From 2a09ccc55845e4ff56cf1e8dee0a24fe26725063 Mon Sep 17 00:00:00 2001
From: Ludovic Poitou <ludovic.poitou@forgerock.com>
Date: Tue, 26 Oct 2010 11:57:44 +0000
Subject: [PATCH] Resolves Enhancement request OpenDJ-5: Support Linux md5 crypt storage for password This changes are adding support for the BSD MD5 crypt hash as part of the CRYPT password storage scheme. A new parameter has been added to the configuration of the storage scheme to select whether new passwords should be hashed with the unix algo (default) or the md5 one. When it comes to authentication, the scheme is able to detect the algo (based on the $1$ prefix) and match appropriately. Unit tests have been added, including test again passwords already hashed on Linux systems.
---
opends/src/admin/defn/org/opends/server/admin/std/CryptPasswordStorageSchemeConfiguration.xml | 51 +++++++++++++++++++++++++++++++++++++++++++++------
1 files changed, 45 insertions(+), 6 deletions(-)
diff --git a/opends/src/admin/defn/org/opends/server/admin/std/CryptPasswordStorageSchemeConfiguration.xml b/opends/src/admin/defn/org/opends/server/admin/std/CryptPasswordStorageSchemeConfiguration.xml
index bee21c5..85538d4 100644
--- a/opends/src/admin/defn/org/opends/server/admin/std/CryptPasswordStorageSchemeConfiguration.xml
+++ b/opends/src/admin/defn/org/opends/server/admin/std/CryptPasswordStorageSchemeConfiguration.xml
@@ -24,6 +24,7 @@
!
!
! Copyright 2007-2008 Sun Microsystems, Inc.
+ ! Portions Copyright 2010 ForgeRock AS
! -->
<adm:managed-object name="crypt-password-storage-scheme"
plural-name="crypt-password-storage-schemes"
@@ -34,14 +35,17 @@
<adm:synopsis>
The
<adm:user-friendly-name />
- provides a mechanism for encoding user passwords using the UNIX
- crypt algorithm.
+ provides a mechanism for encoding user passwords like Unix crypt does.
+ Like on most Unix systems, the password mq be encrypted using different
+ algorithm, either UNIX crypt or md5 (bsd).
</adm:synopsis>
<adm:description>
- This implementation contains only an implementation for the user
- password syntax, with a storage scheme name of "CRYPT". Even though it
- is a one-way digest, the
- <adm:user-friendly-name />
+ This implementation contains an implementation for the user
+ password syntax, with a storage scheme name of "CRYPT". Like on most
+ Unix, the "CRYPT" storage scheme has different algorithm, the default
+ being the UNIX crypt.
+
+ Even though the UNIX crypt is a one-way digest, it
is relatively weak by today's standards. Because it supports
only a 12-bit salt (meaning that there are only 4096 possible ways to
encode a given password), it is also vulnerable to dictionary attacks.
@@ -64,4 +68,39 @@
</adm:defined>
</adm:default-behavior>
</adm:property-override>
+ <adm:property name="crypt-password-storage-encryption-algorithm" mandatory="true">
+ <adm:synopsis>
+ Specifies the algorithm to use to encrypt new passwords.
+ </adm:synopsis>
+ <adm:description>
+ Select the crypt algorithm to use to encrypt new passwords.
+ The value can either be "unix", which means the password is encrypted
+ with the UNIX crypt algorithm, or md5 which means the password is
+ encrypted with BSD MD5 algorithm and has a $1$ prefix.
+ </adm:description>
+ <adm:default-behavior>
+ <adm:defined>
+ <adm:value>unix</adm:value>
+ </adm:defined>
+ </adm:default-behavior>
+ <adm:syntax>
+ <adm:enumeration>
+ <adm:value name="unix">
+ <adm:synopsis>
+ New passwords are encrypted with the UNIX crypt algorithm.
+ </adm:synopsis>
+ </adm:value>
+ <adm:value name="md5">
+ <adm:synopsis>
+ New passwords are encrypted with the BSD MD5 algorithm.
+ </adm:synopsis>
+ </adm:value>
+ </adm:enumeration>
+ </adm:syntax>
+ <adm:profile name="ldap">
+ <ldap:attribute>
+ <ldap:name>ds-cfg-crypt-password-storage-encryption-algorithm</ldap:name>
+ </ldap:attribute>
+ </adm:profile>
+ </adm:property>
</adm:managed-object>
--
Gitblit v1.10.0