--- /dev/null
+#!/bin/sh -eu
+# SYNTAX: $user <$password
+tool=$(readlink -e "${0%/*}/..")
+. "$tool"/local/lib.sh
+
+user=$1
+stty -echo
+IFS= read -r password
+stty echo
+salt="$(openssl rand -base64 3)"
+sha1=$(
+ cat <<-EOF | base64
+ $(openssl dgst -binary -sha1 <<-EOF
+ $password$salt
+ EOF
+ )$salt
+ EOF
+ )
+cat <<-EOF
+ $user:{SSHA}$sha1
+ EOF