Where is "mkpasswd" for OSX?

Question

There is a well-known unix utility called mkpasswd available on many *nix systems.

I was just trying to use it from terminal on an OSX 10.10.5 Yosemite (Early 2015) machine, and it is nowhere to be found.

How can I install it on this machine? or is there an alternative already available?

Answer 1

There's a Mac implementation of mkpasswd on GitHub - https://github.com/PrototypeAlex/mkpasswd

Alternatively, Keychain Access has a built-in GUI password generator
File menu > New Password Item... > [click the key icon]

drop-menu artificially offset for visibility

I also found this Apple Discussion on how to achieve it natively, though it's unfortunately above my skill-level, so I'll let you see if you think it might be suitable.

Answer 2

Coming from the docker world, on your Mac/Windows/Linux box (with docker installed):

docker run -it --rm alpine mkpasswd -m des helloworld

Replace your mkpasswd arguments as needed.

Answer 3

I made a tool for creating mkpasswd -m sha-512 (Linux/Ubuntu) style hashes on OS X (or any platform).

First, we need to acquire a single requirement...

pip3 install passlib

Now we create mkpasswd_sha-512.py (or whatever you want to call it)...

#!/usr/bin/env python3

# based on https://stackoverflow.com/a/17992126/117471

import sys
from getpass import getpass
from passlib.hash import sha512_crypt

passwd = input() if not sys.stdin.isatty() else getpass()
print(sha512_crypt.hash(passwd))

It only handles a single use case of mkpasswd but if it fits, enjoy.

Note: There is a slightly more complicated version at https://gist.github.com/RichardBronosky/58f1b34d2bcf4c4e5f1cd18a88fdc37d which simplifies tuning the CPU Cost, but passlib manages that periodically for you so it's fine to keep it simple like this.

Answer 4

Here's the source code for mkpasswd. It's an expect script. You would have to modify the script (at least the shebang) in order for it to work. There are other command line tools such as openssl (md5), jot and dd that can generate passwords.

Answer 5

With openssl

In macOS, it's very simple, using openssl which is a native already installed package (as mentioned in the apple article shared in @Tetsujin’s answer):

I'm going here to explain how to use in details:

openssl passwd -6

• 6 stands for SHA-512

To show what crypto hashes are supported:

openssl passed -help

• Check Cryptographic options:

Input options:
 -in infile          Read passwords from file
 -noverify           Never verify when reading password from terminal
 -stdin              Read passwords from stdin

Output options:
 -quiet              No warnings
 -table              Format output as table
 -reverse            Switch table columns

Cryptographic options:
 -salt val           Use provided salt
 -6                  SHA512-based password algorithm
 -5                  SHA256-based password algorithm
 -apr1               MD5-based password algorithm, Apache variant
 -1                  MD5-based password algorithm
 -aixmd5             AIX MD5-based password algorithm

Random state options:
 -rand val           Load the given file(s) into the random number generator
 -writerand outfile  Write random data to the specified file

Provider options:
 -provider-path val  Provider load path (must be before 'provider' argument if required)
 -provider val       Provider to load (can be specified multiple times)
 -propquery val      Property query used when fetching algorithms

Using python

Refs

• Automate Server Configuration with Ansible Playbooks
  • usage with ansible playbook example (I took that one-liner and adapted it for Python3 and used getpass())
• passlib.hash.sha512_crypt - SHA-512 Crypt

Execution

One-liner:

python3 -c "from passlib.hash import sha512_crypt; import getpass; swd = getpass.getpass('Password:'); print(sha512_crypt.hash(swd))"

output format

$6$rounds=656000$9NGDC8UzAGWWIdNP$Xltp2/G/Q6geYDe07q2l426oV7b.nqjPpc7t6GZVbdZwM7XQrCDdwNkUCBvjGMZmj9qnbZ.tkmnXlxN04YY.s.

• Note that the output from this differs from the one of OpenSSL. It should work in things like ansible, and I suppose other usages. Because if the OS supports crypt() then passlib will use that sys call. There is a round param and others, check the reference above.

Requirements

• Install the passlib library:

pip3 install --user passlib 

slappasswd no SHA512

• slappasswd doesn't support SHA512
  • slappasswd(8) - Linux man page

man slappasswd

-h "scheme"
       If -h is specified, one of the following RFC 2307 schemes may be specified: {CRYPT}, {MD5}, {SMD5}, {SSHA},
       and {SHA}.  The default is {SSHA}.

       Note that scheme names may need to be protected, due to { and }, from expansion by the user's command
       interpreter.

       {SHA} and {SSHA} use the SHA-1 algorithm (FIPS 160-1), the latter with a seed.

       {MD5} and {SMD5} use the MD5 algorithm (RFC 1321), the latter with a seed.

       {CRYPT} uses the crypt(3).

       {CLEARTEXT} indicates that the new password should be added to userPassword as clear text.  Unless
       {CLEARTEXT} is used, this flag is incompatible with option -g.

Answer 6

Here is a simple mkpasswd utility written in golang for platform portability.

mkpasswd -h

Usage of mkpasswd:
  -hash string
        Optional hash argument: sha512, sha256, md5 or apr1 (default "sha512")
  -password string
        Optional password argument
  -rounds int
        Optional number of rounds
  -salt string
        Optional salt argument without prefix

Answer 7

I successfully installed mkpasswd on my macOS Catalina (10.15.2) using sudo gem install mkpasswd

Answer 8

If you actually want the original mkpasswd utility, just install expect using Homebrew:

brew install expect

However, the original mkpasswd does not include the capability to hash a password using SHA-512 mentioned elsewhere on this page.

Another way to get that is to install the Perl CPAN distributions App::bmkpasswd (providing bmkpasswd) and Crypt::Passwd::XS (providing SHA support).

You can then run:

bmkpasswd --method='sha512' <password>

on the command line to hash a password (specified in place of <password>) using SHA-512.

Answer 9

You can use ruby and securerandom library for password generation:

function random-password() {
  local length="${1:-24}"
  ruby -r securerandom -e "puts SecureRandom.base64($length)" | tr -d "[:punct:]" 2> /dev/null
}

alias mkpasswd=random-password

Check out my dotfile

Answer 10

I successfully installed mkpasswd on my macOS 10.14.5 using gem install mkpasswd.

gem install mkpasswd
Fetching mkpasswd-0.1.0.gem
Fetching unix-crypt-1.3.0.gem
Successfully installed unix-crypt-1.3.0
Successfully installed mkpasswd-0.1.0
Parsing documentation for unix-crypt-1.3.0
Installing ri documentation for unix-crypt-1.3.0
Parsing documentation for mkpasswd-0.1.0
Installing ri documentation for mkpasswd-0.1.0
Done installing documentation for unix-crypt, mkpasswd after 0 seconds
2 gems installed

Here is where I get this information.