Bug 263241

Actually NTLM is fundamentally non-FIPS. MD4 has never been FIPS, regular DES is
no longer FIPS (in favor of DES3 and AES).

bob

Based on the date this bug was created, it appears to have been reported
during the development of Fedora 8. In order to refocus our efforts as
a project we are changing the version of this bug to '8'.

If this bug still exists in rawhide, please change the version back to
rawhide.
(If you're unable to change the bug's version, add a comment to the bug
and someone will change it for you.)

Thanks for your help and we apologize for the interruption.

The process we're following is outlined here:
http://fedoraproject.org/wiki/BugZappers/F9CleanUp

We will be following the process here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping to ensure this
doesn't happen again.

Changing version to '9' as part of upcoming Fedora 9 GA.
More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

What about libntlm? http://josefsson.org/libntlm/

It's already used by XChat and GNU SASL (libgsasl) (at least those are the ones linking against it in Rawhide, there may be more), it has no dependencies other than glibc and it implements just NTLM, no more no less, so it doesn't duplicate the functionality of NSS.

IMHO it's exactly what we're looking for.

By the way, the specfile for the Fedora package is here:
http://cvs.fedoraproject.org/viewvc/rpms/libntlm/devel/libntlm.spec?revision=1.7&view=markup

Looks really easy to package and maintain (can't really get much simpler), and the soname is still at .so.0, so they aren't breaking the ABI willy-nilly either, and the license is plain LGPLv2+, thus it might even be a candidate for LSB inclusion and/or be of interest to other distributions (if they aren't already shipping it as a dependency of GNU SASL and/or XChat). To me, it definitely looks like a good solution, though I admit I haven't looked at its API and I'm not a crypto expert at all. (I just thought of it because I remembered XChat uses it.)

Sounds good to me. I certainly don't think we should write a new one. We just need to get everything else to use it.

bob

The libntlm package works fine for NTLM authentication, but we do have a need for some more basic MD4 operations.

For Fedora Directory Server, we want the ability to take MD4 hashed passwords from Active Directory and pull them into our database when syncing accounts.  This would allow AD users to use their AD password to authenticate to FDS.

In order for this to work, we need a compare function at a minimum.  We would want to pass in the MD4 hash and a clear-text password and get a response telling us the results of the comparison.

In addition, we would need a function to MD4 hash a clear password for true MD4 password storage in FDS, though we may be able to get away without doing this if we only want to support MD4 when pulling passwords in from AD.  I'm not sure if this would work properly given the current structure of a password storage scheme plug-in in FDS.

Indeed, unfortunately, libntlm doesn't export the MD4 functions. Maybe we could get the author to change that?

This message is a reminder that Fedora 9 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 9.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '9'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 9's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 9 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle.
Changing version to '12'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

*** Bug 258481 has been marked as a duplicate of this bug. ***

This message is a reminder that Fedora 12 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 12.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '12'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 12's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 12 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

This message is a notice that Fedora 14 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 14. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained.  At this time, all open bugs with a Fedora 'version'
of '14' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this 
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen 
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we were unable to fix it before Fedora 14 reached end of life. If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora, you are encouraged to click on 
"Clone This Bug" (top right of this page) and open it against that 
version of Fedora.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping