Mark thank you for reply ,

we are running Cent OS 7  with

389-DS 1.3.7.5-24.el7

and getting the following : passwordStorageScheme: SSHA512
should we change the ldap passwd encrytion  to: PBKDF2_SHA256  than for 'safety ' reason ?


The grief is caused : we have two  systems  each with own  ldap version,  one old ldap(1.3.5 fc24)  using SSHA  and this new  ldap ver using SSHA512 some of users from this one need to be added  manually to old ldap and passwd encryption conversion seems to be a issue, I  do not have knowledge how  to translate for individual users their encrypted  passwd from SSHA512 to SSHA ?

 




From: Ghiurea, Isabella
Sent: Wednesday, October 31, 2018 11:01 AM
To: 389-users@lists.fedoraproject.org
Subject: Re: issues with password encryption changes after upgrade
 

here are more details from DS cfg


 *389-DS   1.3.5.15 fc 24


dn: cn=encryption,cn=config
objectClass: top
objectClass: nsEncryptionConfig
cn: encryption
nsSSLSessionTimeout: 0
nsSSLClientAuth: allowed
sslVersionMin: TLS1.1
nsSSL3Ciphers: default
allowWeakCipher: off
nsKeyfile: alias/slapd-xxxx-key3.db
nsCertfile: alias/slapd-xxxx-cert8.d
numSubordinates: 1



*and   389-DS 1.3.7.5-24.el7


dn: cn=encryption,cn=config
objectClass: top
objectClass: nsEncryptionConfig
cn: encryption
nsSSLSessionTimeout: 0
nsSSLClientAuth: allowed
sslVersionMin: SSL3.0
nsSSL3Ciphers: default
allowWeakCipher: off
nsKeyfile: alias/slapd-xxx-key3.db
nsCertfile: alias/slapd-xxx-cert8.db
CACertExtractFile: /etc/dirsrv/slapd-ldap/xxxxxxxx. pem
modifiersName: cn=server,cn=plugins,cn=config
modifyTimestamp: 20180801192432Z
numSubordinates: 1



From: Ghiurea, Isabella
Sent: Wednesday, October 31, 2018 10:25 AM
To: 389-users@lists.fedoraproject.org
Subject: issues with password encryption changes after upgrade
 

Hi list,

we upgrade from1.3.5.15-1.fc24, to  1.3.7.5-24.el7  , this a multi master replication environment  we are seeing the paswd encryption for new users in new  389-DS  has been changed and is causing some grief , both version have the start of passwd same string :'e1NTSE"  , BUT  the latest  389-DS e has one additional new line . Is there anything we can do to have same encryption pattern ?



Thank you