Directory Services 7.4.2

Crypt Password Storage Scheme

The Crypt Password Storage Scheme provides a mechanism for encoding user passwords like Unix crypt does. Like on most Unix systems, the password may be encrypted using different algorithms, either Unix crypt, md5, sha256 or sha512.

This scheme contains only an implementation for the user password syntax, with a storage scheme name of "CRYPT". Like on most Unixes, the "CRYPT" storage scheme has different algorithms, the default being Unix crypt. Warning: even though Unix crypt is a one-way digest, it is very weak by today’s standards. Only the first 8 characters in a password are used, and it only uses the bottom 7 bits of each character. It only supports a 12-bit salt (meaning that there are only 4096 possible ways to encode a given password), so it is vulnerable to dictionary attacks. You should therefore use this algorithm only in cases where an external application expects to retrieve the password and verify it outside of the directory, instead of by performing an LDAP bind.

Parent

The Crypt Password Storage Scheme object inherits from Password Storage Scheme.

Crypt Password Storage Scheme properties

You can use configuration expressions to set property values at startup time. For details, see Property value substitution.

Basic Properties Advanced Properties

crypt-password-storage-encryption-algorithm
enabled

java-class

Basic properties

Use the --advanced option to access advanced properties.

crypt-password-storage-encryption-algorithm

Synopsis

Specifies the algorithm to use to encrypt new passwords.

Description

Select the crypt algorithm to use to encrypt new passwords. The value can either be "unix", which means the password is encrypted with the weak Unix crypt algorithm, or "md5" which means the password is encrypted with the BSD MD5 algorithm and has a $1$ prefix, or "sha256" which means the password is encrypted with the SHA256 algorithm and has a $5$ prefix, or "sha512" which means the password is encrypted with the SHA512 algorithm and has a $6$ prefix.

Default value

unix

Allowed values

  • md5: New passwords are encrypted with the BSD MD5 algorithm.

  • sha256: New passwords are encrypted with the Unix crypt SHA256 algorithm.

  • sha512: New passwords are encrypted with the Unix crypt SHA512 algorithm.

  • unix: New passwords are encrypted with the Unix crypt algorithm. Passwords are truncated at 8 characters and the top bit of each character is ignored.

Multi-valued

No

Required

Yes

Admin action required

None

Advanced

No

Read-only

No

enabled

Synopsis

Indicates whether the Password Storage Scheme is enabled for use.

Default value

None

Allowed values

true

false

Multi-valued

No

Required

Yes

Admin action required

None

Advanced

No

Read-only

No

Advanced properties

Use the --advanced option to access advanced properties.

java-class

Synopsis

Specifies the fully-qualified name of the Java class that provides the Crypt Password Storage Scheme implementation.

Default value

org.opends.server.extensions.CryptPasswordStorageScheme

Allowed values

A Java class that extends or implements:

  • org.opends.server.api.PasswordStorageScheme

Multi-valued

No

Required

Yes

Admin action required

None

Advanced

Yes

Read-only

No