I have been running into an issue with pam password hashing. It seems no matter what I do on my RHEL based systems they always hash passwords based on MD5.

My goal here is to have ldap users who use the passwd(1) command have their password change on the remote ldap server. Currently this works fine but we need the hashing to stop so the ldap server can enforce a password policy. If we use an ldapmodify everything works fine and as expected. It's just when we use passwd(1) that it is always hashed with MD5.

We do want passwords in the shadow file to continue to be hashed. But not those who go through pam_ldap.so.

We have tried the following:

  • adapting or removing the configuration found in /etc/login.defs.
  • In the /etc/pam_ldap.conf or /etc/ldap.conf we made pam_password set to clear instead of md5.
  • /etc/pam.d/passwd directs us to system-auth. We have tried removing the md5 hash on the pam_unix.so line. The pam_ldap.so sits below it in the password section.
  • using authconfig --update --disablemd5

I have made small bits of headway but even using authconfig and changing the hash to sha512 instead of md5 doesn't work. The format of the hash changes but when encode it in base64 it's MD5 again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.