ADAC Solutions, LLC

Here is an OpenLDAP quick tip to change the RootDN password via ldapmodify. This tip should work for most systems, but we used Ubuntu 10.04 and this guide for installing OpenLDAP.

The first thing you want to do is determine the DN (Distinguished Name) for the database that contains the RootDN password.  To do this we used the following LDAP search command.

sudo ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b  cn=config olcRootDN=cn=admin,dc=adac-solutions,dc=net dn olcRootDN olcRootPW

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
<strong>dn: olcDatabase={1}hdb,cn=config</strong>
olcRootDN: cn=admin,dc=adac-solutions,dc=net
olcRootPW: {MD5}G7ANWX3yX2TWqZo6iaTK6w==

We’ve highlighted the DN for our LDAP database above as it will be needed for the ldapmodify command. Before we run our ldapmodify command we’re going to use slappasswd to setup an encrypted password.  We choose MD5 for our password encryption.  Use the following command to generate a MD5 password to be used in OpenLDAP.

slappasswd -h {MD5}
New password:
Re-enter new password:
{MD5}BNrIr+DKUBWHutZva1zlrQ==

We’ve highlighted the MD5 password you will need to paste into ldapmodify.  The final step is to use ldapmodify to update the password.

sudo ldapmodify -Y EXTERNAL -H ldapi:///
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: olcDatabase={1}hdb,cn=config
replace: olcRootPW
olcRootPW: {MD5}BNrIr+DKUBWHutZva1zlrQ==

modifying entry "olcDatabase={1}hdb,cn=config"

The three lines above in bold must be typed by use.  As you can see we used the DN we looked up earlier, dn: olcDatabase={1}hdb,cn=config, this tells ldapmodify with object we plan to modify.  Next we enter replace: olcRootPW, this tells ldapmodify that we intend to replace the current value of olcRootPW attribute of object olcDatabase={1}hdb,cn=config.  Finally we update the value of olcRootPW with our password generated by slappasswd.