LDAP password audit and general hackery
aaron posted in tools on November 17th, 2008
I have a few smaller tools/scripts I’m going to be posting in the near future on a new hackery page. Some of these are random things that don’t quite deserve a whole project page, but I still wanted to put a general reference together.
The first thing I’m putting up is a small tool that will dump out a unix-like password file given a LDAP database dump in LDIF format. The point of this is so that you can audit your LDAP passwords with something like john the ripper. Here’s an example usage:
./ldap-passwd-dump.py usage: ./ldap-passwd-dump.py <ldif file> <output password file> [<user matchString>] example: ./ldap-passwd-dump.py ldif.out passwd.txt "^ou: MyGroup" (matchString default is "objectClass: posixAccount") # Dump the initial database with slapcat $ slapcat > ldap.out $ ./ldap-passwd-dump.py ldap.out pw.out [*] Adding new user [New User, newuser] to results [*] Adding new user [A User, auser] to results [*] newuser:$1$xxxxxx$xxxxxxxxxxxxxxxxxxxxxx:::New User [*] auser:$1$xxxxxx$xxxxxxxxxxxxxxxxxxxxxx:::A User [*] Wrote  password lines to [pw.out] [*] Done $ john pw.out
Anyway, hopefully it’s mildly useful to a couple people. Since the standard PAM modules for password policy enforcement are a little harder to use with LDAP, sometimes it seems like weak LDAP accounts can linger around for a longer than intended. Let me know if you have any problems running it, I know there are several different possible password encoding and hashing types, and posixAccount setup schemas, so YMMV
Look for some more things to be posted to the hackery page in the coming days.