Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I use the following script to change Open Directory (Apple's LDAP) passwords.

I don't like leaving the actual password within the script -- is there any way to hide or masquerade this so the script can be used by other users, but in a way they can't see the password?

PATH=/bin:/usr/bin:/sbin:/usr/sbin export PATH
echo Enter username you\'d like to change password for:
echo Enter New Password for "$USERNAME"
dscl -u diradmin -P 'secretpasswordhere' /LDAPv3/ passwd /Users/$USERNAME $PASSWORD
echo Password successfully changed for $USERNAME to $PASSWORD
share|improve this question

2 Answers 2

You could have the script run as Set-GID and then get the password information from a file protected under this group. The group of course should have limited access and membership. This is a very simple answer.

Another idea is to have the user enter a decrypt code for the scrambled password contained in the scripting. Thus only authorized users (those with the decrypt code) could run the script.

share|improve this answer

have a look at shc

 The whole logic behind the shc is to convert the 
   shell script to C program (and of course compile that
   to generate the executable)
  • is the original unencrypted shell script
  • is the encrypted shell script in binary format
  • is the C source code of the file. This C source code is compiled to create the above encrypted file.
share|improve this answer
SHC looks like an elegant solution, but alas it doesn't appear to compile properly in OSX...rats –  Dan Oct 15 '12 at 21:56
Maybe it uses some linux-specific system calls. But in any case you got the idea. It should not be very difficult to create your own version. –  Nikolaidis Fotis Oct 15 '12 at 22:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.