I have been running into an issue with pam password hashing. It seems no matter what I do on my RHEL based systems they always hash passwords based on MD5.
My goal here is to have ldap users who use the
passwd(1) command have their password change on the remote ldap server. Currently this works fine but we need the hashing to stop so the ldap server can enforce a password policy. If we use an
ldapmodify everything works fine and as expected. It's just when we use
passwd(1) that it is always hashed with MD5.
We do want passwords in the shadow file to continue to be hashed. But not those who go through
We have tried the following:
- adapting or removing the configuration found in
- In the
/etc/pam.d/passwddirects us to
system-auth. We have tried removing the
md5hash on the
pam_ldap.sosits below it in the password section.
authconfig --update --disablemd5
I have made small bits of headway but even using
authconfig and changing the hash to sha512 instead of md5 doesn't work. The format of the hash changes but when encode it in base64 it's MD5 again.