From: Francis Cianfrocca <garbagecat10@...>
Date: 2007-08-23T11:06:56+09:00
Subject: Re: MD5 authentication against Active Directory with ruby ld

------=_Part_36735_760143.1187834810671
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

On 8/22/07, James Yang <macinux@gmail.com> wrote:
>
> Thanks Francis, but I am still confused. what you mean we have to use
> password in plain text to bind with Active Directory? Because the
> password would be saved in a configuration file, which is vulnerable.
> I'd like to save the hashed password in the configuration to bind with
> AD. I just changed the group policy on AD to allow "store passwords
> using reversible encryption" But it still takes the plain text binding
> and gives the error to the MD5 hashed password.



If you saved a password-hash in a configuration file, and it were possible
to bind with the password-hash, then the hash is in effect plaintext. You're
not adding any security by using a hash in that circumstance. This is a
difficult problem. If you're trying to enable an automatic login without any
kind of authentication transaction involving a challenge, then somewhere
along the way you will have a sensitive resource that you have to protect as
best you can.

------=_Part_36735_760143.1187834810671--