[phpldapadmin] [ phpldapadmin-Bugs-3510114 ] Unable to check passwords when samba hashes are in lowercase

Bugs item #3510114, was opened at 2012-03-22 08:11
Message generated for change (Tracker Item Submitted) made by olafrv
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3510114&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: 1.2.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Olaf Reitmaier Veracierta (olafrv)
Assigned to: Nobody/Anonymous (nobody)
Summary: Unable to check passwords when samba hashes are in lowercase

Initial Comment:
FRAMEWORK:

phpLDAPAdmin 1.2.2
OpenLDAP: slapd 2.4.23 (Jun 15 2011 13:31:57) 
Apache/2.2.16 (Debian) 
PHP 5.3.3-7+squeeze8 with Suhosin-Patch (cli) (built: Feb 10 2012 13:05:56)
Debian Squeeze 6.0.4 Kernel 2.6.32-5-amd64 


---

PROBLEM:

When using "check password" link to check samba NT or LM hash the answer is always "Passwords do not match!!!" when the password hashes are stored in lowercase. Samba and other openldap module (smbk5pwd) generate password hashes in LOWERCASE.

I found that the problems is lmhash and nthash functions in lib/createlm.php always returns the result of hashing a plain text in UPPERCASE, but the password_check function in lib/functions.php takes this output and compare to the stored hashes as they are: UPPERCASE or LOWERCASE.

---

PROPOSED SOLUTION:

The solution is to compare password in the SAME CASE in the password_check function.  This can be accomplished with doing "strtoupper($cryptedpassword)" before do the hash comparison in the password_check function as shown here:

    switch($attribute) {
      case 'sambalmpassword':
        if (strcmp($smb->lmhash($plainpassword),strtoupper($cryptedpassword)) == 0)
          return true;
        else
          return false;

      case 'sambantpassword':
        if (strcmp($smb->nthash($plainpassword),strtoupper($cryptedpassword)) == 0)
          return true;
        else
          return false;
    }


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3510114&group_id=61828

------------------------------------------------------------------------------
This SF email is sponsosred by:
Try Windows Azure free for 90 days Click Here 
http://p.sf.net/sfu/sfd2d-msazure
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/