Querying LDAP and Active Directory from Linux with ldapsearch without a password on the command line

Goal

Run an authenticated LDAP query against an LDAP server or Active Directory from a Linux host, encrypted, without exposing a bind password in the process list or shell history.

Prerequisites

The ldap-utils package (or equivalent) providing ldapsearch; either a bind DN and password, or a valid Kerberos ticket obtained with kinit for a GSSAPI bind; the server's base DN.

Steps

1. Never put a password directly after -w on the command line — it is visible to every user on the host via ps for the command's lifetime and lands in shell history. Use -W, which the man page documents as prompting interactively for the bind password, or -y <file>, which the man page says uses the file's complete contents as the password — so a trailing newline becomes part of it. Write it with printf '%s' "$PW" > file rather than echo, and restrict it with chmod 600.
2. Simple bind example: ldapsearch -x -H ldaps://dc.example.com -D "cn=svc-agent,ou=service,dc=example,dc=com" -y /etc/ldap/svc.pass -b "dc=example,dc=com" "(uid=alice)" cn mail. -x selects simple authentication; -H ldaps://... uses implicit TLS on port 636.
3. SASL/GSSAPI bind using an existing Kerberos ticket instead of a password at all: kinit svc-agent@EXAMPLE.COM (see the Kerberos client basics article), then ldapsearch -Y GSSAPI -H ldap://dc.example.com -b "dc=example,dc=com" "(sAMAccountName=alice)". This needs the SASL GSSAPI plugin (libsasl2-modules-gssapi-mit on Debian/Ubuntu, cyrus-sasl-gssapi on RHEL-family), and ldapsearch canonicalizes the host name via reverse DNS unless -N is given, so a wrong PTR record yields a ticket request for the wrong service principal.
4. Prefer StartTLS over plain LDAP when LDAPS is not available: add -ZZ, which the man page documents as requiring StartTLS to succeed (a single -Z only requests it and continues if the server declines).
5. For large result sets, use the simple paged results control: -E pr=500/noprompt requests 500 entries per page and continues automatically rather than waiting for a key press between pages, which matters for unattended scripts. Active Directory caps a page at its MaxPageSize policy (1000 by default), so larger values do not help there.

Expected result

The command returns LDIF-formatted entries matching the filter; a failed bind returns an explicit LDAP result code (for example 49, invalid credentials) rather than an empty result set, which distinguishes "wrong credentials" from "no matches".

Limits and test basis

-y still leaves the password readable in the file's contents to anyone who can read that path, so its permissions matter as much as avoiding -w. -ZZ fails closed (the whole bind fails) if the server does not support StartTLS, which is the safer default for scripts that must not silently fall back to plaintext.