zap-pass.sh

#!/bin/bash
#---
#  zap-pass.sh - reset user's password to random string
#                move user to the disabled branch
#---

if [ r$1 = r ]; then
        echo "usage: `basename $0` <username>"
        exit 1
fi

newpass=`tr -cd '[:alnum:][:punct:]' < /dev/urandom | fold -w30 | head -n1`
ldapmodify -h ldap-prod1 -D "cn=Dadmin" -y /root/pw  << EOF
memberUid: $1
dn: uid=$1,ou=people,dc=example,dc=com
changetype: modify
replace: userPassword
userPassword: $newpass
EOF

ldapmodify -h ldap-prod1 -D "cn=Dadmin" -y /root/pw  << EOF
dn: uid=$1,ou=people,dc=example,dc=com
changetype: moddn
newrdn: uid=$1
deleteoldrdn: 1
newsuperior: ou=disabled,dc=example,dc=com
EOF