Changing the Passwords for OS Users of an MRS Cluster Node

Concepts

• omm: The O&M management user for MRS clusters. This user runs and manages MRS Manager and service processes for big data components in the cluster. The omm user can manage cluster services and configurations, but does not have root system-level permissions.
• ommdba: The database management user for MRS clusters. This user runs and manages DBService in the cluster. The ommdba user can manage the cluster database, but does not have root system-level permissions.
• root: The OS super administrator, who has the highest permissions in the system.

Prerequisites

• You have obtained the IP address of the node where the passwords of users omm and ommdba are to be changed.
• You have obtained the password of user root before changing the passwords of users omm and ommdba.
• You have confirmed the password change plan. We recommend changing passwords during off-peak hours to avoid disrupting running cluster services.

Changing the Password for OS Users of an MRS Cluster Node

Changing an OS user password is a high-risk operation. If the change fails, users cannot log in or cluster services may become abnormal. Before changing a password, ensure the current password is correct and record the new password. We recommend changing only one user password at a time. After changing a password successfully, proceed to the next user. Before changing the password for user root, ensure that the root password is backed up to prevent losing node access.

1. Log in to the node that requires password change as user root.

   If you are logged in as a different user, run the following command to switch to the required user:

   sudo su - root

2. Run the following command to change the passwords of users omm, ommdba, or root:

   passwd omm

   passwd ommdba

   passwd root

   For example, after you run the command to change the password of user omm, the following information is displayed:

   Changing password for user omm.
   New password:
   Retype new password:

   Enter the new password and confirm the password. The OS password change policies vary depending on the OS in use.

   Table 1 Password complexity requirements

   Item	Description
   Password length	Must contain at least 8 characters.
   Character type	Must contain at least three of the following character types: uppercase letters, lowercase letters, digits, spaces, or special characters (~!@#$%^&*()-_=+\|[{}];:'",<.>/?).
   Historical password restriction	The new password cannot be the same as any of the last five passwords.

   After you change the password, the system displays the message "successfully." Log in to the node using SSH with the new password to verify the change. For omm users, perform related operations on MRS Manager to verify that services are running normally.

   To change the password validity period for an OS user, see Changing the MRS OS User Password Validity Period.

Changing the MRS OS User Password Validity Period

1. Log in to the node where you want to change the password validity period of the OS user password as the root user.
2. Change the OS user password validity period.
   • Legacy users

     Run the following command to change the password validity period:

     chage -MValidity period (days) user_name

     Table 2 Parameter description for the chage command

     Item	Description
     -M	Password validity period, in days. Setting this parameter to 99999 configures the password to never expire. Set this parameter according to your service requirements.
     user_name	Name of the OS user whose password validity period will be changed. Examples include omm, ommdba, or root.

     For example, to change the password validity period for the ommdba user to 180 days, run the following command:

     chage -M 180 ommdba 

     Verification method:

     Run the following command to check whether the password validity period was updated:

     chage -l user_name 

     If the command output displays the configured value, the modification was successful.

     You are advised to set this parameter based on service requirements and periodically change the user password.

   • New users

     Run the following command to edit the file and change the value of PASS_MAX_DAYS, which indicates the password validity period, in days. If the value is changed to 99999, the password never expires.

     vi /etc/login.defs

Helpful Links

• For details about how to access Manager of an MRS cluster, see Accessing MRS Manager.
• For details about security management best practices for MRS clusters, see MRS Cluster Security Configuration.
• For more commands to manage Linux system users and passwords, see the official Linux OS documentation.

FAQs:

Q: Do I need to restart cluster services after changing the omm user password?

A: No. Changing the omm user password does not affect running cluster service processes.

Q: What should I do if I forget the root password?

A: Log in to the node using VNC on the Huawei Cloud console, or contact the system administrator to reset the root password in single-user mode.

Q: What should I do if message "Authentication token manipulation error" occurs during password changes?

A: Verify that the new password meets complexity requirements, the file system has sufficient free space, and permissions on the /etc/shadow file are correct.