Re: ldap passwords (want not in clear)
On Tue, 2003-04-22 at 23:45, Alan Chandler wrote:
> Checking with ethereal, I can see that my ldap clients (ldapsearch or gq) are
> sending bind requests with the password as clear text. The data in the ldap
> database for these passwords is set as using {crypt}.
The ldap protocol requires simple binds to be done with plain-text
passwords. If you don't like it, either switch to sasl (a pain in the
ass), or use ldap over TLS (ldapsearch -ZZ). Last time I tried it, you
can just set up a self-signed certificate for the ldap server and the
clients will be happy. If a self-signed cert no longer works, you can
get a real cert from freessl.com. It's free for the first year, and it's
still a reasonable price after that. I believe that you need openldap
from testing or unstable to do TLS properly.
--
Dave Carrigan
Seattle, WA, USA
dave@rudedog.org | http://www.rudedog.org/ | ICQ:161669680
UNIX-Apache-Perl-Linux-Firewalls-LDAP-C-C++-DNS-PalmOS-PostgreSQL-MySQL
Dave is currently listening to Paul Kelly and the Coloured Girls - Bradman (Under the Sun)
Reply to: