Generate a hashed password with random salt in the OpenLDAP SSHA format (seeded SHA-1). For use with FreeRADIUS.

ssha1.bash

#!/bin/bash

set -euo pipefail

if [ "$#" -lt 1 ]; then
  echo "usage: $0 password" >&2
  exit
fi

SALT=$(head -c 18 /dev/urandom | base64 | tr -d '\n')
SSHA=$(echo -n "$1""$SALT" | openssl dgst -binary -sha1 | awk '{print $1}')
ENCODED=$(echo -n "$SSHA""$SALT" | base64 | tr -d '\n')

echo $ENCODED