<div dir="ltr">I had a look at ldap/servers/plugins/pwdstorage/crypt_pwd.c, and it looks like it is hardcoded in crypt_pw_enc, which uses the default DES crypt method. This only affects the encoding. The verification of passwords works with any of MD5 or SHA-* schemes since the underlying crypt function in recent glibcs supports them. Would it make sense to add the other options to the encoding function ? </div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 2, 2015 at 3:27 AM, Prasun Gera <span dir="ltr"><<a href="mailto:prasun.gera@gmail.com" target="_blank">prasun.gera@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I tried enabling crypt for experimentation, and things seem to work well for both NIS and SSSD clients. I noticed that the crypt format that the NIS plugin in IPA provides is the traditional crypt format with a 2 character salt and 13 character hash. NIS clients can understand newer crypt encodings which allow MD5, SHA256 and SHA512 (<a href="https://docs.python.org/3/library/crypt.html" target="_blank">https://docs.python.org/3/library/crypt.html</a>) . Is it possible to force one of those as the storage scheme in the directory server ? </div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 31, 2015 at 12:04 PM, Prasun Gera <span dir="ltr"><<a href="mailto:prasun.gera@gmail.com" target="_blank">prasun.gera@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I've figured it out. You are right. SSSD triggers key generation. For migrated clients though, since ypbind still runs and the NIS-plugin serves maps, they authenticate first using NIS before SSSD. If ypbind is stopped, it is forced to use SSSD, and then it triggers the migration. Thanks for persisting with this. It's pretty clear how it works now. </div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 31, 2015 at 11:32 AM, Prasun Gera <span dir="ltr"><<a href="mailto:prasun.gera@gmail.com" target="_blank">prasun.gera@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><div class="gmail_quote"><span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div text="#000000" bgcolor="#FFFFFF"><span><br></span> ? SSSD does not seem to be involved as user is found in the /etc/passwd and this SSSD should not do anything.<span><br><br></span></div></blockquote></span><div>It's not a local user. There's no entry in /etc/passwd. Here's the relevant sssd log</div><div><br></div><div><br></div><div>sssd_ssh</div><div><br></div><div>(Tue Mar 31 03:50:41 2015) [sssd[ssh]] [sss_parse_name_for_domains] (0x0200): name 'testuser2' matched without domain, user is testuser2</div><div>(Tue Mar 31 03:50:41 2015) [sssd[ssh]] [client_recv] (0x0200): Client disconnected!</div><div>(Tue Mar 31 03:53:17 2015) [sssd[ssh]] [sss_cmd_get_version] (0x0200): Received client version [0].</div><div><br></div><div>sssd_pam</div><div><br></div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): domain: ipadomain<br></div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): user: testuser2</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): service: sshd</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): rhost: host_ip</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 0</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): priv: 1</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 23983</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_print_data] (0x0100): logon name: testuser2</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [0][ipadomain]</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [0].</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [pam_reply] (0x0200): blen: 27</div><div>(Tue Mar 31 03:53:54 2015) [sssd[pam]] [client_recv] (0x0200): Client disconnected! </div></div></div></div> </blockquote></div><br></div> </div></div></blockquote></div><br></div> </div></div></blockquote></div><br></div>