> This page is for version 11 (default).
> For other versions, use one of these documentation indexes:
> - 11 (default): https://docs.nvidia.com/base-command-manager/product-manuals/11/llms.txt
> - 10: https://docs.nvidia.com/base-command-manager/product-manuals/10/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/base-command-manager/product-manuals/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/base-command-manager/product-manuals/_mcp/server.

# Changing The LDAP Password

The administrator may wish to change the LDAP root password. This procedure has two steps:

* setting a new password for the LDAP server (section [I.1](#i1-setting-a-new-password-for-the-ldap-server)), and

* setting the new password in `cmd.conf` (section [I.2](#i2-setting-the-new-password-in-cmdconf)).

It is also a good idea to do some checking afterwards (section [I.3](#i3-checking-ldap-access)).

## I.1  Setting A New Password For The LDAP Server

An encrypted password string can be generated as follows:

```bash
[root@basecm11 ~]# module load openldap
[root@basecm11 ~]# slappasswd
New password:
Re-enter new password:
SSHAJ/3wyO+IqyAwhh8Q4obL8489CWJlHpLg
```

The input is the plain text password, and the output is the encrypted password. The encrypted password is set as a value for the `rootpw` tag in the `slapd.conf` file on the head node:

```bash
[root@basecm11 ~]# grep ^rootpw /cm/local/apps/openldap/etc/slapd.conf
rootpw SSHAJ/3wyO+IqyAwhh8Q4obL8489CWJlHpLg
```

The password can also be saved in plain text instead of as an SSHA hash generated with `slappasswd`, but this is considered insecure.

After setting the value for `rootpw`, the LDAP server is restarted:

```bash
[root@basecm11 ~]# systemctl restart slapd
```

## I.2  Setting The New Password In `cmd.conf`

The new LDAP password (the plain text password that generated the encrypted password after entering the `slappasswd` command in section [I.1](#i1-setting-a-new-password-for-the-ldap-server)) is set in `cmd.conf`. It is kept as clear text for the entry for the LDAPPass directive (Appendix [C.26](/admin/cmdconf#c26-ldappass-directive)):

```bash
[root@basecm11 ~]# grep LDAPPass /cm/local/apps/cmd/etc/cmd.conf
LDAPPass = "Mysecret1dappassw0rd"
```

CMDaemon is then restarted:

```bash
[root@basecm11 ~]# systemctl restart cmd
```

## I.3  Checking LDAP Access

For a default configuration with user `cmsupport` and domain `cm.cluster`, the following checks can be run from the head node (some output truncated):

* anonymous access:

  ```bash
  [root@basecm11 ~]# ldapsearch -x
  # extended LDIF
  #
  # LDAPv3
  # base <dc=cm,dc=cluster> (default) with scope subtree
  ...
  ```

* root cn without a password (this should fail):

  ```bash
  [root@basecm11 ~]# ldapsearch -x -D 'cn=root,dc=cm,dc=cluster'
  ldap_bind: Server is unwilling to perform (53)
   additional info: unauthenticated bind (DN with no password) disallowed
  [root@basecm11 ~]#
  ```

* root cn with a password (this should work):

  ```bash
  [root@basecm11 ~]# ldapsearch -x -D 'cn=root,dc=cm,dc=cluster' -W
  Enter LDAP Password: (the password entered earlier, Mysecret1dappassw0rd, is used)
  # extended LDIF
  #
  # LDAPv3
  # base <dc=cm,dc=cluster> (default) with scope subtree
  ...
  ```