Re: Question regarding order of SASL authentication mechanisms

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Markus Moeller wrote:
Dieter,

It  doesn't work as you described or GSSAPI is weaker than DIGEST-MD5

With /etc/sasl2/slapd.conf
mech_list: gssapi digest-md5 external

I get:

# ldapsearch -h localhost -b "" -s base +
SASL/DIGEST-MD5 authentication started
Please enter your password:

Markus,

SASL is a server-offers - client-chooses specification. DIGEST-MD5 is a 256 bit mechanism and GSSAPI is a 56 bit mechanism, so DIGEST-MD5 may be preferred if no mechanism, or security properties, are specified.

See the manpage for ldap.conf to force a default SASL mechanism for the OpenLDAP client utilities.

You can put 'SASL_MECH GSSAPI' within ~/.ldaprc.

- Dan

[Index of Archives]     [Info Cyrus]     [Squirrel Mail]     [Linux Media]     [Yosemite News]     [gtk]     [KDE]     [Gimp on Windows]     [Steve's Art]

  Powered by Linux