SLAPPASSWD(8C) SLAPPASSWD(8C)

NAME
       slappasswd - OpenLDAP password utility

SYNOPSIS
       //uussrr//ssbbiinn//ssllaappppaasssswwdd  [[-vv]] [[-uu]] [[-ss sseeccrreett||-TT ffiillee]] [[-hh hhaasshh]] [[-cc ssaalltt-
       ffoorrmmaatt]]


DESCRIPTION
       SSllaappppaasssswwdd is used to generate an userPassword value suitable  for  use
       with llddaappmmooddiiffyy(1) or ssllaappdd..ccoonnff(5) rootpw configuration directive.

OOPPTTIIOONNSS
       -vv     enable verbose mode.

       -uu     Generate  RFC  2307  userPassword  values (the default).  Future
              versions of this program may generate  alternative  syntaxes  by
              default.  This option is provided for forward compatibility.

       -ss secret
              The secret to hash.  If this and -TT are absent, the user will be
              prompted for the secret to hash.  -ss and -TT and mutually  exclu-
              sive flags.

       -TT file
              Hash  the  contents of the file.  If this and -ss are absent, the
              user will be prompted for the secret to hash.   -ss  and  -TT  and
              mutually exclusive flags.

       -hh scheme
              If -h is specified, one of the following RFC 2307 schemes may be
              specified: {CRYPT},  {MD5},  {SMD5},  {SSHA},  and  {SHA}.   The
              default is {SSHA}.

              Note that scheme names may need to be protected, due to {{ and }},
              from expansion by the user's command interpreter.

              {{SSHHAA}} and {{SSSSHHAA}} use the SHA-1 algorithm (FIPS 160-1), the  lat-
              ter with a seed.

              {{MMDD55}}  and  {{SSMMDD55}}  use the MD5 algorithm (RFC 1321), the latter
              with a seed.

              {{CCRRYYPPTT}} uses the ccrryypptt(3).

              {{CCLLEEAARRTTEEXXTT}} indicates that the new password should be  added  to
              userPassword as clear text.

       -cc crypt-salt-format
              Specify  the format of the salt passed to ccrryypptt(3) when generat-
              ing {CRYPT} passwords.  This string needs to  be  in  sspprriinnttff(3)
              format  and  may include one (and only one) %s conversion.  This
              conversion will be substituted with a string  random  characters
              from  [A-Za-z0-9./].  For example, "%.2s" provides a two charac-
              ter salt and "$1$%.8s" tells some versions of crypt(3) to use an
              MD5  algorithm  and  provides  8 random characters of salt.  The
              default is "%s", which provides 31 characters of salt.

LLIIMMIITTAATTIIOONNSS
       The practice storing hashed passwords in userPassword violates Standard
       Track (RFC 2256) schema specifications and may hinder interoperability.
       A new attribute type, authPassword, to hold hashed passwords  has  been
       defined (RFC 3112), but is not yet implemented in ssllaappdd(8).

       It should also be noted that the behavior of
              ccrryypptt(3) is platform specific.

SSEECCUURRIITTYY CCOONNSSIIDDEERRAATTIIOONNSS
       Use  of  hashed  passwords  does  not protect passwords during protocol
       transfer.  TLS or other eavesdropping protections  should  be  in-place
       before using LDAP simple bind.

       The hashed password values should be protected as if they
              were clear text passwords.

SEE ALSO
       llddaappppaasssswwdd(1),  llddaappmmooddiiffyy(1), ssllaappdd(8) ssllaappdd..ccoonnff(5) RRFFCC 22330077 RRFFCC 22225566
       RRFFCC 33111122

       "OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

AACCKKNNOOWWLLEEDDGGEEMMEENNTTSS
       OpenLDAP  is  developed  and  maintained  by   The   OpenLDAP   Project
       (http://www.openldap.org/).   OpenLDAP  is  derived  from University of
       Michigan LDAP 3.3 Release.



OpenLDAP 2.2.19                   2004/11/26                    SLAPPASSWD(8C)