Changing System Passwords; Password-Quality Checker - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

d. Copy the file into the /etc/init.d/ directory.
cp /tmp/pki-tps-old /etc/init.d
e. Set the proper file owner and permissions for the file.
chown pkiuser: /etc/init.d/pki-tps-old
chmod 770 /etc/init.d/pki-tps-old
f. Remove the temporary file.
rm -rf /tmp/pki-tps-old
g. Use pkiremove to remove the temporary TPS instance.
8. Note the contents of the password.conf file, and then delete it.
rm -rf /var/lib/subsystem_name/conf/password.conf

12.3.4. Changing System Passwords

Subsystem passwords are used by the subsystem instance to connect to a necessary service, like its
internal database. These passwords are set in the service, so for them to change, they are changed
on the external service. Then, any password changes need to be carried back to the Certificate
System subsystem configuration.
The way that subsystem passwords can be changed depends on the type of password:
• The internal password can be changed using the certutil command to update the NSS
security database or in the subsystem's administrative interface, such as the console.
• LDAP-related passwords, such as internaldb and tokendbpass for the internal database,
can be changed in the LDAP server directly (using the Directory Server console or tools like
ldapmodify).
• LDAP publishing passwords are changed in the LDAP server, but that change mmeans that the
password must be updated in the Certificate System CA configuration. The publishing password is
reset in the CA console; this automatically updates the password.conf file, if it exists.
• Hardware token passwords can be changed on the hardware token itself, using its native tools.
The passwords must then be manually updated in the password.conf file or in the subsystem
console. If the password file has been removed, then the new passwords can simply be entered when
prompted at server startup.

12.3.5. Password-Quality Checker

A Certificate System plug-in, password-quality checker, monitors the quality of passwords set within
the Certificate System. All passwords used in the Certificate System are checked by the password-
quality checker, which by default checks that the length of a password is at least 8 characters long.
There are no checks regarding which characters are valid or invalid. Trying to set passwords that do
not meet the quality rules returns an error message.
Changing System Passwords
293