slappasswd Command in Linux: Generate OpenLDAP Password Hashes

Generate the value before setting a directory-manager password in a disposable lab. Quoting the secret prevents the shell from interpreting !.

sudo slappasswd -s 'LabPass123!'

Sample output:

{SSHA}U/8zYVk9dI894n/rMTUzSej+5Q9vBw60

The {SSHA} prefix tells OpenLDAP how to verify the value; the random salt means another run produces a different hash for the same secret.

On a real server, omit -s so the password is entered at the prompt rather than recorded in the command history.

sudo slappasswd

The program prompts twice and prints one hash after the values match. Paste that hash into the intended LDIF only; do not store the clear-text password beside it.

Use -u when a script should state that it expects the RFC 2307 userPassword syntax, even though it is the current default.

sudo slappasswd -u -s 'LabPass123!'

Sample output:

{SSHA}UfizA53Z7w2WfO0AuINU/5Q1mSZ96fV6

The output remains a scheme-tagged password value such as {SSHA}...; it is safe to place in userPassword, but is still sensitive credential material.

Specify the scheme when documenting a controlled migration or when a configuration standard requires it.

sudo slappasswd -h '{SSHA}' -s 'LabPass123!'

Sample output:

{SSHA}pOSTwXROas4ELWpRtFR780W01apTZRhx

The shell quotes {SSHA} so brace expansion cannot alter it. Avoid {SHA} and {MD5} for new deployments because they are older unsalted or weaker choices.

OpenLDAP 2.6.10 still generates older schemes when asked, but new userPassword and olcRootPW values should stay on {SSHA} or stronger policy.

sudo slappasswd -h '{SHA}' -s 'LabPass123!'

Sample output:

{SHA}8JofvXi6CJmUQ0JvofnSRbp5Rfk=

The unsalted {SHA} form is deterministic for the same password, which is one reason salted schemes are preferred today.

-g emits a random clear-text secret, not a stored hash. Use it when another protected process will immediately consume the password.

sudo slappasswd -g

Sample output:

sD3rxbQu

Treat the output as a password, not a hash. Do not use -g with -h; those flags are mutually exclusive.

For noninteractive automation, keep the input in a file readable only by root and let -T read its contents.

sudo slappasswd -T /root/ldap-secret.txt

Sample output:

{SSHA}UiuLDzAZqkKIhb2jLhqNV3lO5z4ehCGm

The command hashes the file contents. Keep the file out of source control and remove it after a one-time bootstrap when possible.

-n is useful when a script captures stdout directly into an LDIF placeholder.

sudo slappasswd -n -s 'LabPass123!'

Sample output:

{SSHA}d5QD9+1SOs2ZTU1nLZ4oHe9oOgcVI1oT

There is no newline after the hash, so $(sudo slappasswd -n -s 'secret') does not pick up an extra blank line in shell substitution.

Set the suffix administrator hash in cn=config during OpenLDAP installation on RHEL. Discover $MDB_DN first, then paste the generated hash.

HASH=$(sudo slappasswd -s 'LabPass123!')

Create configure-mdb.ldif with restrictive permissions:

umask 077
cat > configure-mdb.ldif <<EOF
dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: $HASH
EOF

Preview the change without applying it:

sudo ldapmodify -n -v -Q -Y EXTERNAL -H ldapi:/// -f configure-mdb.ldif

Sample output:

replace olcRootPW:
	{SSHA}AmFq9NLKHDQalkf+z07R3d8Qv9YKtmig
!modifying entry "olcDatabase={2}mdb,cn=config"

Remove -n from ldapmodify only after the hash and target DN are correct.

After applying the LDIF, confirm the server accepts the administrator simple bind over StartTLS.

ldapwhoami -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W

Sample output:

Enter LDAP Password:
dn:cn=admin,dc=example,dc=com

A successful dn: line proves the stored hash matches the password you typed at the prompt.