15

I'm using GeoServer 2.5.1 and I want to change my default Master Password as is suggested by GeoServer itself when I log in:

The master password for this server has not been changed from the default. It is highly recommended that you change it now. Change it

The Change it link leads me to the Change password form, though I need the default Master Password for this. According to this doc, I'm supposed to find it it at security/masterpw.info, however the only files I find there are masterpw.digest and masterpw.xml. I've tried a bunch of sequences that looked like pws from these files and a file passwd in security/masterpw/default but all I am ever getting is

org.geoserver.security.validation.MasterPasswordChangeException: Current master password invalid

This is reproducible on two different servers and plenty of fresh installations. Am I overseeing something? How can I change my masterpw without masterpw.info?

Honeybear
  • 2,454
  • 1
  • 15
  • 25

2 Answers2

13

If you can log into the Geoserver UI with the admin account, you should be able to access the Passwords link under the Security tab on the left nav. One of the options here is to pipe the master password out to a file, as well as reset it.

If you're unable to login, you should be able to reset the admin's password from encrypted to a plaintext one, temporarily: In /data/security/usergroup/default/users.xml, change

<user enabled="true" name="admin" password="digest1:D9miJH/hVgfxZJscMafEtbt...JOSV4POi55PQI4tw"/>

to

<user enabled="true" name="admin" password="plain:new-password-here"/>

Then, once you are able to login, you can go into your account, update your password and save it, which will save it back in an encrypted digest form.

urbanlegend
  • 156
  • 1
  • 2
  • 3
    For those that come across this post, in v2.5.2 of Geoserver, changes made through the GUI, get saved to these config files automatically. That is to say there is no setting to "pipe the master password out to a file". – alexkb Oct 06 '14 at 07:26
  • I'm still confused by this, there is no "masterpw.info" plaintext file generated by default, so I can't change the master password nor access it by using the available encrypted passwd file (this defeats the purpose of a master password). – ideamotor Nov 05 '15 at 21:41
  • 1
    @ideamotor FYI, the default password is geoserver, see my answer for some more info. – Stijn Mar 14 '18 at 17:09
  • This answer is about the admin account, the question was about the root account (called "master"). It's confusing and maybe just a change in history but hopefully my comment will prevent you, dear reader, from getting more confused than you already are. – bugmenot123 Mar 27 '24 at 08:41
4

The documentation is outdated/wrong.

It's possible to dump the master password by navigating to Security > Passwords and clicking the Master password forgotten ? link. Turns out that the default password is the same as for the admin account: geoserver

Stijn
  • 177
  • 10