6

I am looking for a small cross-platform utility that I can recommend people use to generate salted SHA1 digest passwords suitable for use with OpenLDAP. The utility should:

  • Not require installing or any options to run
  • Not transmit the password over the wire in any form
  • Enforce some basic password quality rules
  • Generate a hash compatible with those made with slappasswd

Installing OpenLDAP, enough of a Unix environment to run slappasswd, or even just the tools needed to SSH to a remote host on random customer's Windows or Mac computers just to generate them a password is too much work. What is a simpler option? Is there a puttygen equivalent for hashed passwords?

Improve this question
8
  • 2
    Having done a bit of searching I pretty much gave up hope that something existed already so I sat down and wrote a Javascript based one this afternoon. If no answers turn up to this question I may package that up as a single downloadable html page for offline use and release it somewhere.
    – Caleb
    Mar 13, 2014 at 18:02
  • I happened to write down an answer for this question, while I was actually answering to you with your own tool. Heh, sorry for that. Would you be ok with me republishing that work as a npm module? I think it might be of use to the community.
    – Alpha
    Dec 7, 2019 at 0:37
  • @Alpha If it would be generally useful as a stand alone module I think I'd rather publish it myself that way, probably as AGPL. Would that suit your usage?
    – Caleb
    Dec 9, 2019 at 9:20
  • Yes, it would. What we need is everything that you did plus: easily accessible offline, simple code to assess security and what it actually does, easily executable from command line. I thought a simple js file (+ dependencies) and console output would fit that, so I imagined npm might fit the bill.
    – Alpha
    Dec 10, 2019 at 12:56
  • @Alpha It sounds like you want too many things from one package. Local browser UI (are you thinking SPA style or local server?) + CLI is not a good fit for one package. The code of that page is only a couple lines, and uses two libraries already in npm to do all the heavy lifting. There is also a package for getting these hashes from the CLI (but without entropy enforcement). If there was a clear spec for what you wanted I'd write it, but right now it seems kind of all over the place.
    – Caleb
    Dec 10, 2019 at 13:23

2 Answers 2

Reset to default
3

I know this question is fairly old, but I reached it by looking for a tool with those specific requirements.

I ended up at this web implementation: https://iguana.alerque.com/slappasswd.html

  • It's web, so any browser with JavaScript is enough to generate passwords
  • There is no storage or transmission of the password, the hashing is done completely offline (at least in the time of writing)
  • The hashed password displays different colours according to the complexity and entropy of the password entered. Even particular sequences (like 123) are counted so that they don't add complexity because they are very easy to predict.
  • It creates a password that can be imported into OpenLDAP servers

If you're willing to use an offline version but still cross-platform, you can use sshapw, only with npm installed:

$ npm install -g sshapw
$ sshapw
password: <entered password>
repeat password: <entered password>
{SSHA}8MLTTuGYsxWFaj6vn3nUh1o5l5c4Q7K/Zx5LvwTfaYdvZ2UZ+B10tlBqvxihOCFxFTh8rQ==
Improve this answer
0

Check out this link. It contains many different ways and also other link(s) to generate {SHA} and {SSHA} password. For my use case, i only needed {SHA} password, so this was enough for me:

The below batch script can generate a {SHA} hash suitable for LDAP passwords:

makeshahash.bat:
@echo off
echo|set /p="{SHA}"
echo|set /p="%1" | openssl dgst -sha1 -binary | openssl enc -base64

makeshahash.bat secret
{SHA}5en6G6MezRroT3XKqkdPOmY/BfQ=

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.