SLAPPASSWD(8C)

📦
version 2.7.2 · 25 versions
, in arch rolling

💖 SLAPPASSWD(8C) — slappasswd, bestie edition 💖

okay so welcome to the manual page for slappasswd, from the 8C section. it's the OpenLDAP password utility and honestly? it's giving "small tool, big job." let's get into it 🫶

✨ NAME ✨

slappasswd — the OpenLDAP password utility, aka the little guy who makes your password hash for you 💅

🌸 SYNOPSIS 🌸

/usr/bin/slappasswd [-v] [-u] [-g|-s secret|-T file] [-h hash] [-c salt-
format] [-n] [-o option[=value]]

(yeah the salt-format wraps onto the next line, that's just the terminal being dramatic, don't panic 🎀)

🦋 DESCRIPTION 🦋

so what does this thing do? it generates a userPassword value, and that value is ready to go straight into:

that's the whole vibe. you give it a secret, it gives you a hash, you go put that hash somewhere. iconic, honestly ✨

💅 OPTIONS 💅

  • -v — turns on verbose mode. it will talk to you. let it yap 💬
  • -u — generates RFC 2307 userPassword values, and this is the default, so it's already doing this. future versions of this program may generate alternative syntaxes by default, and this option exists purely for forward compatibility. so basically it's a reassurance flag 🫶
  • -s secret — the actual secret you want hashed. if this, -g and -T are all absent, the user gets prompted for the secret to hash. also: -s, -g and -T are mutually exclusive flags, you can't run all three, pick one bestie 😭
  • -g — generate the secret. if this, -s and -T are absent, the user will be prompted for the secret to hash. -s, -g and -T are mutually exclusive flags. if this one is present, {CLEARTEXT} is used as the scheme. also -g and -h are mutually exclusive flags, so don't try it 🚫
  • -T "file" — hash the contents of the file. if this, -g and -s are absent, the user will be prompted for the secret to hash. -s, -g and -T are mutually exclusive flags. (the original literally says "and mutually exclusive flags" instead of "are", we love a typo moment, but the meaning is loud and clear 💀)
  • -h "scheme" — if -h is specified, one of these RFC 2307 schemes may be specified: {CRYPT}, {MD5}, {SMD5}, {SSHA}, and {SHA}. the default is {SSHA}.
heads up: scheme names may need to be protected from expansion by the user's command interpreter, because of the { and } characters. quote them, please, for your own sake 🙈

here's the scheme tea ☕:

  • {SHA} and {SSHA} use the SHA-1 algorithm (FIPS 160-1), and the latter uses a seed.
  • {MD5} and {SMD5} use the MD5 algorithm (RFC 1321), and the latter uses a seed.
  • {CRYPT} uses crypt(3).
  • {CLEARTEXT} indicates that the new password should be added to userPassword as clear text. unless {CLEARTEXT} is used, this flag is incompatible with option -g.
  • -c crypt-salt-format — specifies the format of the salt passed to crypt(3) when generating {CRYPT} passwords. this string has to be in sprintf(3) format and may include one (and only one 💀) %s conversion. that conversion gets substituted with a string of random characters from [A-Za-z0-9./]. for example, '%.2s' gives you a two character salt, and '$1$%.8s' tells some versions of crypt(3) to use an MD5 algorithm and provides 8 random characters of salt. the default is '%s', which provides 31 characters of salt. no cap, that's a lot of salt 🧂✨
  • -n — omits the trailing newline. useful for piping the credentials into a command. shell girlies stay winning 🔥
  • -o option[=value] — specify an option with a(n optional) value. the possible generic options/values are:
module-path=<pathspec> (see `modulepath' in slapd.conf(5))
module-load="<filename> [<arguments>...]" (see `moduleload' in slapd.conf(5))

you can load a dynamically loadable password hash module by using this option. plug in modules, glow up your hashing 👑

💀 LIMITATIONS 💀

the practice of storing hashed passwords in userPassword violates Standard Track (RFC 4519) schema specifications and may hinder interoperability. a new attribute type, authPassword, to hold hashed passwords has been defined (RFC 3112), but it is not yet implemented in slapd(8). so like, the better thing exists but it's not here yet. tragic.

also it should be noted that the behavior of crypt(3) is platform specific. so what slays on one machine might do something completely different on another 😭

🔒 SECURITY CONSIDERATIONS 🔒

okay this is the serious part, pay attention bestie:

use of hashed passwords does not protect passwords during protocol transfer. TLS or other eavesdropping protections should be in-place before using LDAP simple bind. like, please, turn on TLS, i am begging 🙏

and the hashed password values should be protected as if they were clear text passwords. yes really. treat your hash like it's the actual password, because that's the energy it deserves 💜

🌈 SEE ALSO 🌈

go read those, iykyk 📚

🫶 ACKNOWLEDGEMENTS 🫶

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release. shoutout to the University of Michigan LDAP 3.3 Release, you're the blueprint periodt 👑

and that's the whole page, bestie 💖 this was OpenLDAP 2.7.2, dated 2026/10/21, and you just read SLAPPASSWD(8C). go hash something cute and protect your secrets, mwah 💅🎀✨

📦 where this page comes from