java
Java-Monitor Forum > Java Application Server Administration > Openfire Administration » Default admin password in Openfire (and how to reset it)
Reply
 
Thread Tools Search this Thread Display Modes
  #1  
Old 22-07-2009, 12:11
kjkoster kjkoster is offline
Forum Operator
 
Join Date: Jul 2008
Posts: 1,119
Default Default admin password in Openfire (and how to reset it)

Dear All,

A question that pops up surprisingly often is: "what is Openfire's default admin password?" The answer is: whatever you set it to. Openfire does the sensible thing by not providing a default password. You set one as part of the installation procedure. The admin account's name is still "admin".

So maybe you have forgotten the password you set when you installed Openfire? You wrote it on a scrap of paper and the dog ate it? No problem, you can easily reset the password in the database.

I use MySQL for these examples, so you may have to localise the syntax here and there. Open a console on the Openfire database and enter the following commands:
Code:
mysql> SELECT * FROM ofUser WHERE username='admin';
+----------+---------------+--------------------------------------------------+---------------+-------------------+-----------------+------------------+
| username | plainPassword | encryptedPassword                                | name          | email             | creationDate    | modificationDate |
+----------+---------------+--------------------------------------------------+---------------+-------------------+-----------------+------------------+
| admin    | NULL          | df8d8aa53e956defc1d83aa7612194fd610897dc271e475a | Administrator | admin@example.com | 001248259126800 | 0                | 
+----------+---------------+--------------------------------------------------+---------------+-------------------+-----------------+------------------+
1 row in set (0.00 sec)

mysql> _
Note how the password is encrypted, but that there is a NULL plainPassword field too. Let's set the new password in that field.

Code:
mysql> UPDATE ofUser SET plainPassword='test123', encryptedPassword=NULL WHERE username='admin';
Query OK, 1 row affected (0.00 sec)
Rows matched: 1  Changed: 1  Warnings: 0

mysql> SELECT * FROM ofUser WHERE username='admin';
+----------+---------------+-------------------+---------------+-------------------+-----------------+------------------+
| username | plainPassword | encryptedPassword | name          | email             | creationDate    | modificationDate |
+----------+---------------+-------------------+---------------+-------------------+-----------------+------------------+
| admin    | test123       | NULL              | Administrator | admin@example.com | 001248259126800 | 0                | 
+----------+---------------+-------------------+---------------+-------------------+-----------------+------------------+
1 row in set (0.00 sec)

mysql> _
Good, we now have the password set to something we can remember.

But wait, the admin password is stored plain-text in the database! Oh horror!

Log into the admin console with the new password and change the password from there. Openfire will use the plain-text password for you to log in. When you change the password in the admin control panel, Openfire will erase the plain-text password and store the new one in an encrypted form.

Code:
mysql> SELECT * FROM ofUser WHERE username='admin';
+----------+---------------+--------------------------------------------------+---------------+-------------------+-----------------+------------------+
| username | plainPassword | encryptedPassword                                | name          | email             | creationDate    | modificationDate |
+----------+---------------+--------------------------------------------------+---------------+-------------------+-----------------+------------------+
| admin    | NULL          | dc94e8d99302d76ba02213b1f0c95088b58945b6110d5579 | Administrator | admin@example.com | 001248259126800 | 0                | 
+----------+---------------+--------------------------------------------------+---------------+-------------------+-----------------+------------------+
1 row in set (0.00 sec)

mysql> _
Kees Jan

PS. Oh, and if you are using Openfire 3.6.4, you cannot log into the admin panel after the setup sequence. You have to restart Openfire after the initial setup to work around this issue.

PPS. Actually, since the cipher's source code is available and the procedure to decrypt passwords too, the encrypted passwords are not actually more secure than the plain-text ones. But hey, management wants encrypted passwords in the database, management gets encrypted passwords in the database. :-)
Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump