4

I am looking for a small cross-platform utility that I can recommend people use to generate salted SHA1 digest passwords suitable for use with OpenLDAP. The utility should:

  • Not require installing or any options to run
  • Not transmit the password over the wire in any form
  • Enforce some basic password quality rules
  • Generate a hash compatible with those made with slappasswd

Installing OpenLDAP, enough of a Unix environment to run slappasswd, or even just the tools needed to SSH to a remote host on random customer's Windows or Mac computers just to generate them a password is too much work. What is a simpler option? Is there a puttygen equivalent for hashed passwords?

  • 2
    Having done a bit of searching I pretty much gave up hope that something existed already so I sat down and wrote a Javascript based one this afternoon. If no answers turn up to this question I may package that up as a single downloadable html page for offline use and release it somewhere. – Caleb Mar 13 '14 at 18:02
  • I happened to write down an answer for this question, while I was actually answering to you with your own tool. Heh, sorry for that. Would you be ok with me republishing that work as a npm module? I think it might be of use to the community. – Alpha Dec 7 '19 at 0:37
  • @Alpha If it would be generally useful as a stand alone module I think I'd rather publish it myself that way, probably as AGPL. Would that suit your usage? – Caleb Dec 9 '19 at 9:20
  • Yes, it would. What we need is everything that you did plus: easily accessible offline, simple code to assess security and what it actually does, easily executable from command line. I thought a simple js file (+ dependencies) and console output would fit that, so I imagined npm might fit the bill. – Alpha Dec 10 '19 at 12:56
  • @Alpha It sounds like you want too many things from one package. Local browser UI (are you thinking SPA style or local server?) + CLI is not a good fit for one package. The code of that page is only a couple lines, and uses two libraries already in npm to do all the heavy lifting. There is also a package for getting these hashes from the CLI (but without entropy enforcement). If there was a clear spec for what you wanted I'd write it, but right now it seems kind of all over the place. – Caleb Dec 10 '19 at 13:23
1

I know this question is fairly old, but I reached it by looking for a tool with those specific requirements.

I ended up at this web implementation: https://iguana.alerque.com/slappasswd.html

  • It's web, so any browser with JavaScript is enough to generate passwords
  • There is no storage or transmission of the password, the hashing is done completely offline (at least in the time of writing)
  • The hashed password displays different colours according to the complexity and entropy of the password entered. Even particular sequences (like 123) are counted so that they don't add complexity because they are very easy to predict.
  • It creates a password that can be imported into OpenLDAP servers

If you're willing to use an offline version but still cross-platform, you can use sshapw, only with npm installed:

$ npm install -g sshapw
$ sshapw
password: <entered password>
repeat password: <entered password>
{SSHA}8MLTTuGYsxWFaj6vn3nUh1o5l5c4Q7K/Zx5LvwTfaYdvZ2UZ+B10tlBqvxihOCFxFTh8rQ==
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.