Movatterモバイル変換


[0]ホーム

URL:


CFEngine documentation homepage

Reset administrative credentials

Suggest changes
Table of contents

The defaultadmin user can be reset to defaults using the following SQL.

cfsettings-setadminpassword.sql
INSERTINTO"users"("username","password","salt","name","email","external","active","roles","changetimestamp")SELECT'admin','SHA=aa459b45ecf9816d472c2252af0b6c104f92a6faf2844547a03338e42e426f52','eWAbKQmxNP','admin','admin@organisation.com',false,'1','{admin,cf_remoteagent}',now()ONCONFLICT(username,external)DOUPDATESETpassword='SHA=aa459b45ecf9816d472c2252af0b6c104f92a6faf2844547a03338e42e426f52',salt='eWAbKQmxNP';

To reset the CFEngine admin user run the following sql as root on your hub

command
psql cfsettings < cfsettings-setadminpassword.sql

Internal credentials

Two internal credentials are present in an Enterprise Hub: Mission Portal API credentials and CFE Robot credentials.

If these credentials are not synchronized between configuration files and database, errors can occur in the Mission Portal UI as well as in hub policy.

Rotating these credentials is optional and can be performed at an interval based on your specific security policy.

Mission Portal API credentials

These credentials enable Mission Portal to authenticate to the backend API.

If these credentials are not synchronized properly you can get "Authentication failed" messages in the Mission Portal UI.

To rotate these credentials execute the following shell script on the hub and then restart the system withsystemctl restart cfengine3 or similar.

rotate_mp_credentials.sh
#!/usr/bin/env bashpwgen(){  ddif=/dev/urandombs=1024count=12>/dev/null| tr -dc'a-zA-Z0-9'| fold -w$1| head -n1}PREFIX=/var/cfengine# adjust if needed, this is the defaultMP_PW=`pwgen40`SECRETS_FILE="$PREFIX/httpd/secrets.ini"# 3.16 version and newerif[ -f"$SECRETS_FILE"];then  sed -i"/mp_client_secret/s/=.*/=$MP_PW/"$SECRETS_FILEelseAPPSETTINGS_FILE="$PREFIX/httpd/htdocs/application/config/appsettings.php"  sed -i"/MP_CLIENT_SECRET/c\$config['MP_CLIENT_SECRET'] = '$MP_PW';"$APPSETTINGS_FILEfiecho"UPDATE oauth_clients SET client_secret = '$MP_PW' where client_id = 'MP'"|$PREFIX/bin/psql cfsettings

CFE Robot credentials

These credentials are used by PHP CLI scripts to authenticate to the backend API.

If these credentials are out of sync or incorrect you will see errors like "500 Internal Server Error" in/var/cfengine/httpd/logs/application/ logs.

Execute the following shell script to rotate and synchronize the CFE Robot credentials and then restart the system withsystemctl restart cfengine3 or similar.

rotate_cfrobot_credentials.sh
#!/usr/bin/env bashpwgen(){  ddif=/dev/urandombs=1024count=12>/dev/null| tr -dc'a-zA-Z0-9'| fold -w$1| head -n1}PREFIX=/var/cfengine# adjust if needed, this is the defaultpwhash(){echo -n"$1"|"$PREFIX/bin/openssl" dgst -sha256| awk'{print $2}'}CFE_ROBOT_PW=`pwgen40`SECRETS_FILE="$PREFIX/httpd/secrets.ini"# 3.16 version and newerif[ -f"$SECRETS_FILE"];then  sed -i"/cf_robot_password/s/=.*/=$CFE_ROBOT_PW/"$SECRETS_FILEelseCFROBOT_FILE="$PREFIX/httpd/htdocs/application/config/cf_robot.php"  sed -i"/CFE_ROBOT_PASSWORD/c\$config['CFE_ROBOT_PASSWORD'] = \"$CFE_ROBOT_PW\";"$CFROBOT_FILEfiCFE_ROBOT_PW_SALT=`pwgen10`CFE_ROBOT_PW_HASH=`pwhash"$CFE_ROBOT_PW_SALT$CFE_ROBOT_PW"`echo"UPDATE users SET password = 'SHA=$CFE_ROBOT_PW_HASH', salt = '$CFE_ROBOT_PW_SALT' WHERE username = 'CFE_ROBOT'"|"$PREFIX/bin/psql" cfsettings

Still need help?

Chat Ask a question on Github Mailing list
Version 
master3.24 (LTS)3.21 (LTS)view all versions

[8]ページ先頭

©2009-2025 Movatter.jp