How to Deploy the macOS Open Directory Password Server (mkpassdb) for Legacy Cryptographic Hash Extraction

In legacy macOS environments, local user authentication and password management were governed by the Open Directory framework, specifically utilizing the mkpassdb (Password Server) subsystem. While modern macOS deployments (macOS 10.15 Catalina and later) have largely migrated away from Open Directory in favor of local PAM (Pluggable Authentication Modules), FileVault SecureToken architecture, and Mobile Device Management (MDM) integrations, many enterprise organizations still maintain legacy Mac minis or Xserves acting as Open Directory Masters. When migrating these legacy users to modern identity providers (like Okta, Google Workspace, or Microsoft Entra ID), identity engineers frequently need to extract the underlying cryptographic password hashes to facilitate seamless, password-synchronized migrations. This extraction is accomplished by deploying specific diagnostic commands against the mkpassdb architecture.

Understanding the Password Server Architecture

The macOS Open Directory Password Server does not store passwords in plain text, nor does it store them in the standard /etc/shadow file utilized by most Linux distributions. Instead, it utilizes a proprietary, highly secure Berkeley DB (BDB) database, historically located at /var/db/authserver/authservermain.db or within the /var/db/dslocal/nodes/Default/users/ directory depending on the specific macOS iteration.

When a user authenticates, the Password Server validates the input against a complex array of cryptographic hash formats. To support legacy protocols like AFP (Apple Filing Protocol), SMB, and older VPN connections, mkpassdb simultaneously generated and stored multiple hash types for a single password, typically including:

• NTLM: Used for legacy SMB/Windows compatibility.
• SHA-1 / SHA-512 (PBKDF2): The primary hashes used for local macOS GUI login.
• CRAM-MD5: Used for legacy mail protocols.

Extracting these hashes requires administrative (root) access and the direct utilization of the mkpassdb utility or the dscl (Directory Service command line) utility, as the database files are mathematically protected by strict POSIX permissions and System Integrity Protection (SIP) on modern systems.

Extracting Hashes utilizing mkpassdb

If you are operating directly on a legacy Open Directory Master server, you can utilize the mkpassdb command to interrogate the database.

First, you must obtain the globally unique identifier (GUID) of the target user. You can find this using the dscl command:

dscl . -read /Users/jdoe GeneratedUID

This command returns a UUID string (e.g., GeneratedUID: 12345678-ABCD-EFGH-IJKL-987654321012).

Once you possess the UUID, you execute the mkpassdb command utilizing the -dump flag. Because this command accesses the raw security database, it must be executed as root:

sudo mkpassdb -dump | grep "12345678-ABCD-EFGH-IJKL-987654321012"

This command outputs the raw hexadecimal representation of the user’s slot within the Password Server database. Depending on the macOS version and the authentication protocols enabled during the user’s password creation, this payload contains the cryptographic hashes.

Extracting Modern PBKDF2 Hashes via dscl

On more recent iterations of macOS (where local accounts are standard, rather than network OD accounts), the Password Server architecture transitioned to storing a highly secure PBKDF2 (Password-Based Key Derivation Function 2) payload directly within the user’s .plist file in the dslocal directory.

To extract this specific payload, you interrogate the ShadowHashData attribute. This attribute is deliberately hidden from standard dscl queries; you must explicitly request it.

sudo dscl . -read /Users/jdoe dsAttrTypeNative:ShadowHashData

The output is a base64-encoded binary property list (bplist). To make this data human-readable (and extractable for migration scripts), you must convert the base64 string into a binary file, and then utilize the plutil command to convert the binary property list into XML or JSON.

# Extract the base64 payload and decode it
sudo dscl . -read /Users/jdoe dsAttrTypeNative:ShadowHashData | tail -n 1 | tr -d ' ' | xxd -r -p > /tmp/hash.bplist

# Convert the bplist to XML for analysis
plutil -convert xml1 /tmp/hash.bplist -o /tmp/hash.xml

# View the extracted cryptographic parameters
cat /tmp/hash.xml

The resulting XML file contains the entropy (the actual hash), the cryptographic salt, and the iterations count (often heavily randomized to defeat brute-force attacks). By utilizing these extraction methodologies, identity engineers can securely migrate legacy macOS credentials into modern, cloud-native directory services.