michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-02-03 06:03:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add support for SSHA password hashing, and use it if possible

Browse Source
This commit is contained in:
Jamie Cameron
2023-04-15 18:22:43 -07:00
parent b425bdfbb7
commit 9098936fc2
6 changed files with 34 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ldap-server/edit_ldif.cgi
View File

@@ -33,6 +33,10 @@ elsif ($rootpw =~ /^{sha1}(.*)/i) {
$rootmode = 2;
$rootsha1 = $1;
}
elsif ($rootpw =~ /^{ssha}(.*)/i) {
$rootmode = 4;
$rootssha = $1;
}
elsif ($rootpw =~ /^{[a-z0-9]+}(.*)/i) {
$rootmode = 3;
$rootenc = $rootpw;
@@ -47,6 +51,7 @@ print &ui_table_row($text{'slapd_rootpw'},
$rootmode == 1 ? &text('slapd_root1', $rootcrypt) :
$rootmode == 2 ? &text('slapd_root2', $rootsha1) :
$rootmode == 3 ? &text('slapd_root3', $rootenc) :
$rootmode == 4 ? &text('slapd_root4', $rootssha) :
$rootplain eq '' ? $text{'slapd_noroot'} :
$rootplain);

5
ldap-server/edit_slapd.cgi
View File

@@ -32,6 +32,10 @@ elsif ($rootpw =~ /^{sha1}(.*)/i) {
$rootmode = 2;
$rootsha1 = $1;
}
elsif ($rootpw =~ /^{ssha}(.*)/i) {
$rootmode = 4;
$rootssha = $1;
}
elsif ($rootpw =~ /^{[a-z0-9]+}(.*)/i) {
$rootmode = 3;
$rootenc = $rootpw;
@@ -46,6 +50,7 @@ print &ui_table_row($text{'slapd_rootpw'},
$rootmode == 1 ? &text('slapd_root1', $rootcrypt) :
$rootmode == 2 ? &text('slapd_root2', $rootsha1) :
$rootmode == 3 ? &text('slapd_root3', $rootenc) :
$rootmode == 4 ? &text('slapd_root4', $rootssha) :
$rootplain eq '' ? $text{'slapd_noroot'} :
$rootplain);

1
ldap-server/lang/en
View File

@@ -39,6 +39,7 @@ slapd_rootpw=Administration password
slapd_root1=Unix encrypted <tt>$1</tt>
slapd_root2=SHA1 encrypted <tt>$1</tt>
slapd_root3=Encrypted <tt>$1</tt>
slapd_root4=SSHA encrypted <tt>$1</tt>
slapd_noroot=<i>No password set</i>
slapd_rootchange=New administration password
slapd_leave=Don't change

19
ldap-server/ldap-server-lib.pl
View File

@@ -942,5 +942,24 @@ foreach my $f (@ldap_lock_files) {
@ldap_lock_files = ( );
}
# hash_ldap_password(pass)
# Returns a password hashed in a format the LDAP server can accept in the config
# file, with the appropriate prefix
sub hash_ldap_password
{
my ($pass) = @_;
my $rv;
if (&has_command("slappasswd")) {
$rv = &backquote_command("slappasswd -s ".quotemeta($pass)." 2>/dev/null </dev/null");
$rv =~ s/\s+//g;
}
if (!$rv) {
&seed_random();
my $salt = chr(int(rand(26))+65).chr(int(rand(26))+65);
$rv = "{crypt}".&unix_crypt($pass, $salt);
}
return $rv;
}
1;

4
ldap-server/save_ldif.cgi
View File

@@ -24,8 +24,8 @@ $in{'rootdn'} =~ /=/ || &error($text{'slapd_erootdn'});
# Admin password
if (!$in{'rootchange_def'}) {
$in{'rootchange'} =~ /\S/ || &error($text{'slapd_erootpw'});
$crypt = &unix_crypt($in{'rootchange'}, substr(time(), -2));
&save_ldif_directive($conf, 'olcRootPW', $defdb, "{crypt}".$crypt);
&save_ldif_directive($conf, 'olcRootPW', $defdb,
&hash_ldap_password($in{'rootchange'}));
$config{'pass'} = $in{'rootchange'};
$save_config = 1;
}

4
ldap-server/save_slapd.cgi
View File

@@ -23,8 +23,8 @@ $in{'rootdn'} =~ /=/ || &error($text{'slapd_erootdn'});
# Admin password
if (!$in{'rootchange_def'}) {
$in{'rootchange'} =~ /\S/ || &error($text{'slapd_erootpw'});
$crypt = &unix_crypt($in{'rootchange'}, substr(time(), -2));
&save_directive($conf, 'rootpw', "{crypt}".$crypt);
&save_directive($conf, 'rootpw',
&hash_ldap_password($in{'rootchange'}));
$config{'pass'} = $in{'rootchange'};
$save_config = 1;
}