29

How am I supposed to pass a password to ldapsearch using the -y <password file> option?
If I write the password in the password file in plain text, I get this error:

ldap_bind: Invalid credentials (49)
    additional info: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 52e, v1772

The same happens if I use the -w <password> option.

EDIT:
The command I'm running is

ldapsearch -x -D <my dn> -y .pass.txt -h server.x.x -b "dc=x,dc=y" "cn=*"

Where the file .pass.txt contains my password, in plain text. Both the DN and the password are correct. If I run the command with the -W option and type the password on the prompt the command runs successfully, but I would like to store the password somehow to make a script.

1
  • What kind of "password file" are you using? You may want to show us the complete command you are typing. Are you using correct bind credentials?
    – solefald
    May 11, 2010 at 16:27

5 Answers 5

34

Keep in mind that ldapsearch will use the entire contents of the file for the password--which means it WILL include a terminating newline character if one exists. To verify if this is in fact your problem, try creating a file without one:

echo -n ThisIsaBadPassword > .pass.txt

(UPDATE: Included '-n')

5
  • 1
    I just tried that, but I get exactly the same error... May 11, 2010 at 16:49
  • 4
    No, it won't. You need echo -n or printf in order to avoid the newline. May 11, 2010 at 19:23
  • The echo -n did the trick! Thank you all for your help. May 12, 2010 at 7:14
  • In followup to grawity's comment, echo -n works perfectly, e.g.: echo -n "secretpassword" > /etc/ldapscripts/ldapscripts.passwd
    – Ned W.
    Oct 9, 2013 at 20:16
  • Annoying problem solved due to this, thanks. I just used sed to strip the end of an existing file, though.
    – wirefox
    May 4, 2018 at 19:06
2

Assuming it is the newline/carriage reuturn try the following:

cat .pass.txt | tr -d '\n\r' > .pass2.txt

Then use the .pass2.txt file. You can always check for new lines and carriage returns with cat -vE and they will show up as $ and ^M respectively.

You could also probably do -y <(cat .pass.txt | tr -d '\n\r') directly in the ldapsearch command.

1

Combining answers from @Brian Showalter, Kyle Brandt and others, the desirable solution is:

read -s LDAPPASS
echo -n "$LDAPPAS"" | ldapsearch -x -D $MYDN -y /dev/stdin -h $MYSERVER -b $MYBASE "cn=*"

LDAPPASS is in the user's environment, which on modern Linux's is secure enough. The echo is internal and not ever visible in the process table, which means ldapsearch gets the information through a secure channel, and not leaked anywhere on disk (unless of course your process gets swapped during execution).

0

ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass.txt -H ldap://ldap.domain.com -b dc=domain,dc=com

You might have to chmod 600 pass.txt

-1

There's no need to dump the password into an actual file. Just echo it with the -n flag to prevent the newline, then read it in from the STDIN file descriptor (/dev/fd/0) as follows:

echo -n 'mypassword' | ldapsearch -x -D <my dn> -y /dev/fd/0 -h server.x.x -b "dc=x,dc=y" "cn=*"
2
  • the problem with this approach is it leaves you subject to shell history and PS to discover your password.
    – cgseller
    May 2, 2018 at 15:53
  • 2
    Point taken. It's mid-2018 now. I've learned from my mistakes. Don't take my 2014 blathering seriously. Thank you. :) Jun 6, 2018 at 2:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .