[389-users] Re: Importing users from open-ds

On 08/16/2018 09:20 AM, rainer@ultra-secure.de wrote:
> Hi,
>
> I have a very old installation of open-ds sitting around and recently
> we got the "go" for upgrading it.
>
> I installed ds389 on CentOS7 64bit, from EPEL.
> The first obstacle I hit when simply trying to import users from and
> export of the old server is that the ldif-export has the passwords in
> formats like this:
>
>
> {SSHA}actual_encrypted_password_here
> or
> {SSHA512}actual_encrypted_password_here
>
> or (very few)
> {ssha}actual_encrypted_password_here
Those all look valid to me.
>
>
> I created a user in 389-ds and exported it and it did not contain any
> such hint.
How did you "export" the user?  Did you use db2ldif tool?
>
> What is the default algorithm that is used to encrypt passwords?
Depends on what version of 389-ds-base you are using.  In some versions
it is SHA512, in newer versions it's PBKDF2, but the server supports all
of these algorithms (including all the open-ds ones).
> How can I switch it to sha512 - and how can I store encrypted
> passwords with different algorithms?
You have to reset/change the passwords for them to get rehashed. There
is no way to just convert an existing password as all of these password
hashing algorithms are one way (not reversible).

Regards,
Mark


> Best Regards
> Rainer
> _______________________________________________
> 389-users mailing list -- 389-users@lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org/message/GX4TL75UONJ5DWTRL4X2OA224CVVTTAF/
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org/message/D3JXFBJ2MHWA6KWJBB3P67MWMYS36J52/