This post is more than 5 years old
3 Posts
0
1651
LDAP password scheme?
Dear Experts,
We have a multiprotocol NAS server (CIFS, NFS and FTP) on a VNXe3200. The FTP access should only be allowed for Unix user accounts, stored in an LDAP directory service. The LDAP server has the RFC 2307 schema, i.e. the user data can be found in the posixAccount objectclass and the login password in its userPassword attribute.
My question is: how should the password look like in the LDAP output? Plain text or hashed ({SSHA}, {SMD5}...)? Base64 encoded or not?
Unfortunately I haven't found any information on this so far and I can't seem to get the FTP authentication working.
Can someone please shed a light on this? Any help (link, howto...) would be greatly appreciated.
Thank you!
szizo
3 Posts
0
November 15th, 2016 00:00
After some experimenting, I was able to setup FTP authentication for the Unix user accounts using {SSHA} hashed passwords.
Maybe there are other working methods as well, but that's an exercise for the reader to find them.
Rainer_EMC
8.6K Posts
0
November 15th, 2016 04:00
would you mind sharing what you learned and which config worked for you?
szizo
3 Posts
0
November 16th, 2016 02:00
Hello Rainer,
Sure.
As I've written in my first post, our Unix user accounts are stored in an LDAP directory (actually OpenLDAP). In case of FTP access, the authentication takes place in the VNXe, based on the account information (username and password) from the LDAP database.
The passwords in the LDAP reply need to be encrypted using a method supported by VNXe, of course, otherwise the authentication won't work. Unfortunately, I haven't found any information on the supported algorithms.
I got a hint from EMC Support that plain text passwords might work, but that's not the case according to my experiments. Linux encrypted passwords ({CRYPT} scheme) doesn't work either. Finally I had luck with salted SHA1 ({SSHA} scheme) hashes (see http://www.openldap.org/faq/data/cache/347.html), as I've written in my previous answer.
I can't tell you whether there are other working algorithms or not because I haven't tried more.
There is perhaps one more thing worth mentioning: you should double-check the security settings of your LDAP server. In our OpenLDAP a default setting prevented the userPassword attribute from showing up in normal LDAP responses. But the account VNXe uses for connecting to the LDAP directory (the one that is specified under the Unix Directory Service settings in Unisphere) needs to have read access to this field, of course.
To sum up, follow the steps below to setup FTP access for LDAP (Unix) users:
1. Configure LDAP connection settings in Unisphere (Settings / NAS Servers / Unix Directory Service).
2. The passwords in LDAP should be encrypted with a VNXe-supported algorithm (e. g. {SSHA}).
3. Make sure that VNXe has access to the password field in the LDAP database.
4. Configure FTP for Unix users in Unisphere (Settings / NAS Servers / Sharing Protocols).
5. Test FTP and drink a beer afterwards.