[SAMBA4] How should we store password hashes?

[Andrew Bartlett]

On Tue, 2007-02-13 at 08:38 -0500, simo wrote:
> On Tue, 2007-02-13 at 10:34 +0100, Stefan (metze) Metzmacher wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > 
> > Hi,
> > 
> > As we now know how the password fields are replicated,
> > I was thinking about how we should store them in our ldb.
> > 
> > I'd like to store them exactly are they're replicated,
> > (just without the session specific encryption). So that
> > the following attributes are stored rid crypted:
> > unicodePwd, ntPwdHistory, dBCSPwd and lmPwdHistory.
> 
> I am ok to store them in the same format if it is reasonable,
> but why do you want to keep them rid obfuscated?
> 
> > And the functions to access the hashes, like samdb_result_hash(), will
> > rid (de)crypt them on the fly.

This means that every caller to this function will also need to remember
to also ask for the objectSid of the record.  It would be better as yet
another module, which can at least automatically add objectSid to the
required attributes.  

But this still raises the question: why? 

> > I have a patch which passes the rid to this functions, to fix all the
> > callers (but it still uses the samba specific attributes and didn't to
> > rid crypt)
> > 
> > Comments please:-)
> 
> It seem to me you are not keeping the crc32, is there a reason to rid
> obfuscate hashes and not keep it?

I really think these can be treated as transport artifacts.  We already
have to do the session-specific encryption on the entries, is it really
a great cost to also rid-decrypt them, and so keep the rest of the code
simple?

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.                  http://redhat.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba-technical/attachments/20070214/4942b1eb/attachment.bin