I am setting up a new IPA instance to provide DNS and CA services in a team lab. I have to decide what to use for the Directory Manager password — our standard, not very secure root password or something else, which no one will ever remember.

Any thoughts? Is it still a major project to change the DM password? How hard is it to recover/reset it these days?

(This will be IPA 4.6 on RHEL 7.)

Thanks!