Howard Chu wrote:
> fedora-directory-users-request redhat com wrote:
> dennis demarco com wrote:
>> I would like to export the MD5 hash from the Fedora directory user's
password
>> attribute into /etc/shadow of a Linux machine not in LDAP (Redhat).
>> It appears this isn't working, is there a way for me to do this?
>> Not all machines are using ldap but I would like to export from ldap.
>>
> Hi,
> I haven't tried this, but here's an idea just off the top of my head which
_might_ work:
>
> 1. take away the {MD5} from the string
> 2. base64 decode the rest of the string
> 3. convert the string to hex
> 4. put the $1$ at the front of the hex string
> 5. put the whole string into the password field in /etc/shadow and test
>
> If that works, you could write a perl script to automate the procedure. And report
back to the list as well :-)
>
No, the password field is not in hex, it uses the same 6-bit encoding
that DES crypt() uses, which is different from base64.
base64 uses the characters [A-Z][a-z][0-9]+/ while crypt uses
the characters ./[0-9][A-Z][a-z] (in those exact orders).
--
-- Howard Chu
Chief Architect, Symas Corp.
http://www.symas.com
Director, Highland Sun
http://highlandsun.com/hyc
OpenLDAP Core Team
http://www.openldap.org/project/ --
Hello,
I found this 2 years old thread. I have same task - convert LDAP values
to passwd/shadow, and solve password conversion. But I'm still out of luck.
I have idea utilize something as MD5 crypt() with empty salt - this
probably work, as when I create password in manner:
openssl passwd -1 -salt "" "heslo"
$1$$1dziKo9JPNdLlVrGfqIBG.
then result is working, with it in shadow I can authenticate and all work
OK. Salt is empty - after "$1$" signature immediately follow salt/hash
delimiter "$", and then as usually 22 chars hash.
But result of MD5 password created e.g. with command:
slappasswd -h {MD5} -s "heslo"
{MD5}lV2wuB7xmJtKTf6ugGGppg==
(values coded in this manner I have in LDAP DB. Isn't problem convert
among different formats, eg:
echo -n "heslo"|md5sum
955db0b81ef1989b4a4dfeae8061a9a6
echo -n "heslo"|openssl dgst -md5 -hex
955db0b81ef1989b4a4dfeae8061a9a6
echo '<? $A=base64_encode(pack("H*",md5("heslo"))); echo
$A;?>' | php
lV2wuB7xmJtKTf6ugGGppg==
And it is simple to obtain full 128-bit hex MD5 hash by reverting LDAP values:
echo '<?
$A=unpack("H*",base64_decode("lV2wuB7xmJtKTf6ugGGppg==")); echo
$A[1];?>'|php
955db0b81ef1989b4a4dfeae8061a9a6
)
Generally, I have convert 22 char long base-64 value to 22 char long
value as generated by MD5 crypt():
lV2wuB7xmJtKTf6ugGGppg # LDAP base-64 value
1dziKo9JPNdLlVrGfqIBG. # MD5 crypt() value
Both uses 6-bit encoding, first with charset "[A-Z][a-z][0-9]+/", second
the characters "./[0-9][A-Z][a-z]". But simple conversion as this:
CRYPT_HASH=`echo "$BASE64_HASH"|tr 'A-Za-z0-9+/' './0-9A-Za-z'`
not work.
Is this problem ever solvable?
Had someone in this thread success with solving this problem?
Is idea of empty salt real, and problem is only in conversion between
6-bit DES crypt() encoding and base-64 encoding?
Have someone any knowledge about this?
Thanks in advance,
Franta Hanzlik