Issue Onyx password issue admin

[bassie83]

We recently update our server with Plesk 12.x to Onyx. The upgrade was not so smooth and we had several issues we solved. But one issue is still going on and we have to solve this.

When we want to login to the admin panel we get the error: ERROR: Zend_Db_Adapter_Exception: SQLSTATE[HY000] [1045] Access denied for user 'admin'@'localhost' (using password: YES)

Server config: Centos 6.8

What we tried to do is to set SKIP-GRANT-Tables on in the my.cnf, restart mysql 5.7 to login in the admin panel. This works but we cannot reset the admin password. It looks something is not in sync (we didn't reset some passwords recently).

What we want to do is to reset the admin password, but with Onyx security it is not possible for us. With the CLI plesk bin admin we get an error if skip-grant-tables is on, and when we set it off we get an access denied on sql.

Anyone a suggestion?

 

[bassie83]

no one a solution?

I have root access on the server and with the option skip-grant-tables i can login on the web panel of plesk. But I need a solution to get it al working the normal way.

I have tried to reset the root account in mysql with ssh access with the command: UPDATE mysql.user SET authentication_string=PASSWORD('NEW-PASSWORD') WHERE User='root';

But I get a warning and nothing happens. I have all the access and I have a feeling I'm just 2 clicks away from the solution...

 

[Bitpalast]

Have you worked through https://support.plesk.com/hc/en-us/articles/213376789 ?

 

[bassie83]

Yes, I tried but : 213927525 How to retrieve Plesk admin password on Linux is not working with the newest version of plesk.

I tried the commands for one time login. I tried to use the plesk repair function, but it failed on the mysql root password. With the option skip-grant-tables on it doesn't work at all.

 

[Bitpalast]

Have you noticed that it is not about resetting the MySQL "root" user password, but the "admin" user password? In your previous post you mention that you have reset the "root" user password.
UPDATE mysql.user SET authentication_string=PASSWORD('NEW-PASSWORD') WHERE User='root';
with "NEW-PASSWORD" = content of /etc/psa/.psa.shadow
?

 

[bassie83]

I'm confused. I thought the Plesk admin@localhost on the web interface is a link to the root account on centos.

When I logged in with SSH root credentials on the service there is no admin account. Should I create one instead?

 

[Bitpalast]

You were not talking about a system account, but a database account:

... SQLSTATE[HY000] [1045] Access denied for user 'admin'@'localhost' (using password: YES)
... What we tried to do is to set SKIP-GRANT-Tables on in the my.cnf, restart mysql 5.7 to login in the admin panel.

If Plesk cannot access the database, the panel cannot work correctly. Your task is to give Plesk database access. This can normally be achieved by setting the correct password for the admin@localhost database user. That is why resetting the root@localhost password has no effect. The error message you have quoted claims that admin@localhost cannot login. This has nothing to do with any system user account. The "Access denied" message is a message from the database, not from the system.

 

[bassie83]

Ok, but my problem is that I don't know how to archieve this.

I think for some reason the admin account in mysql has a different password then i have. Solution would be to reset this password, but this is getting difficult because i cannot login to mysql. With the skip-grant-tables on mysql gives an error when I tried to change the password..... please help.

 

[Bitpalast]

Ok, but my problem is that I don't know how to archieve this.

... I have tried to reset the root account in mysql with ssh access with the command: UPDATE mysql.user SET authentication_string=PASSWORD('NEW-PASSWORD') WHERE User='root';

Have you tried
UPDATE mysql.user SET authentication_string=PASSWORD('NEW-PASSWORD') WHERE User='admin';
with "NEW-PASSWORD" = content of /etc/psa/.psa.shadow
?

 

[bassie83]

I tried it, but I get a warning.

(I can only log into mysql with the skip-grant-tables on)

 

[Bitpalast]

I notice that in your screenshot the password that you have entered is extremely short. This is not the password from /etc/psa/.psa.shadow as requested. The password stored in /etc/psa/.psa.shadow is much longer and looks similar to this example:
$AES-128-CBC$RiDcrzpC7NcmPGaB/sXNuQ==$LMd4rJVfhis5LYSoI7un1d==
Do not use this example as the password string. It is only an example to show the "look alike" of the password you need. Your real, individual password will be different. Do not post your password here. If you wonder how to find out what the content of /etc/psa/.psa.shadow is:
cat /etc/psa/.psa.shadow

- You tried to update the "admin" dataset but got a warning. This can have different reasons. Does the table "user" of the database "mysql" contain a dataset that is named "admin" or is that dataset missing?
> use mysql;
> select user from user WHERE user LIKE 'admin';
should return a field "user" with content "admin".

If it does not, the admin dataset is missing. If and only if the "admin" dataset is missing, execute this statement to create it, and after executing this statement do the password update again. Do not execute this statement when an "admin" dataset is present.
INSERT INTO `user` (`Host`, `User`, `Password`, `Select_priv`, `Insert_priv`, `Update_priv`, `Delete_priv`, `Create_priv`, `Drop_priv`, `Reload_priv`, `Shutdown_priv`, `Process_priv`, `File_priv`, `Grant_priv`, `References_priv`, `Index_priv`, `Alter_priv`, `Show_db_priv`, `Super_priv`, `Create_tmp_table_priv`, `Lock_tables_priv`, `Execute_priv`, `Repl_slave_priv`, `Repl_client_priv`, `Create_view_priv`, `Show_view_priv`, `Create_routine_priv`, `Alter_routine_priv`, `Create_user_priv`, `Event_priv`, `Trigger_priv`, `Create_tablespace_priv`, `ssl_type`, `ssl_cipher`, `x509_issuer`, `x509_subject`, `max_questions`, `max_updates`, `max_connections`, `max_user_connections`, `plugin`, `authentication_string`) VALUES
('localhost', 'admin', 'X', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', '', '', '', '', 0, 0, 0, 0, '', '');

Afterwards test to login to MySQL using the Plesk default password:
mysql -uadmin -p`cat /etc/psa/.psa.shadow`