How to unlock admin accounts

Troubleshooting
1

CMK version: Community 24.04
OS version: Ubunt24.04

Hi All,

Accidentally all my admin account are unable to login, even the cmkadmin account is locked. I tried below way to add new user aaa/bbb/testadmin, but no luck

sudo omd su mysite
htpasswd -m etc/htpasswd bbb
input password
vi ~/etc/check_mk/multisite.d/wato/users.mk ,to add the new user in the the users.mk file , but every time try to login it shows invalid username/password.

Please help. thanks

image
image1049×380 19.2 KB

image
image385×297 7.41 KB

2

Instead of htpasswd, you should use (as siteuser) cmk-passwd to reset a cmk user account.

  • Glowsome
3 
xxx@yyy:~$ sudo omd su heute
OMD[heute]:~$ cmk-passwd cmkadmin

That’s the best way to set the password

EDIT: As Michael said already.

4

Thanks, but it doesn’t work for me . Does this command cmk-passwd cmkadmin reset the password and unlock the account ?

5

Ah, sorry. I didn’t see that the specific account was also locked. Just saw all the others, which were not locked.

If you have another admin account, you can use that one to unlock it in the UI by setting in the User settings for that user: disable the login to this account to No.

On CLI:

  1. ~/etc/check_mk/multisite.d/wato/users.mk: Set 'locked': False
  2. Set a new password using cmk-passwd cmkadmin (alternatively remove ! from etc/htpasswd)
  3. echo 0 > ~/var/check_mk/web/cmkadmin/num_failed_logins

You do not neccesarily need to set num_failed_logins to 0, it will do so automatically if you enter the right password

6

yes, I have another admin account but unfortunately it’s locked too. How can I unlock and reset the password from CLI. Thanks

7

I’ve tried changed the Lock to “False” for the other admin account, but as long as I try login in GUI just 1 time and it says in correct password , then I re-check the users.mk , the Locked already changed to “True”, so it means just 1 failed login and the Locked changes to “True”. So weird

8

Did you follow all my steps? Because if you don’t change the password, in ~/etc/htpassword before the user you will still see a !. If that is there, the account will remain locked no matter what is in users.mk

9

I managed to fix the issue by another way, change a normal user from “user” to “admin” then set the password with command cmk-passwd xxxx, then login to GUI to reset the locked account.

image

Thanks for helping

10

Clever idea, that works of course as well and is way less work :slight_smile: