Weak password security best practices

System name

Steps to change the logon password

Linux

On a Linux server, run the passwd <UserName> command to change a user's logon password. After you run the command, enter the new password as prompted.

If you do not specify <UserName>, the password for the current user is changed.

Windows

This section uses Windows Server 2019 as an example to show how to change a user's logon password.

1. Log on to the Windows server and click the icon in the lower-left corner.

2. Click the icon. On the Windows Settings page, click Accounts.

3. In the navigation pane on the left, click Sign-in options.

4. Change the server password as prompted on the page.

MySQL database

1. Log on to the MySQL database.

2. Run the following command to view user password information in the database.

   SELECT user, host, authentication_string FROM user;

   Note

   Some MySQL database versions may not support the preceding command. If you run the command and do not get user password information, run the following command instead.

   SELECT user, host, password FROM user; 

3. Run the following command to change the password for a specific user based on the query results and the weak password alert.

   SET PASSWORD FOR '<UserName>'@'<HostName>' = PASSWORD('<NewPassword>'); 

4. Run the refresh command: flush privileges;.

Redis database

1. Open the Redis database configuration file, redis.conf.

2. Run the following command to change or add a password.

   requirepass <NewPassword>;

   If a logon password already exists, this command changes it. If no logon password exists, this command adds a new one.

3. Restart the Redis service.

SQL Server database

• Linux system logon

  Log on to the SQL Server database and run the following command to change the logon password.

   exec sp_password <OldPassWord>,<NewPassword>,<UserName>

• Windows authentication logon

  In the SQL Server database client, choose Security > Logins, select the user, and change the weak password to a complex password.

MongoDB database

1. Log on to the MongoDB database.

2. Run the use admin command to switch to the admin user.

3. Run the db.changeUserPassword("<UserName>", "<NewPassword>") command to change the database logon name and password.

   Set a strong password that is more than 12 characters long and includes digits, uppercase letters, lowercase letters, and special characters.

4. Ensure that the identity authentication feature is enabled.

   In the MongoDB configuration file mongod.conf, set security.authorization to enabled or set the auth configuration item to true.

5. Run the systemctl restart mongod command to restart the MongoDB service.

PostgreSQL database

1. Log on to the PostgreSQL database.

2. Run the following command to change the weak password.

   ALTER USER <UserName> WITH PASSWORD <NewPassword>;

Tomcat

1. Open the configuration file conf/tomcat-user.xml in the Tomcat root directory.

2. Change the value of the password property for the user node to a complex password.

Rsync

1. Open the Rsync configuration file, rsyncd.conf.

2. Find the secrets file configuration item and locate the path of the rsyncd.secret file within it.

3. Edit the rsyncd.secret file in the <UserName>:<NewPassword> format to change the password for the corresponding user to a new, complex password.

4. Restart the Rsync service.

SVN

1. Open the repository directory.

2. In the configuration file <path>/conf/svnserve.conf, find password-db.

3. Use the password-db configuration to find the password file path, and then change the password in that file to the specified password. The default file is `passwd`.

4. Restart the SVN service.

vsftpd server software

• Local user

  1. Open the configuration file vsftpd.conf.

  2. Add or change the value of the anonymous_enable configuration item to NO to disable anonymous logon.

  3. Run the passwd <UserName> command to change the FTP user's password.

  4. Follow the prompts to set a new, complex password that meets the requirements.

• Virtual user

  1. Open the file /etc/vsftpd/login.txt.

  2. Change the password for the corresponding username and save the file.

     The file format is as follows: the first line is User A's username, the second line is User A's password, the third line is User B's username, the fourth line is User B's password, and so on.

  3. Run the db_load -T -t hash -f /etc/vsftpd/login.txt /etc/vsftpd/login.db command.

  4. Modify the /etc/pam.d/vsftpd file.

     Add the statement db=/etc/vsftpd/login after the lines that contain auth pam_userdb.so and account pam_userdb.so. Save the file after the changes. The following figure shows the location.

  5. Restart vsftpd.

FTP

1. Log on to the target Linux server as the root user.

2. Run the following command.

   passwd ftp <UserName>

3. Enter the new password as prompted.

   After the password is changed successfully, the message all authentication tokens updated successfully appears.

InfluxDB database

1. Log on to the InfluxDB database.

2. Run the following command to change the database password.

   Replace NewPassword with the new password. The new password must be enclosed in single-byte single quotation marks.

   set password for "<UserName>" = "<NewPassword>" 

JBoss 6 and 7

• JBoss 6:

  1. Edit the configuration file /conf/props/jmx-console-users.properties and change the weak password. The format after modification is <UserName> =<Password>.

  2. Restart JBoss 6.

     1. Run ps -ef|grep jboss to view the current JBoss 6 process.

     2. Run kill -9 <ProcessID> to stop the process.

        Replace <ProcessID> with the process ID of JBoss 6.

     3. Run the following command to start the JBoss service.

        Replace jboss6_path with the installation directory of JBoss 6.

         jboss6_path/bin/run.sh

• JBoss 7:

  1. Edit the configuration file /configuration/mgmt-users.properties and delete the user entry that has a weak password.

  2. Run bin/adduser.sh in the JBoss installation path and follow the prompts to add a new user with a complex password.

Jenkins

1. Log on to the Jenkins service web console.

2. Click Configure to go to the Configure page.

3. In the Password field, enter a new password.

OpenLDAP

1. Run the following command to query the value and location of the OpenLDAP administrator password field.

   ldapsearch -H ldapi:// -LLL -Q -Y EXTERNAL -b "cn=config" "(olcRootDN=*)" dn olcRootDN olcRootPW

2. Run the following command to generate a new password.

    slappasswd -s <NewPassword>

   After running this command, you will get the hash value of the new password, NewHash.

3. Create a new file named newpassword.ldif and add the following information to it.

   dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: NewHash

   The content of the `dn` line is the `dn` value returned by the first query command, and `NewHash` is the hash value of the new password.

4. Run the following command to import the new ldif file.

   ldapmodify -H ldapi:// -Y EXTERNAL -f newpasswd.ldif 

OpenVPN on Linux

Edit the configuration file pwd-file to change the OpenVPN password. The procedure is as follows:

1. Find the configuration file pwd-file. The file is usually in the /etc/openvpn directory.

2. Add the following statement to the configuration file to cancel client certificate authentication.

   client-cert-not-required

3. Add the following statement to the configuration file to enable the user password script.

   auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env

4. Add the following statement to the configuration file to block system alerts.

   script-security  system

5. Edit the /etc/openvpn/psw-file file. Each line corresponds to one account, with the username and password separated by a space. Example:

   cat /etc/openvpn/psw-file 
   abcdocker <NewPassWord>
   abc <NewPassWord>
   test <NewPassWord>

6. Run the following command to get the checkpsw.sh script.

   wget http://openvpn.se/files/other/checkpsw.sh

   Note

   By default, checkpsw.sh reads usernames and passwords from the file /etc/openvpn/psw-file.

Oracle database

1. Log on to the Oracle database.

2. Run the following command to change the password.

   alter user <UserName> identified by <NewPassWord>;

pptpd service

1. Edit the /etc/ppp/chap-secrets file.

2. Configure the username and password in the format <UserName> pptpd <NewPassword>.

   Use a tab key to separate UserName, pptpd, and NewPassword.

3. Restart the pptp service.

ProFTPD

Run the following command and enter the new password as prompted.

In the command, File_Path refers to the file path where the virtual user is stored.

ftpasswd --passwd --name=<UserName> --change-password --file=File_Path

RabbitMQ

Run the following command to change the weak password.

rabbitmqctl change_password <UserName> '<NewPassword>'

VncServer

1. Ensure that VncServer is shut down, then go to the VncServer installation directory on the VncServer server.

   If the weak password is not for the root user, log on or switch to the user whose password you want to change after entering the installation directory. For example, if the user is `aliuser`, run su - aliuser.

2. Delete the `passwd` file in the installation directory, for example, delete /home/aliuser/.vnc/passwd.

3. Run the vncpasswd command to reset the password.

   Important

   VncServer passwords are truncated to the first 8 characters. For example, if you set the new password to `Aliyunpasswd`, the effective password is `Aliyunpa`. If the effective password does not meet the complexity requirements, it is at high risk of being cracked. Ensure your password meets the complexity requirements.

WebLogic 12c

1. Log on to the WebLogic Server Administration Console.

2. In the navigation pane on the left, choose Security Realms > Target Realm > Users and Groups > Users.

3. Select the user whose password you want to change.

4. On the Passwords page, enter and confirm the new password, then click Save.

5. If Activate Changes is displayed in the Change Center in the upper-left corner of the console, click Activate Changes.

6. Log on to the server and modify the password field for the target user in the configuration file `%DOMAIN_HOME%/servers/AdminServer/security/boot.properties.

   The password modified here must be the same as in the WebLogic console. After the password is changed, it will be automatically encrypted with AES.

7. Run the %DOMAIN_HOME%/bin/stopWeblogic.sh command to safely stop WebLogic, and then restart it.

ActiveMQ

1. Go to the configuration file directory activemq_path/conf/.

   activemq_path is the application installation path.

2. Run the vim jetty-realm.properties command to edit the configuration file.

3. Add or modify a user.

   The format for changing the username and password is <UserName>: <NewPassword>,RoleName, where RoleName is the role. For example: admin: passwd123!@#, admin.

4. After making the changes, save, exit, and restart the service.

Elasticsearch service

Run the following command to change a user's password.

In the command, ES_HOME_PATH is the installation path of Elasticsearch, and passwd is the new password.

ES_HOME_PATH/bin/elasticsearch-users passwd <UserName>

Samba

1. Run the smbpasswd <UserName> command to change the user's password.

2. Enter the new password as prompted.

Zabbix

1. Log on to the Zabbix web management console with an administrator account.

2. In the top menu bar, choose Administration > Users to view the user list.

3. Click the target username, then click Change password.

4. Enter the new password and click Update.