SLAPD-PW-PBKDF2(5)

📦
version 2.7.2 · 5 versions
, in arch rolling, ubuntu stonking

💅 SLAPD-PW-PBKDF2 — the tea ☕

okay bestie, gather round, because this is slapd-pw-pbkdf2(5), a page from the File Formats Manual, and it's literally about making your LDAP passwords not mid. it's the PBKDF2 password module for slapd. yes, the password-hashing glow-up. periodt. 👑

✨ NAME ✨

slapd-pw-pbkdf2 — the PBKDF2 password module that plugs into slapd 🧚

🌸 SYNOPSIS 🌸

ETCDIR/slapd.conf

       moduleload pw-pbkdf2 [iterations]

like, that's it. you load the module in slapd.conf and optionally tell it how many iterations you want. iconic minimalism fr fr.

🦋 DESCRIPTION 🦋

so the pw-pbkdf2 module for slapd(8) is the one that shows up with support for PBKDF2 (Password-Based Key Derivation Function 2), the key stretching function, following RFC 2898, for hashed passwords in OpenLDAP. no cap, this is the good stuff.

and the way it does that? it hands slapd these extra password schemes:

  • {PBKDF2} — this is an alias to {PBKDF2-SHA1} (basically the same thing wearing a crop top)
  • {PBKDF2-SHA1} — PBKDF2 using HMAC-SHA-1 as the underlying pseudorandom function
  • {PBKDF2-SHA256} — PBKDF2 using HMAC-SHA-256 as the underlying pseudorandom function
  • {PBKDF2-SHA512} — PBKDF2 using HMAC-SHA-512 as the underlying pseudorandom function

💖 CONFIGURATION 💖

plot twist: the pw-pbkdf2 module does not need any configuration. low maintenance queen. 🙈

if the optional iterations parameter isn't specified, it defaults to 10000.

once you've loaded the module, these password schemes — {PBKDF2}, {PBKDF2-SHA1}, {PBKDF2-SHA256}, and {PBKDF2-SHA512} — will be recognised in values of the userPassword attribute. slay.

after that you can tell OpenLDAP to use these schemes when it's processing the LDAPv3 Password Modify (RFC 3062) extended operations, just by using the password-hash option in slapd.conf(5). yes, it's giving main character energy.

⭐ NOTES ⭐

if you wanna use the schemes described here with slappasswd(8), bestie, remember to load the module using its command line options. the relevant option/value combo is literally:

-o module-load=pw-pbkdf2

and depending on where pw-pbkdf2 lives on your system, you may also need:

-o module-path=pathspec

don't forget it, i'm begging. 😭

🔥 EXAMPLES 🔥

every single one of the userPassword LDAP attributes below encodes the password 'secret'. that's the vibe, that's the assignment.

userPassword: {PBKDF2-SHA512}10000$/oQ4xZi382mk7kvCd3ZdkA$2wqjpuyV2l0U/a1QwoQPOtlQL.UcJGNACj1O24balruqQb/NgPW6OCvvrrJP8.SzA3/5iYvLnwWPzeX8IK/bEQ

userPassword: {PBKDF2-SHA256}10000$jq40ImWtmpTE.aYDYV1GfQ$mpiL4ui02ACmYOAnCjp/MI1gQk50xLbZ54RZneU0fCg

userPassword: {PBKDF2-SHA1}10000$QJTEclnXgh9Cz3ChCWpdAg$9.s98jwFJM.NXJK9ca/oJ5AyoAQ

and to make {PBKDF2-SHA512} the password hash used in Password Modify extended operations, simply drop this line into slapd.conf(5):

password-hash   {PBKDF2-SHA512}

that's it. that's the whole ritual. 🎀

🌈 SEE ALSO 🌈

🫶 ACKNOWLEDGEMENTS 🫶

this manual page has been written by Peter Marschall, based on the module's README file written by HAMANO Tsukasa <hamano@osstech.co.jp>. credit where credit is due, always. 👑

OpenLDAP is developed and maintained by The OpenLDAP Project (http://www.openldap.org/). OpenLDAP is derived from University of Michigan LDAP 3.3 Release.

okay that's the whole page, you ate it, no crumbs. 💜 this little love letter to PBKDF2 lives under OpenLDAP LDVERSION, dropped on RELEASEDATE, and it still answers to the name SLAPD-PW-PBKDF2(5) if you ever need to find it again. mwah. 💅✨

📦 where this page comes from