9

I'm using GeoServer 2.5.1 and I want to change my default Master Password as is suggested by GeoServer itself when I log in:

The master password for this server has not been changed from the default. It is highly recommended that you change it now. Change it

The Change it link leads me to the Change password form, though I need the default Master Password for this. According to this doc, I'm supposed to find it it at security/masterpw.info, however the only files I find there are masterpw.digest and masterpw.xml. I've tried a bunch of sequences that looked like pws from these files and a file passwd in security/masterpw/default but all I am ever getting is

org.geoserver.security.validation.MasterPasswordChangeException: Current master password invalid

This is reproducible on two different servers and plenty of fresh installations. Am I overseeing something? How can I change my masterpw without masterpw.info?

10

If you can log into the Geoserver UI with the admin account, you should be able to access the Passwords link under the Security tab on the left nav. One of the options here is to pipe the master password out to a file, as well as reset it.

If you're unable to login, you should be able to reset the admin's password from encrypted to a plaintext one, temporarily: In /data/security/usergroup/default/users.xml, change

<user enabled="true" name="admin" password="digest1:D9miJH/hVgfxZJscMafEtbt...JOSV4POi55PQI4tw"/>

to

<user enabled="true" name="admin" password="plain:new-password-here"/>

Then, once you are able to login, you can go into your account, update your password and save it, which will save it back in an encrypted digest form.

  • 3
    For those that come across this post, in v2.5.2 of Geoserver, changes made through the GUI, get saved to these config files automatically. That is to say there is no setting to "pipe the master password out to a file". – alexkb Oct 6 '14 at 7:26
  • I'm still confused by this, there is no "masterpw.info" plaintext file generated by default, so I can't change the master password nor access it by using the available encrypted passwd file (this defeats the purpose of a master password). – ideamotor Nov 5 '15 at 21:41
  • @ideamotor FYI, the default password is geoserver, see my answer for some more info. – Stijn Mar 14 '18 at 17:09
1

The documentation is outdated/wrong.

It's possible to dump the master password by navigating to Security > Passwords and clicking the Master password forgotten ? link. Turns out that the default password is the same as for the admin account: geoserver

  • So this means there is no such thing as a master password? – Honeybear Mar 16 '18 at 10:16
  • I'm not sure what you mean. The master password is a thing, although it's a bit odd that it can be decrypted. – Stijn Mar 16 '18 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.