Q&A: How can I change the machine password from my ucs master?

[scheinig]

Question:

How can I change the machine password from may ucs master. For example if you get
ldap_bind: Invalid credentials (49)
from a ldapsearch command.

Answer:

You can try the server-password change routine:

Manually trigger server password change

General information To reconfirm the trust relation between UCS systems, computers need to regularly change the password associated with the machine account. This is controlled through the Univention Configuration Registry variable server/password/interval For UCS servers this is evaluated by the script /usr/lib/univention-server/server_password_change , which is invoked nightly at 01:00 by cron(8). The interval is controlled through a second Univention Configuration Registry variable ser…

But in some cases this does not work anymore, if the password ist already wrong and the ldapaccess with the old machine.secret does not work, anymore you have to set the password manually.
You can use an old one, they are saved in /etc/machine.secret.old
or set a new one:

echo $(date +%y%m%d%H%M)': '$(cat /etc/machine.secret) >> /etc/machine.secret.old
NEWPW=$( pwgen -s 20 1 )
udm computers/domaincontroller_master modify --dn $(ucr get ldap/hostdn) \
  --set password=$NEWPW
echo -n $NEWPW > /etc/machine.secret
unset NEWPW