How safe are LDAP credentials in printer clone files?

A hash would not normally work here. The printer needs the original secret to authenticate to LDAP, so it has to retain it in a recoverable form or obtain it through some other mechanism. A vendor clone file may encrypt the secret, but that does not by itself tell you how strong the protection is or whether the credential can be recovered.

Treat the clone file as sensitive, too. Limit who can export or distribute it, and check the specific printer model and firmware documentation rather than assuming the file format makes the secret safe.

Separate storage from transport. Even if a printer protects a saved password at rest, a simple LDAP bind without TLS can expose credentials on the network. Use LDAPS or StartTLS if the device supports it, and verify the connection settings actually enforce encryption. Some devices may support secure authentication methods instead, but support varies.

Use a dedicated service account with only the directory read permissions needed for lookups. Do not reuse an administrator or employee account, and avoid granting broad access just to make the printer work. If the printer or its clone file is exposed, a narrowly scoped account limits the damage.

Cloning that preserves the setting strongly suggests the credential, or a usable representation of it, is included in the configuration or retained through some device-specific mechanism. It does not prove the password is plaintext, and without the manufacturer’s details there is no reliable way to say how the file is protected. Keep clone files out of shared folders and ordinary ticket attachments, and rotate the account secret if one may have been exposed.