OpenLDAP SSHA安全性存疑：能否换配置？长盐是否安全？

Let’s break down each of your questions with practical, real-world context:

Can I configure LDAP in other, more secure ways? #

Absolutely. Modern OpenLDAP supports a range of stronger password hashing algorithms that fix the weaknesses of the older MD5/SHA-1 variants you mentioned. Here’s how to adjust your setup:

• Enable modern cryptographic hashes: You can switch to SHA-2 family algorithms (like salted {SSHA256} or {SSHA512}), or slow hashes like bcrypt ({CRYPT}$6$) and Argon2 ({ARGON2})—these are far more resistant to brute-force attacks than SHA-1.
• Update your configuration: For OpenLDAP 2.4+, set the preferred password hash via the olcPasswordHash attribute in your slapd config. Examples:

  olcPasswordHash: {SSHA512}
  olcPasswordHash: {CRYPT}$6$  # Enables bcrypt
  

• Disable weak hashes: Remove support for MD5, SMD5, SHA, and SSHA entirely to force all new passwords to use your stronger chosen algorithms.

Should I still use LDAP? #

Yes—LDAP remains a valid and widely used tool for centralized identity management, especially in enterprise environments where legacy systems or applications depend on it. That said, you need to use it securely:

• Harden your existing setup: Don’t stick with outdated configurations. Upgrade password hashing (as above), enforce TLS 1.2+ for all connections, and implement strict access controls to limit who can read or modify user entries.
• Consider modern alternatives for new projects: If you’re building from scratch, protocols like OIDC (OpenID Connect) or SAML offer more modern identity features and easier cloud integration. But there’s no need to rip out a working LDAP deployment—just shore up its security.

Is using an 8-byte (64-bit) salt secure? #

It depends entirely on the hashing algorithm paired with it:

• For SSHA (SHA-1): Even an 8-byte salt can’t fix SHA-1’s fundamental flaws—it’s cryptographically broken, vulnerable to collisions, and fast to brute-force with modern hardware. The salt helps avoid rainbow tables, but the algorithm itself is weak—you should abandon SSHA entirely.
• For strong algorithms (SHA-256/512, bcrypt, Argon2): An 8-byte salt is more than sufficient. Salts exist to ensure identical passwords don’t produce identical hashes, and 64 bits of entropy means 2^64 possible salt values—far too many for attackers to precompute rainbow tables. For these algorithms, the salt length isn’t the bottleneck; the algorithm’s brute-force resistance is what matters most.

内容的提问来源于stack exchange，提问作者user187205