20.7. Managing the Directory Manager Password The Directory Manager is the privileged database administrator, comparable to the root user in Linux. The Directory Manager entry and the corresponding password are set during the instance installation. The default distinguished name (DN) of the Directory Manager is cn=Directory Manager . 20.7.1. Resetting the Directory Manager Password If you lose the Directory Manager password, reset it: Stop the Directory Server instance: Generate a new password hash. For example: Specifying the path to the Directory Server configuration automatically uses the password storage scheme set in the nsslapd-rootpwstoragescheme attribute to encrypt the new password. Edit the /etc/dirsrv/slapd- instance_name /dse.ldif file and set the nsslapd-rootpw attribute to the value displayed in the step: Start the Directory Server instance: 20.7.2. Changing the Directory Manager Password This section describes how to can change the password of the Directory Manager account. 20.7.2.1. Changing the Directory Manager Password Using the Command Line Use one of the following options to set the new password: Important Only set the password using an encrypted connection. Using an unencrypted connection can expose the password to the network. If your server does not support encrypted connections, use the web console to update the Directory Manager password. See Section 20.7.2.2, "Changing the Directory Manager Password Using the Web Console" . To set the nsslapd-rootpw parameter to a plain text value which Directory Server automatically encrypts: Warning Do not use curly braces ( {} ) in the password. Directory Server stores the password in the {password-storage-scheme}hashed_password format. The server interprets characters in curly braces as the password storage scheme. If the string is an invalid storage scheme or if the password is not correctly hashed, the Directory Manager cannot connect to the server. To manually encrypt the password and setting it in the nsslapd-rootpw parameter: Generate a new password hash. For example: Specifying the path to the Directory Server configuration automatically uses the password storage scheme set in the nsslapd-rootpwstoragescheme attribute to encrypt the new password. Set the nsslapd-rootpw attribute to the value displayed in the step using a secure connection (STARTTLS): 20.7.2.2. Changing the Directory Manager Password Using the Web Console As the administrator, perform these steps to change the password: Open the Directory Server user interface in the web console. See Section 1.4, "Logging Into Directory Server Using the Web Console" . Select the instance. Open the Server Settings menu, and select Server Settings . Open the Directory Manager tab. Enter the new password into the Directory Manager Password and Confirm Password fields Optionally, set a different password storage scheme. Click Save . 20.7.3. Changing the Directory Manager Password Storage Scheme The password storage scheme specifies which algorithm Directory Server uses to hash a password. To change the storage scheme using the command line, your server must support encrypted connections. If your server does not support encrypted connections, use the web console to set the storage scheme. See Section 20.7.3.2, "Changing the Directory Manager Password Storage Scheme Using the Web Console" . Note that the storage scheme of the Directory Manager ( nsslapd-rootpwstoragescheme ) can be different than the scheme used to encrypt user passwords ( nsslapd-pwstoragescheme ). For a list of supported password storage schemes, see the corresponding section in the Red Hat Directory Server Configuration, Command, and File Reference . Note If you change the Directory Manager's password storage scheme you must also reset its password. Existing passwords cannot be re-encrypted. 20.7.3.1. Changing the Directory Manager Password Storage Scheme Using the Command Line If your server supports encrypted connections, perform these steps to change the password storage scheme: Generate a new password hash that uses the new storage scheme. For example: Set the nsslapd-rootpwstoragescheme attribute to the storage scheme and the nsslapd-rootpw attribute to the value displayed in the step using a secure connection (STARTTLS): 20.7.3.2. Changing the Directory Manager Password Storage Scheme Using the Web Console Perform these steps to change the password using the web console: Open the Directory Server user interface in the web console. See Section 1.4, "Logging Into Directory Server Using the Web Console" . Select the instance. Open the Server Settings menu, and select Server Settings . Open the Directory Manager tab. Set the password storage scheme. Directory Server cannot re-encrypt the current password using the new storage scheme. Therefore, enter a new password into the Directory Manager Password and Confirm Password field. Click Save Configuration . 20.7.4. Changing the Directory Manager DN As the administrator, perform the following step to change the Directory Manager DN to cn=New Directory Manager : Note that Directory Server supports only changing the Directory Manager DNs using the command line.

Commands:
dsctl instance_name stop
pwdhash -D /etc/dirsrv/slapd- instance_name password {PBKDF2_SHA256}AAAgABU0bKhyjY53NcxY33ueoPjOUWtl4iyYN5uW
nsslapd-rootpw: {PBKDF2_SHA256}AAAgABU0bKhyjY53NcxY33ueoPjOUWtl4iyYN5uW
dsctl instance_name start
dsconf -D "cn=Directory Manager" ldaps://server.example.com config replace nsslapd-rootpw= password
pwdhash -D /etc/dirsrv/slapd- instance_name password {PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty
dsconf -D "cn=Directory Manager" ldaps://server.example.com config replace nsslapd-rootpw=" {PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty... "
pwdhash -s PBKDF2_SHA256 password {PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty
dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-rootpwstoragescheme= PBKDF2_SHA256 nsslapd-rootpw=" {PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty... "
dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-rootdn=" cn=New Directory Manager "