Skip to navigation

Changing The LDAP Password

View as Markdown

The administrator may wish to change the LDAP root password. This procedure has two steps:

  • setting a new password for the LDAP server (section I.1), and

  • setting the new password in cmd.conf (section I.2).

It is also a good idea to do some checking afterwards (section I.3).

I.1 Setting A New Password For The LDAP Server

An encrypted password string can be generated as follows:

[root@basecm10 ~]# module load openldap
[root@basecm10 ~]# slappasswd
New password:
Re-enter new password:
SSHAJ/3wyO+IqyAwhh8Q4obL8489CWJlHpLg

The input is the plain text password, and the output is the encrypted password. The encrypted password is set as a value for the rootpw tag in the slapd.conf file on the head node:

[root@basecm10 ~]# grep ^rootpw /cm/local/apps/openldap/etc/slapd.conf
rootpw SSHAJ/3wyO+IqyAwhh8Q4obL8489CWJlHpLg

The password can also be saved in plain text instead of as an SSHA hash generated with slappasswd, but this is considered insecure.

After setting the value for rootpw, the LDAP server is restarted:

[root@basecm10 ~]# systemctl restart slapd

I.2 Setting The New Password In cmd.conf

The new LDAP password (the plain text password that generated the encrypted password after entering the slappasswd command in section I.1) is set in cmd.conf. It is kept as clear text for the entry for the LDAPPass directive (Appendix C.26):

[root@basecm10 ~]# grep LDAPPass /cm/local/apps/cmd/etc/cmd.conf
LDAPPass = "Mysecret1dappassw0rd"

CMDaemon is then restarted:

[root@basecm10 ~]# systemctl restart cmd

I.3 Checking LDAP Access

For a default configuration with user cmsupport and domain cm.cluster, the following checks can be run from the head node (some output truncated):

  • anonymous access:

    [root@basecm10 ~]# ldapsearch -x
    # extended LDIF
    #
    # LDAPv3
    # base <dc=cm,dc=cluster> (default) with scope subtree
    ...

  • root cn without a password (this should fail):

    [root@basecm10 ~]# ldapsearch -x -D 'cn=root,dc=cm,dc=cluster'
    ldap_bind: Server is unwilling to perform (53)
     additional info: unauthenticated bind (DN with no password) disallowed
    [root@basecm10 ~]#

  • root cn with a password (this should work):

    [root@basecm10 ~]# ldapsearch -x -D 'cn=root,dc=cm,dc=cluster' -W
    Enter LDAP Password: (the password entered earlier, Mysecret1dappassw0rd, is used)
    # extended LDIF
    #
    # LDAPv3
    # base <dc=cm,dc=cluster> (default) with scope subtree
    ...