Hash variable does not apply about docker-openldap

[thesefer]

Ah I got it. Looks like I clearly misinterpreted the template. For the group problem (webinterface) I will separate this into a new issue.

Only new users are hashed, probably because the bootstrap happens later and the default users are added using the old policy. That explains this behaviour and might be noted in the readme.

[clayrisser]

olcPasswordHash: {CRYPT} is actually correct. The part that makes it do sha256 is the following configuration which tells crypt to use sha256. This is why I call it SHA512CRYPT instead of SHA512.

olcPasswordCryptSaltFormat: $6$%.16s

The following is the config I have on my openldap deployment. The user passwords are being hashed for me.

  BITNAMI_DEBUG: "true"                                                                                                                                                       
  LDAP_CONFIG_ADMIN_ENABLED: "yes"                                                                                                                                            
  LDAP_CONFIG_ADMIN_USERNAME: admin                                                                                                                                           
  LDAP_ENABLE_TLS: "yes"                                                                                                                                                      
  LDAP_EXTRA_SCHEMAS: cosine,inetorgperson,nis,acls                                                                                                                           
  LDAP_HASH_PASSWORD: SHA512CRYPT                                                                                                                                             
  LDAP_LOGLEVEL: "256"                                                                                                                                                        
  LDAP_ROOT: dc=example,dc=com                                                                                                                                                
  LDAP_SCHEMAS: misc,ppolicy                                                                                                                                                  
  LDAP_SKIP_DEFAULT_TREE: "yes"                                                                                                                                               
  LDAP_TLS_CA_FILE: /opt/bitnami/openldap/certs/ca.crt                                                                                                                        
  LDAP_TLS_CERT_FILE: /opt/bitnami/openldap/certs/tls.crt                                                                                                                     
  LDAP_TLS_ENFORCE: "false"                                                                                                                                                   
  LDAP_TLS_KEY_FILE: /opt/bitnami/openldap/certs/tls.key                                                                                                                      
  LDAPTLS_REQCERT: never

Here's my ppolicy when I use the above configuration.

# https://github.com/osixia/docker-openldap/issues/208
# https://github.com/osixia/docker-openldap/issues/48
# https://help.univention.com/t/ucs-and-security-hardening/6059
# https://serverfault.com/questions/571928/how-do-you-set-password-hash-for-openldap
# https://www.openldap.org/lists/openldap-technical/201608/msg00078.html
# https://www.redpill-linpro.com/techblog/2016/08/16/ldap-password-hash.html

# LDAP_HASH_PASSWORD:
#   - NONE
#   - SSHA
#   - MD5
#   - CRYPT
#   - MD5CRYPT
#   - SHA256CRYPT
#   - SHA512CRYPT

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy

dn: cn=config
changetype: modify
replace: olcPasswordHash
olcPasswordHash: {CRYPT}
-
replace: olcPasswordCryptSaltFormat
olcPasswordCryptSaltFormat: $6$%.16s

dn: olcDatabase={-1}frontend,cn=config
changetype: modify
replace: olcPasswordHash
olcPasswordHash: {CRYPT}

dn: olcOverlay=ppolicy,olcDatabase={2}mdb,cn=config
changetype: add
objectClass: top
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
olcPPolicyHashCleartext: TRUE
olcPPolicyDefault: cn=default,ou=ppolicy,dc=example,dc=com

dn: ou=ppolicy,dc=example,dc=com
changetype: add
objectClass: top
objectclass: organizationalUnit
ou: ppolicy

dn: cn=default,ou=ppolicy,dc=example,dc=com
changetype: add
objectClass: top
objectClass: device
objectClass: pwdPolicy
cn: default
pwdAllowUserChange: TRUE
pwdAttribute: 2.5.4.35
pwdCheckQuality: 0
pwdExpireWarning: 3600
pwdFailureCountInterval: 0
pwdGraceAuthNLimit: 0
pwdInHistory: 0
pwdLockout: TRUE
pwdLockoutDuration: 3600
pwdMaxAge: 0
pwdMaxFailure: 5
pwdMinLength: 6
pwdMustChange: FALSE
pwdSafeModify: FALSE