Change default passwords post-installation

Products

VCF Operations/Automation (formerly VMware Aria Suite) VMware Salt

Issue/Introduction

The default passwords were used during the initial deployment or upgrade
Business policy to change passwords periodically

Environment

VMware Salt 8.18+

Resolution

Follow these steps to safely update the database password:

Note: Stop the RaaS daemon prior to proceeding with these steps.

Step 1: Update the Password in the PostgreSQL Database First, change the actual database user's password inside PostgreSQL.

Open the PostgreSQL command-line tool as the system database administrator (postgres):
```
sudo -u postgres psql
```
Trigger the password reset prompt for the RaaS database user (usually salt_eapi):
```
\password salt_eapi
```
The system will ask you to type the new password twice.
Note: The text will be hidden as you type.
Quit the database prompt and return to the normal Linux command line:
```
\q
```

Step 2: Open a Shell as the Restricted raas User Because the raas account is locked down, you must explicitly force the system to give you a temporary command-line shell (/bin/bash) running as that user.

Run this command:
```
sudo -u raas /bin/bash
```

Step 3: Activate the Virtual Python Environment Operating as the raas user, you must set up the environment variables and activate the virtual environment so the system knows exactly where the RaaS commands live.

Tell the system where the raas user's home directory is:
```
export HOME=/app/raas
```
Add the specific folder containing the RaaS commands to your PATH:
```
export PATH=/opt/saltstack/raas/bin:$PATH
```
Activate the Python virtual environment:
```
source /opt/saltstack/raas/bin/activate
```

Step 4: Update the raas.secconf Configuration File Use a built-in RaaS tool to securely encrypt your new database password and save it into the system configuration.

Run the save_creds command. Make sure to replace <NEW_DB_PASSWORD> with the password you created in Step 1.
Note: You also need to pass your current Redis username and password to this command so they don't get accidentally overwritten.
```
raas -l debug save_creds postgres='{"username": "salt_eapi","password":"<NEW_DB_PASSWORD>"}' redis='{"username":"<YOUR_REDIS_USER>","password":"<YOUR_REDIS_PASS>"}'
```
Exit the raas user session and return to your standard administrator account:
```
exit
```

Step 5: Restart the RaaS Service Finally, restart the RaaS background service so it picks up the brand new encrypted configuration file.

Restart the RaaS daemon:
```
sudo systemctl restart raas
```
Check the status to ensure it says "active (running)":
```
sudo systemctl status raas
```

Additional Information

Risk & Revert Plan:

Potential Risk: This procedure modifies the authentication link between the application and the database. If the password set in PostgreSQL (Step 1) does not perfectly match the password saved into raas.secconf (Step 4), the RaaS service will fail to connect to the database, resulting in the Automation Config web interface going offline.
How to Revert:
1. Keep a backup copy of your configuration before starting by running: sudo cp /etc/raas/raas.secconf /etc/raas/raas.secconf.backup
2. If the service fails to start, simply repeat Step 1 to change the PostgreSQL password back to your old password, and then restore your backup file with: sudo cp /etc/raas/raas.secconf.backup /etc/raas/raas.secconf followed by sudo systemctl restart raas.