Red Hat DIRECTORY SERVER 8.0 - ADMINISTRATION Administration Manual page 236

Chapter 7. Managing User Accounts and Passwords
Server does not include a client application for the password change extended operation. However,
the ldappasswd utility can be used as follows:
ldappasswd -h hostname -p secure_port -Z -P /path/to/cert8.db -D bindDN -w bindPassword
[-a oldPassword] -s newPassworduser
Parameter
-h
-p
-Z
-P
-D
-w
-a
-s
Table 7.2. ldappasswd Options
To use Start TLS, which runs the command on a non-secure port, run ldappasswd with the -ZZ
option and the standard LDAP port number. The password extended change operation has the
following format:
ldappasswd -h hostname -p standard_port -ZZ -P /path/to/cert8.db -D bindDN -w bindPassword
-s newPassworduser [-a oldPassword]
Use the -ZZZ for additional certificate hostname validation.
To modify an entry's password, run ldappasswd like any other LDAP operation. It is not necessary to
specify a user if the account is the same as that given in the bind DN. For example:
218
Description
Gives the hostname of the Directory Server.
Gives the port number of the Directory Server.
Since SSL is required for password change
operations, this is usually give the TLS/SSL port
of the Directory Server. With the -ZZ or -ZZZ for
Start TLS, this can be the standard port.
Requires SSL for the connection. A secure
connection is required for the password change
operation.
NOTE
ldappasswd also supports Start
TLS encryption (-ZZ[Z]).
Gives the full path to the certificate database
which contains the CA certificate of the CA that
issued the Directory Server client certificate.
If the ldappasswd command is run on the
same machine that the Directory Server is
installed on, this can be /etc/dirsrv/
slapd-instance_name/cert8.db. If this is
not given, the default is the current directory.
Gives the bind DN.
Gives the password for the bind DN.
Optional. Gives the old password, which is being
changed.
Sets the new password.