Unfortunately I forgot what my username and password is to login to CouchDB.
Here is a similar question.
I have looked within the local.ini file at C:\Program Files (x86)\Apache Software Foundation\CouchDB\etc\couchdb
password = somepassword
username = password
However I am unable to login through lclhst :5984/_utils/index.html login.
I have also tried the config.dat file at /opt/couchbase/var/lib/couchbase/config/config.dat
Are there other places where the username or password could be? It seems there is a hierarchy of files that take precedence over each other, though I could not find this in the docs.
Thanks
Your server credentials are in the local.ini whose full path can be found using couchdb -c, in the [admins] section, but the password is hashed. It looks like this:
[admins]
username = -pbkdf2-70349775b6e7674de7fd45ff08675550046535c9,f18db0cd9fd933c0c610532e965ef1de,10
If you forgot the password, just replace the hash with your new password and restart CouchDB. It will be rehashed immediately. Example:
[admins]
username = newPassw0rd
relay from: http://silviud.blogspot.com/2012/10/couchbase-recover-web-console-password.html
(Note: top 4 lines only)
/opt/couchbase/bin/erl \
-noinput -eval \
'case file:read_file("/opt/couchbase/var/lib/couchbase/config/config.dat") of {ok, B} -> io:format("~p~n", [binary_to_term(B)]) end.' \
-run init stop | grep cred
Related
I have deployed a new OKD cluster (3.11) and as Identity Provider I have selected LDAPPasswordIdentityProvider
The configuration goes like this:
openshift_master_identity_providers=[{'name': 'idm', 'challenge': 'true', 'login': 'true', 'kind': 'LDAPPasswordIdentityProvider', 'attributes': {'id': ['dn'], 'email': ['mail'], 'name': ['cn'], 'preferredUsername': ['uid']}, 'bindDN': 'uid=service,cn=users,cn=accounts,dc=myorg,dc=com', 'bindPassword': 'reallysecurepasswordhere', 'insecure': 'false', 'url': 'ldaps://idm.myorg.com:636/dc=myorg,dc=com?uid??(memberof=cn=openshift,cn=accounts,dc=myorg,dc=com)'}]
I have tried two dozens of possibilities with this URL.
On the logs I always get:
I0528 15:23:38.491659 1 ldap.go:122] searching for (&(objectClass=*)(uid=user1))
E0528 15:23:38.494172 1 login.go:174] Error authenticating "user1" with provider "idm": multiple entries found matching "user1"
I don't get it why is the filter showing as (&(objectClass=*)(uid=... appears as the filter isn't being parsed correctly, despite the URL being as above.
I also checked the master-config.yaml and it is correct as my ini file.
If I do ldapsearch I get the expected results:
$ ldapsearch -x -D "uid=service,cn=users,cn=accounts,dc=myorg,dc=com" -W -H ldaps://idm.myorg.com -s sub -b "cn=accounts,dc=myorg,dc=com" '(&(uid=user1)(memberof=cn=openshift,cn=groups,cn=accounts,dc=myorg,dc=com))' uid
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=accounts,dc=myorg,dc=com> with scope subtree
# filter: (&(uid=user1)(memberof=cn=openshift,cn=groups,cn=accounts,dc=myorg,dc=com))
# requesting: uid
#
# user1, users, accounts, myorg.com
dn: uid=user1,cn=users,cn=accounts,dc=myorg,dc=com
uid: user1
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
The LDAP Server is FreeIPA.
Help please!
Ok, I found the solution to the problem.
I assumed ... incorrectly ... that running the playbook openshift-ansible/playbook/openshift-master/config.yml would restart the openshift-master API.
It doesn't.
I noticed this when, instead of editing my ini inventory where I have this set and running config, I started editing directly on /etc/origin/master/master-config.yaml and using master-restart api to restart the API.
Several URL alterations (many incorrect actually) had never been ran. Config uploaded them, but the master api doesn't restart, so new config doesn't go in place, and I kept hitting the wall.
I was able to configure mbsync and mu4e in order to use my gmail account (so far everything works fine). I am now in the process of using mu4e-context to control multiple accounts.
I cannot retrieve emails from my openmailbox account whereas I receive this error
Reading configuration file .mbsyncrc
Channel ombx
Opening master ombx-remote...
Resolving imap.ombx.io... ok
Connecting to imap.ombx.io (*.*.10*.16*:*9*)...
Opening slave ombx-local...
Connection is now encrypted
Logging in...
IMAP command 'LOGIN <user> <pass>' returned an error: NO [AUTHENTICATIONFAILED] Authentication failed.
In other posts I've seen people suggesting AuthMechs Login or PLAIN but mbsync doesn't recognizes the command. Here is my .mbsyncrc file
IMAPAccount openmailbox
Host imap.ombx.io
User user#openmailbox.org
UseIMAPS yes
# AuthMechs LOGIN
RequireSSl yes
PassCmd "echo ${PASSWORD:-$(gpg2 --no-tty -qd ~/.authinfo.gpg | sed -n 's,^machine imap.ombx.io .*password \\([^ ]*\\).*,\\1,p')}"
IMAPStore ombx-remote
Account openmailbox
MaildirStore ombx-local
Path ~/Mail/user#openmailbox.org/
Inbox ~/Mail/user#openmailbox.org/Inbox/
Channel ombx
Master :ombx-remote:
Slave :ombx-local:
# Exclude everything under the internal [Gmail] folder, except the interesting folders
Patterns *
Create Slave
Expunge Both
Sync All
SyncState *
I am using Linux Mint and my isync is version 1.1.2
Thanks in advance for any help
EDIT: I have run a debug option and I have upgraded isync to version 1.2.1
This is what the debug returned:
Reading configuration file .mbsyncrc
Channel ombx
Opening master store ombx-remote...
Resolving imap.ombx.io... ok
Connecting to imap.ombx.io (*.*.10*.16*:*9*)...
Opening slave store ombx-local...
pattern '*' (effective '*'): Path, no INBOX
got mailbox list from slave:
Connection is now encrypted
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Openmailbox is ready to
handle your requests.
Logging in...
Authenticating with SASL mechanism PLAIN...
>>> 1 AUTHENTICATE PLAIN <authdata>
1 NO [AUTHENTICATIONFAILED] Authentication failed.
IMAP command 'AUTHENTICATE PLAIN <authdata>' returned an error: NO [AUTHENTICATIONFAILED] Authentication failed.
My .msyncrc file now contains these options instead
SSLType IMAPS
SSLVersions TLSv1.2
AuthMechs PLAIN
At the end, the solution was to use the correct password. Since openmailbox uses an application password for third-party e-mail clients I was using the wrong (original) password instead of the application password.
I'm using the Debian image for the BBB from here: Debian (BeagleBone Black - 2GB eMMC) 2014-05-14
This image has the Cloud9 IDE built-in. It works quite nicely for my purposes, but I can't figure out how to add a password. Anyone on the network can go to 11.22.33.44:3000 (not the actual IP address) and the IDE will automatically log them in as "John Doe" (No password requested).
Is there a way to request a user name and password when logging into Cloud9? I'm ok if the browser saves the password, but it should ask at least once.
I just found out the solution.
To set a default username and password:
Open the file /opt/cloud9/build/standalonebuild/configs/standalone.js.
Locate the following code block. (Should be at the top of the file)
if (!optimist.local) {
optimist
.boolean("t")
.describe("t", "Start in test mode")
.describe("k", "Kill tmux server in test mode")
.default("b", false)
.describe("b", "Start the bridge server - to receive commands from the cli")
.default("w", config.workspaceDir)
.describe("w", "Workspace directory")
.alias("p", "port")
.default("port", process.env.PORT || config.port)
.describe("port", "Port")
.alias("d", "debug")
.default("debug", false)
.describe("debug", "Turn debugging on")
.alias("l", "listen")
.default("listen", process.env.IP || config.host)
.describe("listen", "IP address of the server")
.boolean("help")
.describe("workspacetype")
.alias("ws", "workspacetype")
.describe("readonly", "Run in read only mode")
.alias("ro", "readonly")
.describe("packed", "Whether to use the packed version.")
.boolean("packed")
.default("packed", config.packed)
.alias("a", "auth")
.describe("auth", "Basic Auth username:password")
.default("auth", ":")
.describe("collab", "Whether to enable collab.")
.default("collab", config.collab)
// #lennartcl this should be moved
.describe("lb.fileserver", "LogicBlox file server Url")
.default("lb.fileserver", config.logicblox && config.logicblox.fileServerURL);
}
At the line .default("auth", ":"), type in the username and password you'd like to use in the format of username:password, e.g. .default("auth", "user:pass")
You should be all set! Try accessing 11.22.33.44:3000, and there should be a pop-up prompting for username and password.
On a side note, if you wish to change the profile name (the default "John Doe"):
Open the file /opt/cloud9/build/standalonebuild/settings/standalone.js.
Locate the following code block.
user: {
uid: 1,
name: "johndoe",
fullname: "John Doe",
email: "johndoe#example.org",
pubkey: null
},
Change the the value of fullname to the username you want.
Reboot BeagleBone Black and go to 11.22.33.44:3000, and you shall see updated profile name on your Cloud9 IDE.
When starting Cloud9 from the command line (at least with the latest version) you can use the:
-a user:pass
where "user" is the user name it will permit and "pass" is the password for that user. It uses basic web authentication.
Other parameters for Cloud9 are:
-l [ip addresses to accept] Use 0.0.0.0 to accept all IP addresses.
-w path/to/project/to/edit
-p port on which to operate
As for the particular script/service that is used to start Cloud9 in which to tweak the startup parameters, I'm not sure. You might try this information for where to start looking:
https://dcinglis.wordpress.com/2014/09/08/running-a-startup-script-on-a-beaglebone-black/
I have a basic LDAP setup without SSL configured. Users are able to login but not able to change their password using passwd command. I have gone though many blogs but no luck. I have disabled selinux and iptables.
Any help on this will be much appreciated.
Details below,
OS: CentOS6.5
LDAP version: openldap-servers-2.4.23-34.el6_5.1.x86_64
Client version: openldap-clients-2.4.23-34.el6_5.1.x86_64
Output from the terminal when trying to change the password:
[servername ~]$ passwd
Changing password for user dkrishna.
Enter login(LDAP) password:
New password:
Retype new password:
LDAP password information update failed: Insufficient access
passwd: Authentication token manipulation error
Below are the logs,
==> /var/log/secure <==
Oct 8 09:31:33 passwd: pam_unix(passwd:chauthtok): user "dkrishna" does not exist in /etc/passwd
Oct 8 09:31:42 passwd: pam_unix(passwd:chauthtok): user "dkrishna" does not exist in /etc/passwd
==> /var/log/messages <==
Oct 8 09:31:42 passwd: pam_ldap: ldap_modify_s Insufficient access
ACL's configured as below,
database config
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by * none
database monitor
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
by dn.exact="cn=admin,dc=tibbr,dc=com" read
by * none
access to attrs=userPassword
by self write
by anonymous auth
by users none
access to * by * read
I found the solution:
Add the following two lines to the end of the file: oclDatabase\=\{2\}bdb.ldif
olcAccess: {0}to attrs=userPassword by self write by dn.base="cn=Manager,dc=domain,dc=com" write by anonymous auth by * none
olcAccess: {1}to * by dn.base="cn=Manager,dc=domain,dc=com" write by self write by * read
bye
Looks like slapd.conf is deprecated when OCL database is configured.
Observe the following snippet from OCL configuration guide:
"From the time you have run the conversion the slapd.conf file is redundant. When loading slapd looks for the configuration directory (default slapd.d) and reads its configuration files from there and initializes the OLC (cn=config) DIT. If the slapd.d directory is not found then slapd looks for slapd.conf."
I have been doing a lot of research on ssh (openssh) and radius.
What I want to do:
SSH in to equipment with credentials (username and password) stored in either on a radius server or ldap store. I have been reading online and some people point to having an ldap server running in the background of your radius server. This will work, but will only work if the user is found in the local machine.
The problem:
Is there a way for me to ssh (or telnet) in to my equipment by logging in via a radius server that contains the credentials? if not is there a way for the client (the machine I am trying to connect to) get an updated list of credentials and store it locally from a central location (whether it be a radius server or an sql database etc).
I have been able to connect via Radius but only on accounts that are local, but for example if I try to connect with an account that does not exist locally (client-wise) I get "incorrect"
Here is the radius output:
Code:
rad_recv: Access-Request packet from host 192.168.4.1 port 5058, id=219, length=85 User-Name = "klopez"
User-Password = "\010\n\r\177INCORRECT"
NAS-Identifier = "sshd"
NAS-Port = 4033
NAS-Port-Type = Virtual
Service-Type = Authenticate-Only
Calling-Station-Id = "192.168.4.200"
Code:
[ldap] performing user authorization for klopez[ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> klopez
[ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=klopez)
[ldap] expand: dc=lab,dc=local -> dc=lab,dc=local
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] performing search in dc=lab,dc=local, with filter (uid=klopez)
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
[ldap] userPassword -> Cleartext-Password == "somepass"
[ldap] userPassword -> Password-With-Header == "somepass"
[ldap] looking for reply items in directory...
[ldap] user klopez authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Config already contains "known good" password. Ignoring Password-With-Header
++[pap] returns updated
Found Auth-Type = PAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group PAP {...}
[pap] login attempt with password "? INCORRECT"
[pap] Using clear text password "somepass"
[pap] Passwords don't match
++[pap] returns reject
Failed to authenticate the user.
WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
Using Post-Auth-Type Reject
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> klopez
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 3 for 1 seconds
I also have pam_radius installed, and its working (can log in on a account that exists locally). Although I read this and do not know if this is 100% accurate:
http://freeradius.1045715.n5.nabble.com/SSH-authendication-with-radius-server-fails-if-the-user-does-not-exist-in-radius-client-td2784316.html
and
http://fhf.org/archives/713
tl:dr:
I need to ssh into a machine that does not have a user/pass locally and that combination will be stored remotely, such as a radius server or ldap.
please advise
P.S.
The solution is preferable using radius server or ldap but not necessary. If there is an alternate please advise.
Thanks,
Kevin
You can configure SSH to authenticate directly against an LDAP server using PAM LDAP.
I've set it up myself on Debian Systems:
https://wiki.debian.org/LDAP/PAM
https://wiki.debian.org/LDAP/NSS
You need to have both PAM and NSS to get SSH working. You also need to enable PAM in your SSH configuration. Install the libnss-ldapd libpam-ldapd and nslcd packages on Debian (or Ubuntu) system.