diff --git a/packstack/plugins/cinder_250.py b/packstack/plugins/cinder_250.py
index b51e4104c..195dcb6db 100644
--- a/packstack/plugins/cinder_250.py
+++ b/packstack/plugins/cinder_250.py
@@ -2,6 +2,7 @@
 Installs and configures Cinder
 """
 
+import uuid
 import logging
 
 import packstack.installer.engine_validators as validate
@@ -40,6 +41,30 @@ def initConfig(controllerObject):
                    "USE_DEFAULT"     : False,
                    "NEED_CONFIRM"    : False,
                    "CONDITION"       : False },
+                  {"CMD_OPTION"      : "cinder-db-passwd",
+                   "USAGE"           : "The password to use for the Cinder to access DB",
+                   "PROMPT"          : "Enter the password for the Cinder DB access",
+                   "OPTION_LIST"     : [],
+                   "VALIDATION_FUNC" : validate.validateStringNotEmpty,
+                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
+                   "MASK_INPUT"      : True,
+                   "LOOSE_VALIDATION": False,
+                   "CONF_NAME"       : "CONFIG_CINDER_DB_PW",
+                   "USE_DEFAULT"     : True,
+                   "NEED_CONFIRM"    : True,
+                   "CONDITION"       : False },
+                  {"CMD_OPTION"      : "cinder-ks-passwd",
+                   "USAGE"           : "The password to use for the Cinder to authenticate with Keystone",
+                   "PROMPT"          : "Enter the password for the Cinder Keystone access",
+                   "OPTION_LIST"     : [],
+                   "VALIDATION_FUNC" : validate.validateStringNotEmpty,
+                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
+                   "MASK_INPUT"      : True,
+                   "LOOSE_VALIDATION": False,
+                   "CONF_NAME"       : "CONFIG_CINDER_KS_PW",
+                   "USE_DEFAULT"     : True,
+                   "NEED_CONFIRM"    : True,
+                   "CONDITION"       : False },
                  ]
 
     groupDict = { "GROUP_NAME"            : "CINDER",
diff --git a/packstack/plugins/glance_200.py b/packstack/plugins/glance_200.py
index 59119d7b5..9dd231168 100644
--- a/packstack/plugins/glance_200.py
+++ b/packstack/plugins/glance_200.py
@@ -2,6 +2,7 @@
 Installs and configures Glance
 """
 
+import uuid
 import logging
 
 import packstack.installer.engine_validators as validate
@@ -40,6 +41,30 @@ def initConfig(controllerObject):
                    "USE_DEFAULT"     : False,
                    "NEED_CONFIRM"    : False,
                    "CONDITION"       : False },
+                  {"CMD_OPTION"      : "glance-db-passwd",
+                   "USAGE"           : "The password to use for the Glance to access DB",
+                   "PROMPT"          : "Enter the password for the Glance DB access",
+                   "OPTION_LIST"     : [],
+                   "VALIDATION_FUNC" : validate.validateStringNotEmpty,
+                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
+                   "MASK_INPUT"      : True,
+                   "LOOSE_VALIDATION": False,
+                   "CONF_NAME"       : "CONFIG_GLANCE_DB_PW",
+                   "USE_DEFAULT"     : True,
+                   "NEED_CONFIRM"    : True,
+                   "CONDITION"       : False },
+                  {"CMD_OPTION"      : "glance-ks-passwd",
+                   "USAGE"           : "The password to use for the Glance to authenticate with Keystone",
+                   "PROMPT"          : "Enter the password for the Glance Keystone access",
+                   "OPTION_LIST"     : [],
+                   "VALIDATION_FUNC" : validate.validateStringNotEmpty,
+                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
+                   "MASK_INPUT"      : True,
+                   "LOOSE_VALIDATION": False,
+                   "CONF_NAME"       : "CONFIG_GLANCE_KS_PW",
+                   "USE_DEFAULT"     : True,
+                   "NEED_CONFIRM"    : True,
+                   "CONDITION"       : False },
                  ]
 
     groupDict = { "GROUP_NAME"            : "GLANCE",
diff --git a/packstack/plugins/keystone_100.py b/packstack/plugins/keystone_100.py
index 1b2286885..f14eece0e 100644
--- a/packstack/plugins/keystone_100.py
+++ b/packstack/plugins/keystone_100.py
@@ -42,6 +42,18 @@ def initConfig(controllerObject):
                    "USE_DEFAULT"     : False,
                    "NEED_CONFIRM"    : False,
                    "CONDITION"       : False },
+                  {"CMD_OPTION"      : "keystone-db-passwd",
+                   "USAGE"           : "The password to use for the Keystone to access DB",
+                   "PROMPT"          : "Enter the password for the Keystone DB access",
+                   "OPTION_LIST"     : [],
+                   "VALIDATION_FUNC" : validate.validateStringNotEmpty,
+                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
+                   "MASK_INPUT"      : True,
+                   "LOOSE_VALIDATION": False,
+                   "CONF_NAME"       : "CONFIG_KEYSTONE_DB_PW",
+                   "USE_DEFAULT"     : True,
+                   "NEED_CONFIRM"    : True,
+                   "CONDITION"       : False },
                   {"CMD_OPTION"      : "keystone-admin-token",
                    "USAGE"           : "The token to use for the Keystone service api",
                    "PROMPT"          : "The token to use for the Keystone service api",
diff --git a/packstack/plugins/nova_300.py b/packstack/plugins/nova_300.py
index 9eb046192..8290b683c 100644
--- a/packstack/plugins/nova_300.py
+++ b/packstack/plugins/nova_300.py
@@ -2,8 +2,9 @@
 Installs and configures nova
 """
 
-import logging
 import os
+import uuid
+import logging
 
 import packstack.installer.engine_validators as validate
 import packstack.installer.engine_processors as process
@@ -107,6 +108,30 @@ def initConfig(controllerObject):
                    "USE_DEFAULT"     : False,
                    "NEED_CONFIRM"    : False,
                    "CONDITION"       : False },
+                  {"CMD_OPTION"      : "nova-db-passwd",
+                   "USAGE"           : "The password to use for the Nova to access DB",
+                   "PROMPT"          : "Enter the password for the Nova DB access",
+                   "OPTION_LIST"     : [],
+                   "VALIDATION_FUNC" : validate.validateStringNotEmpty,
+                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
+                   "MASK_INPUT"      : True,
+                   "LOOSE_VALIDATION": False,
+                   "CONF_NAME"       : "CONFIG_NOVA_DB_PW",
+                   "USE_DEFAULT"     : True,
+                   "NEED_CONFIRM"    : True,
+                   "CONDITION"       : False },
+                  {"CMD_OPTION"      : "nova-ks-passwd",
+                   "USAGE"           : "The password to use for the Nova to authenticate with Keystone",
+                   "PROMPT"          : "Enter the password for the Nova Keystone access",
+                   "OPTION_LIST"     : [],
+                   "VALIDATION_FUNC" : validate.validateStringNotEmpty,
+                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
+                   "MASK_INPUT"      : True,
+                   "LOOSE_VALIDATION": False,
+                   "CONF_NAME"       : "CONFIG_NOVA_KS_PW",
+                   "USE_DEFAULT"     : True,
+                   "NEED_CONFIRM"    : True,
+                   "CONDITION"       : False },
                   {"CMD_OPTION"      : "novanetwork-pubif",
                    "USAGE"           : "Public interface on the Nova network server",
                    "PROMPT"          : "Enter the Public interface on the Nova network server",
@@ -253,4 +278,3 @@ def createcommonmanifest():
         if manifestfile.endswith("_nova.pp"):
             data = getManifestTemplate("nova_common.pp")
             appendManifestFile(os.path.split(manifestfile)[1], data)
-
diff --git a/packstack/plugins/swift_600.py b/packstack/plugins/swift_600.py
index 645f25f3b..f7a013543 100644
--- a/packstack/plugins/swift_600.py
+++ b/packstack/plugins/swift_600.py
@@ -2,6 +2,7 @@
 Installs and configures an openstack swift
 """
 
+import uuid
 import logging
 import os
 
@@ -38,6 +39,18 @@ def initConfig(controllerObject):
                    "USE_DEFAULT"     : False,
                    "NEED_CONFIRM"    : False,
                    "CONDITION"       : False },
+                  {"CMD_OPTION"      : "os-swift-ks-passwd",
+                   "USAGE"           : "The password to use for the Swift to authenticate with Keystone",
+                   "PROMPT"          : "Enter the password for the Swift Keystone access",
+                   "OPTION_LIST"     : [],
+                   "VALIDATION_FUNC" : validate.validateStringNotEmpty,
+                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
+                   "MASK_INPUT"      : True,
+                   "LOOSE_VALIDATION": False,
+                   "CONF_NAME"       : "CONFIG_SWIFT_KS_PW",
+                   "USE_DEFAULT"     : True,
+                   "NEED_CONFIRM"    : True,
+                   "CONDITION"       : False },
                   {"CMD_OPTION"      : "os-swift-storage",
                    "USAGE"           : "A comma separated list of IP addresses on which to install the Swift Storage services, each entry should take the format <ipaddress>[/dev], for example 127.0.0.1/vdb will install /dev/vdb on 127.0.0.1 as a swift storage device, if /dev is omitted Packstack will create a loopback device for a test setup",
                    "PROMPT"          : "Enter the Swift Storage servers e.g. host/dev,host/dev",
diff --git a/packstack/puppet/templates/cinder.pp b/packstack/puppet/templates/cinder.pp
index 512b1392d..f22190da6 100644
--- a/packstack/puppet/templates/cinder.pp
+++ b/packstack/puppet/templates/cinder.pp
@@ -1,7 +1,7 @@
 
 class {'cinder::base':
     rabbit_password => '',
-    sql_connection => "mysql://cinder:cinder_default_password@%(CONFIG_MYSQL_HOST)s/cinder"
+    sql_connection => "mysql://cinder:%(CONFIG_CINDER_DB_PW)s@%(CONFIG_MYSQL_HOST)s/cinder"
 }
 
 cinder_config{
@@ -13,7 +13,7 @@ package {'python-keystone':
     notify => Class['cinder::api'],
 }
 class {'cinder::api':
-    keystone_password => 'cinder_default_password',
+    keystone_password => '%(CONFIG_CINDER_KS_PW)s',
     keystone_tenant => "services",
     keystone_user => "cinder",
     keystone_auth_host => "%(CONFIG_KEYSTONE_HOST)s",
@@ -34,4 +34,3 @@ firewall { '001 cinder incoming':
     dport    => ['3260', '8776'],
     action   => 'accept',
 }
-
diff --git a/packstack/puppet/templates/glance.pp b/packstack/puppet/templates/glance.pp
index fad0695de..09d5919fd 100644
--- a/packstack/puppet/templates/glance.pp
+++ b/packstack/puppet/templates/glance.pp
@@ -4,8 +4,8 @@ class {"glance::api":
     auth_host => "%(CONFIG_KEYSTONE_HOST)s",
     keystone_tenant => "services",
     keystone_user => "glance",
-    keystone_password => "glance_default_password",
-    sql_connection => "mysql://glance:glance_default_password@%(CONFIG_MYSQL_HOST)s/glance"
+    keystone_password => "%(CONFIG_GLANCE_KS_PW)s",
+    sql_connection => "mysql://glance:%(CONFIG_GLANCE_DB_PW)s@%(CONFIG_MYSQL_HOST)s/glance"
 }
 
 class { 'glance::backend::file': }
@@ -14,8 +14,8 @@ class {"glance::registry":
     auth_host => "%(CONFIG_KEYSTONE_HOST)s",
     keystone_tenant => "services",
     keystone_user => "glance",
-    keystone_password => "glance_default_password",
-    sql_connection => "mysql://glance:glance_default_password@%(CONFIG_MYSQL_HOST)s/glance"
+    keystone_password => "%(CONFIG_GLANCE_KS_PW)s",
+    sql_connection => "mysql://glance:%(CONFIG_GLANCE_DB_PW)s@%(CONFIG_MYSQL_HOST)s/glance"
 }
 
 firewall { '001 glance incoming':
@@ -23,4 +23,3 @@ firewall { '001 glance incoming':
     dport    => ['9292'],
     action   => 'accept',
 }
-
diff --git a/packstack/puppet/templates/keystone.pp b/packstack/puppet/templates/keystone.pp
index 9195e2d72..4c11bf0f1 100644
--- a/packstack/puppet/templates/keystone.pp
+++ b/packstack/puppet/templates/keystone.pp
@@ -1,6 +1,6 @@
 class {"keystone":
     admin_token => "%(CONFIG_KEYSTONE_ADMINTOKEN)s",
-    sql_connection => "mysql://keystone_admin:keystone_default_password@%(CONFIG_MYSQL_HOST)s/keystone",
+    sql_connection => "mysql://keystone_admin:%(CONFIG_KEYSTONE_DB_PW)s@%(CONFIG_MYSQL_HOST)s/keystone",
 }
 
 class {"keystone::roles::admin":
@@ -20,4 +20,3 @@ firewall { '001 keystone incoming':
     dport    => ['5000', '35357'],
     action   => 'accept',
 }
-
diff --git a/packstack/puppet/templates/keystone_cinder.pp b/packstack/puppet/templates/keystone_cinder.pp
index 12a6b0316..f8245661a 100644
--- a/packstack/puppet/templates/keystone_cinder.pp
+++ b/packstack/puppet/templates/keystone_cinder.pp
@@ -1,8 +1,7 @@
 
 class {"cinder::keystone::auth":
-    password => "cinder_default_password",
+    password => "%(CONFIG_CINDER_KS_PW)s",
     public_address => "%(CONFIG_CINDER_HOST)s",
     admin_address => "%(CONFIG_CINDER_HOST)s",
     internal_address => "%(CONFIG_CINDER_HOST)s",
 }
-
diff --git a/packstack/puppet/templates/keystone_glance.pp b/packstack/puppet/templates/keystone_glance.pp
index 92441dd96..4823cd60e 100644
--- a/packstack/puppet/templates/keystone_glance.pp
+++ b/packstack/puppet/templates/keystone_glance.pp
@@ -1,8 +1,7 @@
 
 class {"glance::keystone::auth":
-    password => "glance_default_password",
+    password => "%(CONFIG_GLANCE_KS_PW)s",
     public_address => "%(CONFIG_GLANCE_HOST)s",
     admin_address => "%(CONFIG_GLANCE_HOST)s",
     internal_address => "%(CONFIG_GLANCE_HOST)s",
 }
-
diff --git a/packstack/puppet/templates/keystone_nova.pp b/packstack/puppet/templates/keystone_nova.pp
index b609a724a..f336fa5c7 100644
--- a/packstack/puppet/templates/keystone_nova.pp
+++ b/packstack/puppet/templates/keystone_nova.pp
@@ -1,9 +1,8 @@
 
 class {"nova::keystone::auth":
-    password    => "nova_default_password",
+    password    => "%(CONFIG_NOVA_KS_PW)s",
     public_address => "%(CONFIG_NOVA_API_HOST)s",
     admin_address => "%(CONFIG_NOVA_API_HOST)s",
     internal_address => "%(CONFIG_NOVA_API_HOST)s",
     cinder => true,
 }
-
diff --git a/packstack/puppet/templates/keystone_swift.pp b/packstack/puppet/templates/keystone_swift.pp
index 6a510931d..3fe365d3f 100644
--- a/packstack/puppet/templates/keystone_swift.pp
+++ b/packstack/puppet/templates/keystone_swift.pp
@@ -1,4 +1,4 @@
 class { 'swift::keystone::auth':
   address  => '%(CONFIG_SWIFT_PROXY)s',
-  password => 'swift_default_password',
+  password => '%(CONFIG_SWIFT_KS_PW)s',
 }
diff --git a/packstack/puppet/templates/mysql.pp b/packstack/puppet/templates/mysql.pp
index 0437c312f..534249ed7 100644
--- a/packstack/puppet/templates/mysql.pp
+++ b/packstack/puppet/templates/mysql.pp
@@ -22,22 +22,22 @@ if ($::fqdn != $::hostname) {
 }
 
 class {"keystone::db::mysql":
-    password      => "keystone_default_password",
+    password      => "%(CONFIG_KEYSTONE_DB_PW)s",
     allowed_hosts => "%%",
 }
 
 class {"glance::db::mysql":
-    password      => "glance_default_password",
+    password      => "%(CONFIG_GLANCE_DB_PW)s",
     allowed_hosts => "%%",
 }
 
 class {"nova::db::mysql":
-    password      => "nova_default_password",
+    password      => "%(CONFIG_NOVA_DB_PW)s",
     allowed_hosts => "%%",
 }
 
 class {"cinder::db::mysql":
-    password      => "cinder_default_password",
+    password      => "%(CONFIG_CINDER_DB_PW)s",
     allowed_hosts => "%%",
 }
 
diff --git a/packstack/puppet/templates/nova_api.pp b/packstack/puppet/templates/nova_api.pp
index 7b2156db5..f4ceac23d 100644
--- a/packstack/puppet/templates/nova_api.pp
+++ b/packstack/puppet/templates/nova_api.pp
@@ -3,7 +3,7 @@ require 'keystone::python'
 class {"nova::api":
     enabled => true,
     auth_host => "%(CONFIG_KEYSTONE_HOST)s",
-    admin_password => "nova_default_password",
+    admin_password => "%(CONFIG_NOVA_KS_PW)s",
 }
 
 Package<| title == 'nova-common' |> -> Class['nova::api']
diff --git a/packstack/puppet/templates/nova_common.pp b/packstack/puppet/templates/nova_common.pp
index 73ad8bf81..83a399f6e 100644
--- a/packstack/puppet/templates/nova_common.pp
+++ b/packstack/puppet/templates/nova_common.pp
@@ -6,5 +6,5 @@ nova_config{
 
 class {"nova":
     glance_api_servers => "%(CONFIG_GLANCE_HOST)s:9292",
-    sql_connection => "mysql://nova:nova_default_password@%(CONFIG_MYSQL_HOST)s/nova",
+    sql_connection => "mysql://nova:%(CONFIG_NOVA_DB_PW)s@%(CONFIG_MYSQL_HOST)s/nova",
 }
diff --git a/packstack/puppet/templates/swift_proxy.pp b/packstack/puppet/templates/swift_proxy.pp
index 595e7ca14..9845de4dc 100644
--- a/packstack/puppet/templates/swift_proxy.pp
+++ b/packstack/puppet/templates/swift_proxy.pp
@@ -49,7 +49,7 @@ class { 'swift::proxy::keystone':
 class { 'swift::proxy::authtoken':
     admin_user        => 'swift',
     admin_tenant_name => 'services',
-    admin_password    => 'swift_default_password',
+    admin_password    => '%(CONFIG_SWIFT_KS_PW)s',
     # assume that the controller host is the swift api server
     auth_host         => '%(CONFIG_KEYSTONE_HOST)s',
 }