Chapter 1. General information

Winsync and PassSync have been deprecated in 12.6

The Winsync plug-in and PassSync package that were used for synchronization with Active Directory have been deprecated in Red Hat Directory Server 12.6 and will be removed in future releases because PassSync is not maintained upstream. Consider using Identity Management (IdM) and cross-forest trust for Active Directory as an alternative.

The Directory Server 12 default password storage scheme is PBKDF2-SHA512

Directory Server 12 uses the PBKDF2-SHA512 scheme as a default password storage scheme, which is more secure than SSHA, SSHA512, and other schemes. Therefore, if some of your applications, such as freeradius, do not support the PBKDF2-SHA512 scheme, and you must set a weaker password storage scheme back, note that Directory Server updates user passwords not only when an application adds or modifies the user entry, but also during a successful bind operation. However, you can disable an update on bind operations by setting the nsslapd-enable-upgrade-hash parameter in the cn=config entry to off.

New command-line utilities starting Directory Server 11

Since version 11, Directory Server provides new command line utilities to manage server instances and users. These utilities replace the Perl scripts used for management tasks in Directory Server 10 and earlier versions.