* use 'crypto_pwhash_str_alg(..., crypto_pwhash_ALG_ARGON2ID13)' to set
the algorithm to Argon2.
According to libsodium's documentation, the original 'crypto_pwhash_str()'
only guarantees a "memory-hard, CPU-intensive hash function", but not
necessarily Argon2. Although in released versions of libsodium Argon2 is
the only implemented backend, this may chane in the future.
* multiply the 'memory' parameter by 1024 to align it with the libargon2
implementation. The objective is to have consistent configuration in
OpenLDAP's pw-argon2 module no matter what backend implementation is used.
Signed-off-by: Peter Marschall <peter@adpm.de>
This change implements argon2, which won the Password Hashing
Competition (https://password-hashing.net/) as a contrib-module in order
to provide a modern password hashing alternative in openldap. The
currently available password hashing algorithms are relatively old, and
modern hardware, especially GPUs can compute quite a few (ranging from
tens of thousands to millions) of hashes per second. Argon2 was designed
to withstand such attacks.
This implementation uses the default work factors used in the argon2
command line client, but the resulting hashes are stored in a way that
would allow retroactive changes to these values, or even exposing them
as configuration in the module.
Add a manual page slapo-smbk5pwd.5 and update smbk5pwd's Makefile to
install the new manual page.
ITS#8205 - contrib/lastbind: install man page
Update lastbind's Makefile to install the manual page too.
ITS#8205 - contrib/passwd/sha2: add man page, install it too
Add a manual page slapd-pw-sha2.5 and update passwd/sha2's Makefile to
install the new manual page.
ITS#8205 - contrib/adremap: install man page
Update adremap's Makefile to install the manual page too.
ITS#8205 - contrib/allop: install man page
Update allop's Makefile to install the manual page too.
ITS#8205 - contrib/cloak: install man page
Update cloak's Makefile to install the manual page too.
ITS#8205 - contrib/lastmod: install man page
Update lastmod's Makefile to install the manual page too.
ITS#8205 - contrib/nops: install man page
Update nops's Makefile to install the manual page too.
ITS#8205 - contrib/nssov: install man page
Update nssov's Makefile to install the manual page too.
ITS#8205 - contrib/passwd: add man page slapd-pw-sha2.5, install it too
Add a manual page slapd-pw-radius.5 and update passwd's Makefile to
install the new manual page.
ITS#8205 - contrib/passwd/totp: add man page, install it too
Add a manual page slapo-totp.5 and update passwd/totp's Makefile to
install the new manual page.
ITS#8205 - contrib/passwd/pbkdf2: add man page, install it too
Add a manual page slapd-pw-pbkdf2.5 and update passwd/pbkdf2's Makefile to
install the new manual page.
OpenLDAP can be configured to be either built with OpenSSL or
GnuTLS. This commit adds support for building pw-pbkbdf2 module
without OpenSSL, by using PBKDF2 crypto primitives provided by
libnettle.
Closeshamano/openldap-pbkdf2#2
Signed-off-by: Luca Bruno <luca.bruno@rocket-internet.de>
Fixed asprintf return value check, in order to properly catch
error conditions. This has been caught by clang -Wtautological-compare:
pw-pbkdf2.c:132:17: warning: comparison of unsigned expression < 0 is always false
if(msg->bv_len < 0){
~~~~~~~~~~~ ^ ~
Signed-off-by: Luca Bruno <luca.bruno@rocket-internet.de>
This code duplicates the basic function of lastbind. The two overlays
cannot be used together. The timestamp Mod op is changed to require
the old value to still be present at the end of the Bind. This allows
us to detect collisions (multiple successful Binds in the same time
window) and properly fail the extra Bind attempts.
