Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

20.7. Managing the Directory Manager Password

The Directory Manager is the privileged database administrator, comparable to the root user in Linux. The Directory Manager entry and the corresponding password are set during the instance installation.
The default distinguished name (DN) of the Directory Manager is cn=Directory Manager.

20.7.1. Resetting the Directory Manager Password
Copiar enlace

If you lose the Directory Manager password, reset it:
  1. Stop the Directory Server instance: 
    # dsctl instance_name stop
    Copy to Clipboard Toggle word wrap
  2. Generate a new password hash. For example: 
    # pwdhash -D /etc/dirsrv/slapd-instance_name password
{PBKDF2_SHA256}AAAgABU0bKhyjY53NcxY33ueoPjOUWtl4iyYN5uW...
    Copy to Clipboard Toggle word wrap
    Specifying the path to the Directory Server configuration automatically uses the password storage scheme set in the nsslapd-rootpwstoragescheme attribute to encrypt the new password.
  3. Edit the /etc/dirsrv/slapd-instance_name/dse.ldif file and set the nsslapd-rootpw attribute to the value displayed in the previous step: 
    nsslapd-rootpw: {PBKDF2_SHA256}AAAgABU0bKhyjY53NcxY33ueoPjOUWtl4iyYN5uW...
    Copy to Clipboard Toggle word wrap
  4. Start the Directory Server instance: 
    # dsctl instance_name start
    Copy to Clipboard Toggle word wrap

20.7.2. Changing the Directory Manager Password
Copiar enlace

This section describes how to can change the password of the Directory Manager account.
Use one of the following options to set the new password:

Important

Only set the password using an encrypted connection. Using an unencrypted connection can expose the password to the network. If your server does not support encrypted connections, use the web console to update the Directory Manager password. See Section 20.7.2.2, “Changing the Directory Manager Password Using the Web Console”.
  • To set the nsslapd-rootpw parameter to a plain text value which Directory Server automatically encrypts: 
    # dsconf -D "cn=Directory Manager" ldaps://server.example.com config replace nsslapd-rootpw=password
    Copy to Clipboard Toggle word wrap

    Warning

    Do not use curly braces ({}) in the password. Directory Server stores the password in the {password-storage-scheme}hashed_password format. The server interprets characters in curly braces as the password storage scheme. If the string is an invalid storage scheme or if the password is not correctly hashed, the Directory Manager cannot connect to the server.
  • To manually encrypt the password and setting it in the nsslapd-rootpw parameter:
    1. Generate a new password hash. For example: 
      # pwdhash -D /etc/dirsrv/slapd-instance_name password
{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty...
      Copy to Clipboard Toggle word wrap
      Specifying the path to the Directory Server configuration automatically uses the password storage scheme set in the nsslapd-rootpwstoragescheme attribute to encrypt the new password.
    2. Set the nsslapd-rootpw attribute to the value displayed in the previous step using a secure connection (STARTTLS): 
      # dsconf -D "cn=Directory Manager" ldaps://server.example.com config replace nsslapd-rootpw="{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty..."
      Copy to Clipboard Toggle word wrap
As the administrator, perform these steps to change the password:
  1. Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
  2. Select the instance.
  3. Open the Server Settings menu, and select Server Settings.
  4. Open the Directory Manager tab.
  5. Enter the new password into the Directory Manager Password and Confirm Password fields
  6. Optionally, set a different password storage scheme.
  7. Click Save.

20.7.3. Changing the Directory Manager Password Storage Scheme
Copiar enlace

The password storage scheme specifies which algorithm Directory Server uses to hash a password. To change the storage scheme using the command line, your server must support encrypted connections. If your server does not support encrypted connections, use the web console to set the storage scheme. See Section 20.7.3.2, “Changing the Directory Manager Password Storage Scheme Using the Web Console”.
Note that the storage scheme of the Directory Manager (nsslapd-rootpwstoragescheme) can be different than the scheme used to encrypt user passwords (nsslapd-pwstoragescheme).
For a list of supported password storage schemes, see the corresponding section in the Red Hat Directory Server Configuration, Command, and File Reference.

Note

If you change the Directory Manager's password storage scheme you must also reset its password. Existing passwords cannot be re-encrypted.
If your server supports encrypted connections, perform these steps to change the password storage scheme:
  1. Generate a new password hash that uses the new storage scheme. For example: 
    # pwdhash -s PBKDF2_SHA256 password
{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty...
    Copy to Clipboard Toggle word wrap
  2. Set the nsslapd-rootpwstoragescheme attribute to the storage scheme and the nsslapd-rootpw attribute to the value displayed in the previous step using a secure connection (STARTTLS): 
    # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-rootpwstoragescheme=PBKDF2_SHA256 nsslapd-rootpw="{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty..."
    Copy to Clipboard Toggle word wrap
Perform these steps to change the password using the web console:
  1. Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
  2. Select the instance.
  3. Open the Server Settings menu, and select Server Settings.
  4. Open the Directory Manager tab.
  5. Set the password storage scheme.
  6. Directory Server cannot re-encrypt the current password using the new storage scheme. Therefore, enter a new password into the Directory Manager Password and Confirm Password field.
  7. Click Save Configuration.

20.7.4. Changing the Directory Manager DN
Copiar enlace

As the administrator, perform the following step to change the Directory Manager DN to cn=New Directory Manager: 
# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-rootdn="cn=New Directory Manager"
Copy to Clipboard Toggle word wrap
Note that Directory Server supports only changing the Directory Manager DNs using the command line.
Volver arriba
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2025 Red Hat