Security Center:Reinforce password security

1. Log on to your Windows server. In the lower-left corner of the Windows desktop, click the icon.
2. Click the icon.
3. In the Windows Settings window, click Accounts.
4. In the left-side navigation pane, click Sign-in options.
5. Change the logon password of the server as prompted.

1. Log on to your MySQL database.
2. Run the following command to view the password information about database users:

   SELECT user, host, authentication_string FROM user;

   Note The command may not be supported by some versions of MySQL databases. If you cannot obtain the password information after you run the command, you can run the following command:

   SELECT user, host, password FROM user; 

3. Run the following command to change the password of a specific user based on the query results and the alert information about weak passwords:

   SET PASSWORD FOR '<UserName>'@'<HostName>' = PASSWORD('<NewPassword>'); 

4. Run the flush privileges; command.

1. Log on to your Redis database and open the redis.conf file.
2. Run the following command to change the current password or configure a password:

   requirepass <NewPassword>;

3. Restart the Redis service.

• Linux operating system
  Log on to your SQL Server database and run the following command to change the logon password:

   exec sp_password <OldPassWord>,<NewPassword>,<UserName>

• Windows operating system

  Log on to your SQL Server database client, choose Security > Logins, find the required username, and then change the weak password to a complex password.

1. Log on to your MongoDB database.
2. Run the use admin command to switch to user admin.
3. Run the use db_name command to switch to the database for which you want to change the logon password.
4. Run the db.updateUser(<UserName>,{pwd:<NewPassword}>) command to change the logon username and password for the database.

   We recommend that you configure a complex password that is greater than 12 characters in length and contains digits, uppercase letters, lowercase letters, and special characters.

5. Enable the identity authentication feature.

   Open the mongod.conf file of the MongoDB database, change the value of auth to true, and then restart the MongoDB service.

• db_name specifies the name of the database for which you want to change the logon password.
• After you change the password, wait 5 minutes before you check whether the new password is a weak password.

1. Log on to your PostgreSQL database.
2. Run the following command to change the weak password:

   ALTER USER <UserName> WITH PASSWORD <NewPassword>;

1. Go to the root directory of your Tomcat server and open the conf/tomcat-user.xml file.
2. Change the password attribute value of the user node to a complex password.

1. Open the rsyncd.conf file of your rsync server.
2. Find the secrets file configuration item and obtain the path to the rsyncd.secret file in the configuration item.
3. Edit the rsyncd.secret file in the username:password format and change the password of a specific user to a complex password.
4. Restart the rsync service.

1. Open the directory of the Subversion (SVN) repository.
2. Find password-db in the <path>/conf/svnserve.conf file.
3. Obtain the path to the password configuration file based on password-db and change the password in the password configuration file to a specified password. By default, the password configuration file is named passwd.
4. Restart the SVN service.

• Local user
  1. Open the vsftpd.conf file.
  2. Add the anonymous_enable configuration item and specify NO for the configuration item. Alternatively, change the value of the configuration item to NO.

     The value NO indicates that anonymous logons are not allowed.

  3. Run the passwd <UserName> command to change the password of the user who uses the FTP service.
  4. Configure a complex password that meets the requirements as prompted.
• Virtual user
  1. Open the /etc/vsftpd/login.txt file.
  2. Change the passwords of users and save the new passwords.

     In the file, line 1 contains the username of user A, line 2 contains the password of user A, line 3 contains the username of user B, line 4 contains the password of user B, and so on.

  3. Run the db_load -T -t hash -f /etc/vsftpd/login.txt /etc/vsftpd/login.db command.
  4. Edit the /etc/pam.d/vsftpd file.
     Append the db=/etc/vsftpd/login parameter to the lines that contain auth pam_userdb.so and account pam_userdb.so. Then, save the modification. The following figure shows an example.
  5. Restart the vsftpd service.

1. Log on to your Linux server as the root user.
2. Run the following command:

   passwd ftp <UserName>

3. Enter a new password as prompted.

   If the all authentication tokens updated successfully message appears, the password is changed.

1. Log on to your InfluxDB database.
2. Run the following command to change the password of the account that is used to log on to the database:

   set password for "<UserName>" = "<NewPassword>" 

• JBoss 6
  1. Find the /conf/props/jmx-console-users.properties file and change the password in the file. The new password must be in the <UserName> =<Password> format.
  2. Restart the JBoss6 service.
     1. Run the ps -ef|grep jboss command to view the current process of JBoss6.
     2. Run the kill -9 process ID command to terminate the process.
     3. Run the following command to start the JBoss service:

         jboss6_path/bin/run.sh

• JBoss 7
  1. Find the /configuration/mgmt-users.properties file and delete the usernames whose passwords are weak.
  2. Run the bin/adduser.sh script in the installation directory of JBoss. Then, add new users for which you configure complex passwords as prompted.

1. Log on to the Jenkins console.
2. Click Configure to go to the Configure page.
3. Enter a new password in the Password field.

1. Run the following command to query the value and position of the password of the OpenLDAP administrator:

   ldapsearch -H ldapi:// -LLL -Q -Y EXTERNAL -b "cn=config" "(olcRootDN=*)" dn olcRootDN olcRootPW

2. Run the following command to generate a password:

    slappasswd -s <NewPassword>

   After you run the command, the hash value of the new password is returned.

3. Create a file named newpassword.ldif and add the following content to the file:

   dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: NewHash

   The content of the line that contains dn is the value of dn returned by the command that is run in Step 1, and the value of NewHash is the hash value of the new password.

4. Run the following command to import the created .ldif file:

   ldapmodify -H ldapi:// -Y EXTERNAL -f newpasswd.ldif 

1. Find the pwd-file file. In most cases, the file is saved in the /etc/openvpn directory.
2. Append the following statement to the file to cancel the client certificate authentication:

   client-cert-not-required

3. Append the following statement to the file to enable the user password script:

   auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env

4. Append the following statement to the file to block the alerts that are generated by the system:

   script-security  system

5. Edit the /etc/openvpn/psw-file file. Each row represents an account. Separate a username and its password with spaces. Examples:

   cat /etc/openvpn/psw-file 
   abcdocker <NewPassWord>
   abc <NewPassWord>
   test <NewPassWord>

6. Run the following command to obtain the checkpsw.sh script:

   wget http://openvpn.se/files/other/checkpsw.sh

   Note By default, the checkpsw.sh script reads usernames and passwords from the /etc/openvpn/psw-file file.

1. Log on to your Oracle database.
2. Run the following command to change the password:

   alter user <UserName> identified by <NewPassWord>;

1. Edit the /etc/ppp/chap-secrets file.
2. Specify the username and password in the <UserName> pptpd <NewPassword> format.

   Separate UserName, pptpd, and NewPassword with tabs.

3. Restart the pptpd service.

ftpasswd --passwd --name=<UserName> --change-password --file=File_Path

rabbitmqctl change_password <UserName> '<NewPassword>'

1. Disable VNC Server and go to the installation directory of VNC Server on the server where VNC Server is installed.

   If the weak password does not belong to the root user, log on or switch to the user to which the weak password belongs after you go to the installation directory. For example, if the user whose password you want to change is aliuser, run the su - aliuser command.

2. Delete the passwd file from the installation directory. Example: /home/aliuser/.vnc/passwd.
3. Run the vncpasswd command to reset the password.
   Important For a VNC Server password, the system checks only the first eight characters of the password. For example, if you set the new password to Aliyunpasswd, only the first eight characters Aliyunpa take effect. If the new password does not meet the complexity requirements, the new password has a high risk of being cracked. Make sure that the new password meets the complexity requirements.

1. Log on to the WebLogic console.
2. In the left-side navigation pane, choose Security Realms > Realms > Users and Groups > Users.
3. Select the user whose password you want to change.
4. On the Passwords tab, enter and confirm the new password, and click Save.
5. If Activate Changes is displayed in the Change Center section in the upper-left corner of the WebLogic console, click Activate Changes.
6. Log on to your server and change the value of the password field for the selected user in the '%DOMAIN_HOME%/servers/AdminServer/security/boot.properties file.

   The new password must be the same as the password that you enter in the WebLogic console. After you change the password, AES encryption is automatically enabled.

7. Run the %DOMAIN_HOME%/bin/stopWeblogic.sh script to securely stop WebLogic. Then, restart WebLogic.

1. Go to the activemq_/pathconf/ directory and find the configuration file.
2. Run the vim jetty-realm.properties command to edit the file.
3. Add or modify a user. Change the username and password to a value in the <UserName>: <NewPassword>,RoleName format. Example: admin: passwd123! @#, admin.
4. After the modification is complete, save the modification and exit. Then, restart the ActiveMQ service.

1. Run the smbpasswd <UserName> command to change the password of a user.
2. Enter a new password as prompted.

1. Log on to the Zabbix web interface by using the administrator account.
2. In the top navigation bar, choose Administration > Users to view users.
3. Click the username whose password you want to change and click Change password.
4. Enter a new password and click Update.