Changing Passwords on a ztC Endurance System

A ztC Endurance system requires the following sets of passwords:

  • BMC Web console administrator password

  • zenadmin password on the Management VM and Standby OS

  • ESXi root password

  • ztC Endurance console​ and REST API password

This topic describes these passwords and explains how to update them (when possible) after the installation. See Gathering Information to learn more about these passwords.

To change the BMC Web console administrator password, log in to the BMC Web console as described in Logging In to the BMC Web Console. Click Settings, and then click User Management. The User Management page allows you to set usernames and passwords.

Note: Both BMCs must have an account with the username admin, and both BMCs must use the same administrator password.

If you change the password after the installation, you must use the cfgpasswd command to notify the system-management software.

Notice: The system-management software uses the same password for IPMI accesses to the BMC. Therefore, if you do not notify the system-management software of a password change, any attempts to access the BMC by the system-management software results in a failure.

To notify the system-management software

  1. On the management VM, run the following command:

    sudo /opt/stratus/sbin/cfgpasswd --bmcadmin

  2. At the prompt, enter the new BMC administrator password that you created in the BMC Web console.

Note: The cfgpasswd command does not change the password; it simply notifies the system-management software of the change.

The following example shows how to use the cfgpasswd command.

zenadmin@sys001-ztcmgmt:~$ sudo /opt/stratus/sbin/cfgpasswd --bmcadmin
Stopping sra-mgmt...
Enter value for BMC admin password: xxxxxxxxxxx
Confirm value for BMC admin password: xxxxxxxxxxx
Installed /opt/stratus/config/install-config.json
Restarting sra-mgmt...
zenadmin@sys001-ztcmgmt:~$

Non-administrator users can set up additional usernames and passwords with the BMC Web console without using the cfgpasswd command. The system-management software does not use these usernames or passwords and therefore does not need to be notified about them.

The system-management software uses the Ubuntu operating system zenadmin account on the Management VM and Standby OS for BeyondTrust installation and configuration, support logs, and software upgrades.

Notice: The Management VM and both Standby OSes require the same password for the zenadmin account.

To change the zenadmin account password

  1. Change the password for each Ubuntu instance with the Linux passwd command:

    1. Use the ssh command to connect to the Management VM and each Standby OS (for example, ssh zenadmin@xxx-ztcmgmt.yyy.com). Note that you must perform a Smart Exchange​ to connect to each Standby OS.

    2. Run the Linux passwd command.

  2. Notify system management about the new password created in the previous steps:

    1. On the Management VM, run the following command:

      sudo /opt/stratus/sbin/cfgpasswd --zenadmin

    2. At the prompt, enter the new password.

      Note: The cfgpassword command does not change passwords. It simply stores an encrypted copy of the password for the management software to use when it needs to access the account protected by the password.

  3. Verify the passwords by running the following command on the Management VM and current Standby OS:

    sudo /opt/stratus/sbin/cfgpasswd --verify

To change the ESXi root password, use the ESXi Host Client. (See Configuring ESXi Host Client or vSphere Web Client for Remote System Management for information about logging in to the ESXi Host Client.) Stratus software does not use this password, so changing it has no impact on your ztC Endurance system.

To change ztC Endurance console​ usernames and passwords, use the ztC Endurance console​ as described in Managing User Accounts.

The REST API uses the same usernames and passwords.

Notice: If you change the usernames and passwords, any external application using the REST API must change its usernames and passwords to match.