Ian Pilcher via FreeIPA-users wrote:
I am setting up a new IPA instance to provide DNS and CA services in
a
team lab. I have to decide what to use for the Directory Manager
password — our standard, not very secure root password or something
else, which no one will ever remember.
Any thoughts? Is it still a major project to change the DM password? How
hard is it to recover/reset it these days?
(This will be IPA 4.6 on RHEL 7.)
It isn't a huge deal to change the DM password but in practice you'd
want to do it on all masters (not replicated) so while not the end of
the world it can be at best annoying.
Though with root DM can be reset so with having a crappy root password
in effect it doesn't matter what DM is (e.g. someone could already have
the keys to the Kingdom).
I'd set both to something(s) you can remember. When you need it the last
thing you'll want to do is run around resetting it.
rob