When dscreate is executed in verbose mode, it prints Directory Manager's password to stderr. The same happens with dsconf when I change the password.

Version-Release number of selected component (if applicable): 
389-ds-base-1.4.0.19-2.

How reproducible: 
always

Steps to Reproduce: 
1. dscreate -v interactive 
2. dsconf -v localhost directory_manager password_change

Actual results:

# dscreate -v interactive
...
DEBUG: cn=config set REPLACE: ('nsslapd-rootpw', 'Directory_Manager_Password')

# dsconf -v localhost directory_manager password_change
... 
Enter new directory manager password : 
CONFIRM - Enter new directory manager password : 
DEBUG: cn=config set REPLACE: ('nsslapd-rootpw', 'new_password')

Expected results:
Actual value should not be printed in the debug logs. Python logging module supports filters that should be used to redact sensitive information from the logs

Reference: 

https://bugzilla.redhat.com/show_bug.cgi?id=1654059