Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First up, I know this question's got the potential to be downvoted and closed, nonetheless I think I will go ahead and ask it all the same because our issue is genuine enough.

We have a mail server which runs OpenLDAP for authentication and Postfix+Cyrus. So far, it has been working fine. We have an idea to configure a second mail server, possibly as a failover. Keeping that in mind, we built a server whose configuration part has been completed - i.e in essence, it is an exact duplicate of the original server including the LDAP users.

While creating the LDAP users on the 2nd server, we'd created the user's using a default password. Now, the question is, for the time being, we want to extract the passwords for the users in the original mail server and apply it to the users in the new mail server (using ldapmodify). The problem is doing and ldapsearch for the userPassword gives only the encrypted password.

How do we go about applying the old passwords for the users in the new server?

share|improve this question
up vote 1 down vote accepted

If you specify the encrypted password in the ldif file, the new server should apply the password and the user should be able to use it. I don't know how the users in your server are organized, but here is an example:

dn: uid=johndoe,ou=Users,dc=domain,dc=dom
changetype: modify
userPassword: {SSHA}AUi2EtvAOqFWfCM3hLgi6mcP+uTD6xfp

This changes the password of user johndoe to "sekretPass". There is no need do decrypt the password, it will be done by the LDAP server the next time the user wants to log in.

share|improve this answer
Thanks, Lacek. Let me check this out now... – i.h4d35 Aug 16 '13 at 9:07
Actually, the password is never decrypted (if it would be easily possible, there would be no use in storing it encrypted in the first place ;)), but the user submitted password is encrypted and then compared to the stored encrypted password. – Isaac Aug 16 '13 at 9:49
@Isaac - I never knew that part. Thanks – i.h4d35 Aug 16 '13 at 10:43
@Isaac It is hashed and compared to the hashed password. SSHA is a secure hash algorithm, not an encryption algorithm. – EJP Nov 28 '13 at 6:55
@EJP Good point,… explains the difference. I was thinking of cryptographic hashing, but I wasn't aware of the difference of hashing and encrypting. – Isaac Nov 28 '13 at 7:12

Why not setup the original LDAP server as a provider and the new server as a consumer, or in other words a master-slave setup? I guess that's the way you should do it anyway -- at the LDAP daemon level. Time to dig in to your slapd.conf!

share|improve this answer
While I agree that yours is the more efficient way, and ultimately that is what we want to achieve, we're just trying this method out before we get to a master-slave setup – i.h4d35 Aug 16 '13 at 10:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.