en-US/change-database-password.xml

<?xml version='1.0' encoding='utf-8' ?>
<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
<!ENTITY % BOOK_ENTITIES SYSTEM "cloudstack.ent">
%BOOK_ENTITIES;
]>

<!-- Licensed to the Apache Software Foundation (ASF) under one
 or more contributor license agreements.  See the NOTICE file
 distributed with this work for additional information
 regarding copyright ownership.  The ASF licenses this file
 to you under the Apache License, Version 2.0 (the
 "License"); you may not use this file except in compliance
 with the License.  You may obtain a copy of the License at
 
   http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing,
 software distributed under the License is distributed on an
 "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 KIND, either express or implied.  See the License for the
 specific language governing permissions and limitations
 under the License.
-->

<section id="change-database-password">
    <title>Changing the Database Password</title>
    <para>You may need to change the password for the MySQL account used by CloudStack. If so, you'll need to change the password in MySQL, and then add the encrypted password to <filename>/etc/cloudstack/management/db.properties</filename>.</para> 
    <orderedlist>
    <listitem>
        <para>Before changing the password, you'll need to stop CloudStack's management server and the usage engine if you've deployed that component.</para>
<screen>
<command># service cloudstack-management stop</command>
<command># service cloudstack-usage stop</command>
</screen>
    </listitem>
    <listitem>
        <para>Next, you'll update the password for the CloudStack user on the MySQL server.</para>
<screen>
<command># mysql -u root -p</command>
</screen>
        <para>At the MySQL shell, you'll change the password and flush privileges:</para>
<screen>
<command>update mysql.user set password=PASSWORD("newpassword123") where User='cloud';</command>
<command>flush privileges;</command>
<command>quit;</command>
</screen>
    </listitem>
    <listitem>
        <para>The next step is to encrypt the password and copy the encrypted password to CloudStack's database configuration (<filename>/etc/cloudstack/management/db.properties</filename>).</para>
<screen>
    <command># java -classpath /usr/share/cloudstack-common/lib/jasypt-1.9.0.jar \
org.jasypt.intf.cli.JasyptPBEStringEncryptionCLI encrypt.sh \ 
input="newpassword123" password="`cat /etc/cloudstack/management/key`" \
verbose=false 
</command>
</screen>
<note><title>File encryption type</title>
    <para>Note that this is for the file encryption type. If you're using the web encryption type then you'll use password="management_server_secret_key"</para>
</note>
</listitem>
<listitem>
    <para>Now, you'll update <filename>/etc/cloudstack/management/db.properties</filename> with the new ciphertext. Open <filename>/etc/cloudstack/management/db.properties</filename> in a text editor, and update these parameters: </para>
    <programlisting>
db.cloud.password=ENC(encrypted_password_from_above) 
db.usage.password=ENC(encrypted_password_from_above) 
</programlisting>
</listitem>
<listitem>
    <para>After copying the new password over, you can now start CloudStack (and the usage engine, if necessary).</para>
    <screen>
        <command># service cloudstack-management start</command>
        <command># service cloud-usage start</command>
    </screen>
</listitem>
</orderedlist>
</section>