.
Thanks,
Gaurav

How can I talk w/a real person for password support?

and why do I continue to get a pop up screen saying "safari wants to use "login" key chain?? Help.

What's the problem? We are easier to ask than a real person on the phone. If you'd really like to talk to someone about it, call 1-800-APL-CARE during business hours, or see the international numbers list here: http://support.apple.com/kb/HE57
The login keychain is just your stored passwords. Mac OS calls any set of stored passwords a "Keychain" which is viewable in the "Keychain Access" application. Your basic, catch-all keychain is your login keychain. Basically, you should grant Safari access unless you have a good reason not to.

Logging in with md5 passwords.

Hi,
How is it possible to allow users to login when their passwords, have been encrypted into md5?
Thank you.

You encrypt the submitted value and compare it to the stored value.
The way I do this with the Dreamweaver Log In User server behavior is to add this at the top of the login page:
if (isset($_POST['password'])) {
$_POST['password'] = md5($_POST['password']);

MD5 passwords in PostgreSQL Database

Hi!
I have to store some MD5 hashed passwords in a table in a my PostgreSQL Database. The problem is that when I try to store those "hashed" Strings with an INSERT Statement I get the error: java.sql.SQLException: ERROR: parser: parse error at or near "��h".
This happens not always when I hash and store a clear text String with the MD5 algorithm. Some Strings work fine others not! I think it has something to do with the character encoding in my JDBC Driver. I use the ISO-8859-15 encoding.
Please give me some hints to solve this problem!
Thx

I'm not an MD5 expert, but as far as I know the MD5 code is "binary" meaning, it can contain values below 32 which are non-printable characters (and even negativ values as they are bytes). I think you have to encode the MD5 checksum as e.g. Base64
Thomas

Can I create ASP user validated website using existing MD5 passwords from SQL table?

I'm attempting to build a user authenticated site in Dreamweaver CS5 using an existing USERS table from another site. The password field in the existing SQL table appears to be MD5 encoded. How can I MD5 encode the form field (or the SQL query) so that it verifies MD5 to MD5?
Currently, it's comparing the form's plain text field to the MD5 encrypted password field in SQL.
I've built a simple login form using the following:
<form id="form1" name="form1" method="POST" action="<%=MM_LoginAction%>">
    <input name="username" type="text" id="username" accesskey="u" tabindex="1" /><input name="password" type="password" id="password" accesskey="p" tabindex="2" /><input name="submit" type="submit" value="submit" />
    </form>
With the stock Dreamweaver Log In User Server Behavior as follows:
<%
' *** Validate request to log in to this site.
MM_LoginAction = Request.ServerVariables("URL")
If Request.QueryString <> "" Then MM_LoginAction = MM_LoginAction + "?" + Server.HTMLEncode(Request.QueryString)
MM_valUsername = CStr(Request.Form("username"))
If MM_valUsername <> "" Then
Dim MM_fldUserAuthorization
Dim MM_redirectLoginSuccess
Dim MM_redirectLoginFailed
Dim MM_loginSQL
Dim MM_rsUser
Dim MM_rsUser_cmd
MM_fldUserAuthorization = ""
MM_redirectLoginSuccess = "results.asp"
MM_redirectLoginFailed = "error.html"
MM_loginSQL = "SELECT user_name, password"
If MM_fldUserAuthorization <> "" Then MM_loginSQL = MM_loginSQL & "," & MM_fldUserAuthorization
MM_loginSQL = MM_loginSQL & " FROM dbo.users WHERE user_name = ? AND password = ?"
Set MM_rsUser_cmd = Server.CreateObject ("ADODB.Command")
MM_rsUser_cmd.ActiveConnection = MM_ADSX_STRING
MM_rsUser_cmd.CommandText = MM_loginSQL
MM_rsUser_cmd.Parameters.Append MM_rsUser_cmd.CreateParameter("param1", 200, 1, 32, MM_valUsername) ' adVarChar
MM_rsUser_cmd.Parameters.Append MM_rsUser_cmd.CreateParameter("param2", 200, 1, 32, Request.Form("password")) ' adVarChar
MM_rsUser_cmd.Prepared = true
Set MM_rsUser = MM_rsUser_cmd.Execute
If Not MM_rsUser.EOF Or Not MM_rsUser.BOF Then
    ' username and password match - this is a valid user
    Session("MM_Username") = MM_valUsername
    If (MM_fldUserAuthorization <> "") Then
      Session("MM_UserAuthorization") = CStr(MM_rsUser.Fields.Item(MM_fldUserAuthorization).Value)
    Else
      Session("MM_UserAuthorization") = ""
    End If
    if CStr(Request.QueryString("accessdenied")) <> "" And false Then
      MM_redirectLoginSuccess = Request.QueryString("accessdenied")
    End If
    MM_rsUser.Close
    Response.Redirect(MM_redirectLoginSuccess)
End If
MM_rsUser.Close
Response.Redirect(MM_redirectLoginFailed)
End If
%>
Please help!

unfortunately classic asp does not have a built in function for md5. what we used for our legacy sites is a javascript that hashes a string to MD5. here's the code we've used in the past http://pajhome.org.uk/crypt/md5/md5.html
your asp should have something like this...
<script language="jscript" src="path_to_js_file/md5.js" runat="server"></script>
<%
'hash the password
Dim md5password       ' md5password variable will hold the hashed text from form variable txtPassword
md5password = hex_md5(""&Request("txtPassword")&"")
' based on the code you posted...
MM_rsUser_cmd.Parameters.Append MM_rsUser_cmd.CreateParameter("param2", 200, 1, 32, md5password) ' adVarChar
%>

Retrieving encrypted(MD5) password in LDAP

I have this code that retrieves LDAP entries particularly the common name (cn), e-mail address (mail) and password (userpassword). Everything is ok except for the password. Password of each users appears the same which is not correct because when I try connecting to LDAP using telnet, it displays different values.
The password that I'm always getting is: [B@7ee6fc
The code in particular is:
for (Enumeration vals = attr.getAll(); vals.hasMoreElements(); )
System.out.println("\t" + vals.nextElement());
Is there a problem with my code?� Apparently, it is
not getting the exact string, while the other attributes
are correct.
By the way, our LDAP is using MD5 for the encryption of passwords.
(I'm also having problems with my MD5 code in JAVA, but that's another story :) For now, I have to retrieve the correct userpassword)
Thanks in advance.

The password must be a byte array. Try to convert into byte[]

MD5 Password and Salt strategy

Hey all.
I'm about to implement encyrypting our application passwords into the db using MD5.
It was brought to my attention that I should use some 'salt' on the password to help avoid a dictionary attack on the encrypted passwords in the db. This is not a big concern, as our db is protected, and if someone is running queries against it, they pretty much have the whole system. I do however want to do a good a job as possible, so if it adds some security to it, then why not.
So what is a realistic approach for this situation. Would I just encyrpt 'password' + 'username', where 'username' is the salt. I've seen some mention of using something random for salt, but how would I track that when I need to check the password when the user logs in?
Any advice on the topic would be appreciated.
Regards,
Vic

I recommend reading the PKCS#5 standard which is available at http://www.rsasecurity.com/rsalabs/pkcs/pkcs-5/index.html. Chapter PBKDF2 describes just what you are looking for with the addition of an iteration count. If you have just one field to store the hashed (not encrypted) password you can concatenate the salt and the password hash to form one field.
The salt has to be unique among the users, so using the user name as the salt is quite appropriate.
Oh, and remember to store the hash as something readable like in Base64 encoding or as a hex string.
Regards,
Frank

Migrating Linux shadow-file MD5 passwords to Sun DSEE for Solaris/SunMail

Hello all,
We are about to undertake migration of an outdated mail server based on RedHat 7.2 and Sendmail/ipop3d to Sun Messaging Server (JCS6u2). While the filesystem/mail are not a problem, we're stuck at the question of how to best migrate old users' identities.
The old Linux system used user names and password hashes stored in /etc/passwd and /etc/shadow files. Hashes are mostly MD5 and a few seem like crypt.
Question is: are there known incompatibilities between password hashes (algorithms, expected format) in Linux and Sun products - Solaris/DSEE/SunMail?
That is, if we just take strings like these:
usemd5:$1$Wu7IqFT5$TeUht3OMdeSSBB3Vab4dB.:11262:0:::::134540116
usecrypt:DD2kEwCD8nies:10220::::::
Can we simply place the second column as the userPassword attribute in Sun DSEE and expect that users would be able to log in to LDAP-enabled Solaris and Sun Mail with their old passwords knownst only to them?
If not, is there some simple modification/translation of such hashes to a format accepted by Sun products?
Or are these formats/algorithms known to be incompatible somehow in a fatal manner, so our only option would be generation of new passwords for Sun DSEE and its clients?
Thanks,
//Jim

Just to reclarify or throw more information:
a password - cleartext value - testuser1 has 32-digit HEX value as - 41da76f0fc3ec62a6939e634bfb6a342
Same password when converted to Base64 pattern becomes - Qdp28Pw+xippOeY0v7ajQg==
But when I use pwdhash utility in DSE after configuring CRYPT to use MD5 hashes it becomes -
{crypt}$md5$$LiB/H70zXr3xfQPoXVuUQ1
I used below command :
pwdhash -D /opt/SUNWdsee/dsee6/ds6/slapd-oha-dev -s CRYPT testuser1
Actual hash value of pwdhash is -LiB/H70zXr3xfQPoXVuUQ1 with rest of the prefix is to meet RFC standard and salt and algo name separator.
I am wondering if Sun MD5 default uses any salt even when I haven't used or DS does it. Or if any other MD5 option is there which can be used.
Thanks,
Gaurav

Java Card simulator with MD5 MessageDigest support?

Are there any Java Card simulators with support for the MD5 MessageDigest available? I checked both cref and jcwde, but they only support ALG_SHA.

Thanks.
By the way, do you happen to know if the newer JCOP cards (e.g. the NXP (Philips) JCOP 41 V2.2.1/72K USB
NXP (Philips) JCOP 41 V2.2.1/72K) still support the MD5 MessageDigest? Older JCOP cards seem to support MD5, but at least in the publicly available JCOP 41 specs there is no mention of MD5 anymore; e.g. at http://www.bsi.bund.de/zertifiz/zert/reporte/0426b.pdf

MD5 Password Support in DS5.2

Similar Messages

Maybe you are looking for