Fedora directory users - Jan 2009 - Re: Exporting MD5 Hash from FD-DS into /etc/shadow

Howard Chu wrote:
 >> fedora-directory-users-request redhat com wrote:
 >>    dennis demarco com wrote:
 >>>     I would like to export the MD5 hash from the Fedora directory
user''s password
 >>>     attribute into /etc/shadow of a Linux machine not in LDAP
(Redhat).
 >>>     It appears this isn''t working, is there a way for me
to do this?
 >>>     Not all machines are using ldap but I would like to export
from ldap.
 >>>

 >>   Hi,
 >>   I haven''t tried this, but here''s an idea just off
the top of my head which _might_ work:
 >>
 >>    1. take away the {MD5} from the string
 >>    2. base64 decode the rest of the string
 >>    3. convert the string to hex
 >>    4. put the $1$ at the front of the hex string
 >>    5. put the whole string into the password field in /etc/shadow and
test
 >>
 >>    If that works, you could write a perl script to automate the
procedure. And report back to the list as well :-)
 >>
 > No, the password field is not in hex, it uses the same 6-bit encoding
 > that DES crypt() uses, which is different from base64.
 > base64 uses the characters [A-Z][a-z][0-9]+/ while crypt uses
 > the characters ./[0-9][A-Z][a-z] (in those exact orders).
 >
 > --
 >  -- Howard Chu
 > Chief Architect, Symas Corp.   http://www.symas.com
 > Director, Highland Sun   http://highlandsun.com/hyc
 > OpenLDAP Core Team  http://www.openldap.org/project/
-- 
Hello,
I found this 2 years old thread. I have same task - convert LDAP values
to passwd/shadow, and solve password conversion. But I''m still out of
luck.
I have idea utilize something as MD5 crypt() with empty salt - this
probably work, as when I create password in manner:

openssl passwd -1 -salt "" "heslo"
$1$$1dziKo9JPNdLlVrGfqIBG.

then result is working, with it in shadow I can authenticate and all work
OK. Salt is empty - after "$1$" signature immediately follow salt/hash
delimiter "$", and then as usually 22 chars hash.
But result of MD5 password created e.g. with command:

slappasswd -h {MD5} -s "heslo"
{MD5}lV2wuB7xmJtKTf6ugGGppg=
(values coded in this manner I have in LDAP DB. Isn''t problem convert
among different formats, eg:
echo -n "heslo"|md5sum
955db0b81ef1989b4a4dfeae8061a9a6
echo -n "heslo"|openssl dgst -md5 -hex
955db0b81ef1989b4a4dfeae8061a9a6

echo ''<?
$A=base64_encode(pack("H*",md5("heslo"))); echo
$A;?>'' | php
lV2wuB7xmJtKTf6ugGGppg=
And it is simple to obtain full 128-bit hex MD5 hash by reverting LDAP values:

echo ''<?
$A=unpack("H*",base64_decode("lV2wuB7xmJtKTf6ugGGppg=="));
echo $A[1];?>''|php
955db0b81ef1989b4a4dfeae8061a9a6
)
Generally, I have convert 22 char long base-64 value to 22 char long
value as generated by MD5 crypt():

lV2wuB7xmJtKTf6ugGGppg        # LDAP base-64 value
1dziKo9JPNdLlVrGfqIBG.        # MD5 crypt() value

Both uses 6-bit encoding, first with charset "[A-Z][a-z][0-9]+/",
second
the characters "./[0-9][A-Z][a-z]". But simple conversion as this:

CRYPT_HASH=`echo "$BASE64_HASH"|tr ''A-Za-z0-9+/''
''./0-9A-Za-z''`

not work.

Is this problem ever solvable?
Had someone in this thread success with solving this problem?
Is idea of empty salt real, and problem is only in conversion between
6-bit DES crypt() encoding and base-64 encoding?
Have someone any knowledge about this?

Thanks in advance,
Franta Hanzlik