Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

20.7. Managing the Directory Manager Password

The Directory Manager is the privileged database administrator, comparable to the root user in Linux. The Directory Manager entry and the corresponding password are set during the instance installation.
The default distinguished name (DN) of the Directory Manager is cn=Directory Manager.

20.7.1. Resetting the Directory Manager Password
Link kopieren

If you lose the Directory Manager password, reset it:
  1. Stop the Directory Server instance: 
    # dsctl instance_name stop
    Copy to Clipboard Toggle word wrap
  2. Generate a new password hash. For example: 
    # pwdhash -D /etc/dirsrv/slapd-instance_name password
{PBKDF2_SHA256}AAAgABU0bKhyjY53NcxY33ueoPjOUWtl4iyYN5uW...
    Copy to Clipboard Toggle word wrap
    Specifying the path to the Directory Server configuration automatically uses the password storage scheme set in the nsslapd-rootpwstoragescheme attribute to encrypt the new password.
  3. Edit the /etc/dirsrv/slapd-instance_name/dse.ldif file and set the nsslapd-rootpw attribute to the value displayed in the previous step: 
    nsslapd-rootpw: {PBKDF2_SHA256}AAAgABU0bKhyjY53NcxY33ueoPjOUWtl4iyYN5uW...
    Copy to Clipboard Toggle word wrap
  4. Start the Directory Server instance: 
    # dsctl instance_name start
    Copy to Clipboard Toggle word wrap

20.7.2. Changing the Directory Manager Password
Link kopieren

This section describes how to can change the password of the Directory Manager account.
Use one of the following options to set the new password:

Important

Only set the password using an encrypted connection. Using an unencrypted connection can expose the password to the network. If your server does not support encrypted connections, use the web console to update the Directory Manager password. See Section 20.7.2.2, “Changing the Directory Manager Password Using the Web Console”.
  • To set the nsslapd-rootpw parameter to a plain text value which Directory Server automatically encrypts: 
    # dsconf -D "cn=Directory Manager" ldaps://server.example.com config replace nsslapd-rootpw=password
    Copy to Clipboard Toggle word wrap

    Warning

    Do not use curly braces ({}) in the password. Directory Server stores the password in the {password-storage-scheme}hashed_password format. The server interprets characters in curly braces as the password storage scheme. If the string is an invalid storage scheme or if the password is not correctly hashed, the Directory Manager cannot connect to the server.
  • To manually encrypt the password and setting it in the nsslapd-rootpw parameter:
    1. Generate a new password hash. For example: 
      # pwdhash -D /etc/dirsrv/slapd-instance_name password
{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty...
      Copy to Clipboard Toggle word wrap
      Specifying the path to the Directory Server configuration automatically uses the password storage scheme set in the nsslapd-rootpwstoragescheme attribute to encrypt the new password.
    2. Set the nsslapd-rootpw attribute to the value displayed in the previous step using a secure connection (STARTTLS): 
      # dsconf -D "cn=Directory Manager" ldaps://server.example.com config replace nsslapd-rootpw="{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty..."
      Copy to Clipboard Toggle word wrap

20.7.2.2. Changing the Directory Manager Password Using the Web Console
Link kopieren

As the administrator, perform these steps to change the password:
  1. Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
  2. Select the instance.
  3. Open the Server Settings menu, and select Server Settings.
  4. Open the Directory Manager tab.
  5. Enter the new password into the Directory Manager Password and Confirm Password fields
  6. Optionally, set a different password storage scheme.
  7. Click Save.

20.7.3. Changing the Directory Manager Password Storage Scheme
Link kopieren

The password storage scheme specifies which algorithm Directory Server uses to hash a password. To change the storage scheme using the command line, your server must support encrypted connections. If your server does not support encrypted connections, use the web console to set the storage scheme. See Section 20.7.3.2, “Changing the Directory Manager Password Storage Scheme Using the Web Console”.
Note that the storage scheme of the Directory Manager (nsslapd-rootpwstoragescheme) can be different than the scheme used to encrypt user passwords (nsslapd-pwstoragescheme).
For a list of supported password storage schemes, see the corresponding section in the Red Hat Directory Server Configuration, Command, and File Reference.

Note

If you change the Directory Manager's password storage scheme you must also reset its password. Existing passwords cannot be re-encrypted.
If your server supports encrypted connections, perform these steps to change the password storage scheme:
  1. Generate a new password hash that uses the new storage scheme. For example: 
    # pwdhash -s PBKDF2_SHA256 password
{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty...
    Copy to Clipboard Toggle word wrap
  2. Set the nsslapd-rootpwstoragescheme attribute to the storage scheme and the nsslapd-rootpw attribute to the value displayed in the previous step using a secure connection (STARTTLS): 
    # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-rootpwstoragescheme=PBKDF2_SHA256 nsslapd-rootpw="{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty..."
    Copy to Clipboard Toggle word wrap
Perform these steps to change the password using the web console:
  1. Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
  2. Select the instance.
  3. Open the Server Settings menu, and select Server Settings.
  4. Open the Directory Manager tab.
  5. Set the password storage scheme.
  6. Directory Server cannot re-encrypt the current password using the new storage scheme. Therefore, enter a new password into the Directory Manager Password and Confirm Password field.
  7. Click Save Configuration.

20.7.4. Changing the Directory Manager DN
Link kopieren

As the administrator, perform the following step to change the Directory Manager DN to cn=New Directory Manager: 
# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-rootdn="cn=New Directory Manager"
Copy to Clipboard Toggle word wrap
Note that Directory Server supports only changing the Directory Manager DNs using the command line.
Nach oben
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2025 Red Hat