Red Hat DIRECTORY SERVER 8.0, Administration Manual

Page: 236 / 552

Chapter 7. Managing User Accounts and Passwords
218
Server does not include a client application for the password change extended operation. However,
the
ldappasswd
utility can be used as follows:
ldappasswd -h hostname -p secure_port -Z -P /path/to/ cert8.db -D bindDN -w bindPassword
[-a oldPassword ] -s newPassworduser
Parameter Description
-h Gives the hostname of the Directory Server.
-p Gives the port number of the Directory Server.
Since SSL is required for password change
operations, this is usually give the TLS/SSL port
of the Directory Server. With the
-ZZ
or
-ZZZ
for
Start TLS, this can be the standard port.
-Z Requires SSL for the connection. A secure
connection is required for the password change
operation.
NOTE
ldappasswd
also supports Start
TLS encryption (
-ZZ[Z]
).
-P Gives the full path to the certificate database
which contains the CA certificate of the CA that
issued the Directory Server client certificate.
If the
ldappasswd
command is run on the
same machine that the Directory Server is
installed on, this can be
/etc/dirsrv/
slapd- instance_name /cert8.db
. If this is
not given, the default is the current directory.
-D Gives the bind DN.
-w Gives the password for the bind DN.
-a
Optional.
Gives the old password, which is being
changed.
-s Sets the new password.
Table 7.2. ldappasswd Options
To use Start TLS, which runs the command on a non-secure port, run
ldappasswd
with the
-ZZ
option and the standard LDAP port number. The password extended change operation has the
following format:
ldappasswd -h hostname -p standard_port -ZZ -P /path/to/ cert8.db -D bindDN -w bindPassword
-s newPassworduser [-a oldPassword ]
Use the
-ZZZ
for additional certificate hostname validation.
To modify an entry's password, run
ldappasswd
like any other LDAP operation. It is not necessary to
specify a
user
if the account is the same as that given in the bind DN. For example: