From 2dec9295cf6dec874228fe8ea5f33f468a327dda Mon Sep 17 00:00:00 2001 From: William Brown Date: Thu, 5 Oct 2017 10:24:41 +1000 Subject: [PATCH] Ticket 49235 - pbkdf2 by default Bug Description: Now that we have improved the tuning somewhat we should offer a stronger default password hash. Wehave historically been poor at offering secure defaults, so this is a strong move to support this. Fix Description: PBKDF2 by default. PBKDF2 helps to prevent certain classes of attacks by being resistant to bruetforce attacks due to the high work factor that an attacker must conduct to attempt to check the passwords content. Additionally the PBKDF2 impl we provide has a high random salt content (well in excess of current NIST requirements) which assits making bruteforces harder. https://pagure.io/389-ds-base/issue/49235 Author: wibrown Review by: ??? --- ldap/servers/slapd/slap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 4463258..353f8b5 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -2226,7 +2226,7 @@ typedef struct _slapdEntryPoints #define MAX_ALLOWED_TIME_IN_SECS 2147483647 #define MAX_ALLOWED_TIME_IN_SECS_64 9223372036854775807 -#define DEFAULT_PASSWORD_SCHEME_NAME "SSHA512" +#define DEFAULT_PASSWORD_SCHEME_NAME "PBKDF2_SHA256" typedef struct _slapdFrontendConfig { -- 1.8.3.1