Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using OpenLDAP 2.4.23 on Ubuntu 11.04. Every thing is working fine. I am using other server to authenticate via LDAP and that is working well. At the connecting server I am using a configuration file like this:

basedn = ou=Employees,dc=example,dc=com
basedn_filter = personStatus=1
bind_passwd = pass123
bind_user = cn=admin,dc=example,dc=com
cache_size = 100
cache_ttl = 900
enable = true
global_perms = false
group_bind = false
group_rdn =
groupattr = cn
groupmember = member
groupmemberisdn = false
groupname = groupofnames
#host =
host =
manage_groups = false
port = 389

Is there any way I can encrypt the password used to bind to LDAP?

share|improve this question

You could use SSL (or TLS) to encrypt the traffic. The OpenLDAP 2.4 manual has a section on using TLS, as does the OpenLDAP FAQ. The Ubuntu 11.04 manual has a section on LDAP which includes using TLS/SSL. The FreeBSD project (home to some of the best manuals I've seen) has an article on LDAP Authentication which includes a section on configuring LDAP with TLS.

I found this information through a Google search...

share|improve this answer


The plaintext password is needed to bind to LDAP, so even if it were encrypted in some way, you'd need the key to decrypt it on the system as well (a la having an encrypted SSL key and storing the password to the key in the web server config). Obscurity is not security; leaving the password in plaintext is no less secure than encrypting it with a key that's also in the config.

Set the permissions on your LDAP config to not be world-readable, and if the system can potentially be physically compromised, then use some kind of disk encryption.

share|improve this answer
Are you saying that you can't encrypt with SSL? The OpenLDAP docs, the Ubuntu docs, and the FreeBSD docs all disagree with you. – Mei Jan 30 '12 at 23:04
@David No, you're absolutely right that SSL/TLS should be used any time you're doing a basic LDAP bind - but the way I interpreted the question is that he was looking for a way to encrypt the plaintext password in the config file. I think it's a little clearer in the original text of the question: Is there any way so than I can use encrypted password in the place of bind_passwd option. – Shane Madden Jan 30 '12 at 23:07

If your client application allows TLS/EXTERNAL authentication (that is: x509 certificates-based), you could than dispose the clear-text password and substitute it with a client certificate. Please be warned the server requires a couple of configuration changes in order to accept SASL TLS/EXTERNAL.

share|improve this answer
If you are really shy of having a clear-text password in a file, this the way to go. But it might be only cosmetic: as a evil user could read the file, could as well steal the key (if she has the access rights). – 473183469 Nov 20 '15 at 10:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.