SLAPD-PW-SHA2(5)

📦
version 2.7.2 · 3 versions
, in alpine 3.23, alpine 3.24, arch rolling, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu stonking

💖 SLAPD-PW-SHA2 💖

okay bestie, so this is slapd-pw-sha2 — the SHA-2 password module for slapd. it lives in the File Formats Manual section of the OpenLDAP world, and it's genuinely so cute and useful. let's get into it 🫶

✨ NAME ✨

slapd-pw-sha2 — SHA-2 password module to slapd

✨ SYNOPSIS ✨

ETCDIR/slapd.conf

       moduleload pw-sha2

🌸 DESCRIPTION 🌸

so the pw-sha2 module is a little add-on for slapd(8), and what it does is let OpenLDAP use the SHA-2 family of hash functions (FIPS 180-2) in hashed passwords. we're talking SSHA-512, SSHA-384, SSHA-256, SHA-512, SHA-384 and SHA-256. iconic lineup tbh 👑

and how does it do that? by handing slapd these extra password schemes to play with:

  • {SSHA256} — SHA-256 with salt, giving hash values of 256 bits length
  • {SHA256} — plain SHA-256, giving hash values of 256 bits length
  • {SSHA384} — SHA-384 with salt, giving hash values of 384 bits length
  • {SHA384} — plain SHA-384, giving hash values of 384 bits length
  • {SSHA512} — SHA-512 with salt, giving hash values of 512 bits length
  • {SHA512} — plain SHA-512, giving hash values of 512 bits length

no cap, that's the whole menu. 🍓

🎀 CONFIGURATION 🎀

okay here's the best part: the pw-sha2 module does not need any configuration. zero. nada. she's low maintenance 💅

once you've loaded the module, the password schemes {SSHA256}, {SSHA384}, {SSHA512}, {SSHA256}, {SHA384}, and {SHA512} will be recognised in values of the userPassword attribute. (yes bestie, read that list again, that's what it says ✨)

after that you can tell OpenLDAP to actually use these schemes when it's processing the LDAPv3 Password Modify (RFC 3062) extended operations — you do that with the password-hash option in slapd.conf(5). main character energy fr fr 🌈

🦋 NOTES 🦋

if you wanna use the schemes described here with slappasswd(8), do not forget to load the module using its command line options. the relevant option/value combo is:

-o module-load=pw-sha2

and depending on where pw-sha2 is chillin' on your system, you might also need:

-o module-path=pathspec

🌟 EXAMPLES 🌟

every single one of the userPassword LDAP attributes below encodes the password 'secret'. yes, literally all of them. same password, different glow-up ✨

userPassword: {SHA512}vSsar3708Jvp9Szi2NWZZ02Bqp1qRCFpbcTZPdBhnWgs5WtNZKnvCXdhztmeD2cmW192CF5bDufKRpayrW/isg==
userPassword: {SHA384}WKd1ukESvjAFrkQHznV9iP2nHUBJe7gCbsrFTU4//HIyzo3jq1rLMK45dg/ufFPt
userPassword: {SHA256}K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=

and if you want {SSHA512} to be the password hash used in Password Modify extended operations, you literally just set this line in slapd.conf(5):

password-hash   {SSHA512}

done. slay. 💅

👑 SEE ALSO 👑

💜 ACKNOWLEDGEMENTS 💜

this manual page has been written by Peter Marschall based on the module's README file written by Jeff Turner. legends, both of them 🫶

OpenLDAP is developed and maintained by The OpenLDAP Project (http://www.openldap.org/). OpenLDAP is derived from University of Michigan LDAP 3.3 Release.

and that's the whole page bestie!! tysm for reading, mwah 💖

✨ this page is from OpenLDAP, version LDVERSION, released RELEASEDATE, and it belongs to the slapd-pw-sha2(5) manual — go forth and hash responsibly ✨ 🦋🎀💅

📦 where this page comes from