New password.txt for admin not working

Andrew2 · April 20, 2022, 7:14pm

I have Lucee working with a basic test page, however I cannot get the admin page to accept the password.txt - nothing happens, so the admin is unusable and hence so is Lucee!

There are no errors in apache, tomcat or lucee logs (or javascript console).
I am using Tuckey urlrewriter which shows successful pass-through in catalina log

<rule>
   <name>RULE: ignore lucee/form.cfm</name>
    <from>^/lucee/form.cfm$</from>
    <to last="true">-</to>
</rule>

apache2 access.log
**** - - [20/Apr/2022:18:50:09 +0000] “POST /lucee/admin/server.cfm HTTP/1.1” 302 4199 “https://test2..com/lucee/admin/server.cfm?action=overview" “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.88 Safari/537.36”
**** - - [20/Apr/2022:18:50:09 +0000] “GET /lucee/admin/server.cfm?action=overview HTTP/1.1” 200 7121 "https://test2..com/lucee/admin/server.cfm?action=overview” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.88 Safari/537.36”
**** - - [20/Apr/2022:18:50:10 +0000] “GET /lucee/form.cfm HTTP/1.1” 200 21743 “https://test2.****.com/lucee/admin/server.cfm?action=overview” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.88 Safari/537.36”

catalina log

20-Apr-2022 18:26:45.124 INFO [ajp-nio-127.0.0.1-8009-exec-8] org.apache.catalina.core.ApplicationContext.log org.tuckey.web.filters.urlrewrite.UrlRewriter DEBUG: processing request for /lucee/form.cfm
20-Apr-2022 18:26:45.124 INFO [ajp-nio-127.0.0.1-8009-exec-8] org.apache.catalina.core.ApplicationContext.log org.tuckey.web.filters.urlrewrite.RuleBase DEBUG: RULE: ignore lucee/form.cfm (rule 0) run called with /lucee/form.cfm
20-Apr-2022 18:26:45.125 INFO [ajp-nio-127.0.0.1-8009-exec-8] org.apache.catalina.core.ApplicationContext.log org.tuckey.web.filters.urlrewrite.RuleBase DEBUG: matched “from”
20-Apr-2022 18:26:45.125 INFO [ajp-nio-127.0.0.1-8009-exec-8] org.apache.catalina.core.ApplicationContext.log org.tuckey.web.filters.urlrewrite.RuleBase DEBUG: ‘to’ is ‘-’, no substitution, passing through URL
20-Apr-2022 18:26:45.125 INFO [ajp-nio-127.0.0.1-8009-exec-8] org.apache.catalina.core.ApplicationContext.log org.tuckey.web.filters.urlrewrite.RuleExecutionOutput DEBUG: needs no substitution
20-Apr-2022 18:26:45.125 INFO [ajp-nio-127.0.0.1-8009-exec-8] org.apache.catalina.core.ApplicationContext.log org.tuckey.web.filters.urlrewrite.UrlRewriter DEBUG: rule is last

Don’t forget to tell us about your stack!

OS:Ubuntu 20.04 LTS
Java Version: openjdk version “11.0.14.1”
Tomcat Version: 9.0
Lucee Version: 5.3.8.206

Terry_Whitney · April 20, 2022, 7:19pm

The password is set at install time.

How was Lucee installed and why are you using a FQDN, try localhost.localdomain
/lucee/admin/server.cfm?action=security.access

bdw429s · April 20, 2022, 7:25pm

I’m a little confused by what you mean here. Are you seeing the login page which tells you to create the password.txt file or are you not even able to see that? Where are you placing the file? When you say “nothing happens”, that’s in response to… what? Like, what specific URL are you hitting and what is a screen shot of that you see on that page? Are you clicking buttons? I’m just not following.

Andrew2 · April 20, 2022, 7:53pm

I installed Lucee got a cfml test page working I then went to admin page says I need to put password.txt in /lucee-server/context/password.txt, did that and tried again.
I always use a FQDN and as I said before there are no errors in the logs.

bdw429s · April 20, 2022, 7:56pm

Did what? What exact specific folder did you place the password.txt file in?

Tried what again? Clicked a button? Loaded a page?

Andrew2 · April 20, 2022, 7:57pm

The login page appears perfectly with the message that I need to install the password.txt.
If you look at the logs you will see that the page just redirects back to itself when the import button is clicked.
the url:
https://************.com/lucee/admin/server.cfm?action=overview

Andrew2 · April 20, 2022, 8:00pm

/var/www/vhosts/*********/www/WEB-INF/lucee/context/password.txt

tried clicking button again, hard reload of page.

bdw429s · April 20, 2022, 8:01pm

Ok, I can tell what you’re doing wrong. Take a good hard look at the folder you placed the file in and compare that to the folder you were instructed to place the file in. See the difference? Also, including these details in the first message would have speeded this along

Andrew2 · April 20, 2022, 8:11pm

Sorry! as you suggested: /usr/local/tomcat/lucee-server/context/password.txt
Thank you for the prompt response.

BlackEnder · May 11, 2023, 11:13am

The filename just have to be PASSWORD
Do not add the .txt.
The popup at the import-file screen needs to be changed.
Thanks.

Zackster · May 11, 2023, 12:10pm

no, it’s definately password.txt

github.com

lucee/Lucee/blob/6.0/core/src/main/java/lucee/runtime/config/ConfigWebFactory.java#L645


      
          			// create salt
          			root.setEL("salt", salt = CreateUUID.invoke());
          			rtn = true;
          		}
          
          
		// no password yet
          		if (!essentialOnly && config instanceof ConfigServer && StringUtil.isEmpty(root.get("hspw", ""), true) && StringUtil.isEmpty(root.get("adminhspw", ""), true)
          				&& StringUtil.isEmpty(root.get("pw", ""), true) && StringUtil.isEmpty(root.get("adminpw", ""), true) && StringUtil.isEmpty(root.get("password", ""), true)
          				&& StringUtil.isEmpty(root.get("adminpassword", ""), true)) {
          			ConfigServer cs = (ConfigServer) config;
          			Resource pwFile = cs.getConfigDir().getRealResource("password.txt");
          			if (pwFile.isFile()) {
          				try {
          					String pw = IOUtil.toString(pwFile, (Charset) null);
          					if (!StringUtil.isEmpty(pw, true)) {
          						pw = pw.trim();
          						String hspw = new PasswordImpl(Password.ORIGIN_UNKNOW, pw, salt).getPassword();
          						root.setEL("hspw", hspw);
          						pwFile.delete();
          						rtn = true;
          					}

andreas · May 11, 2023, 12:30pm

@BlackEnder: Check your OS file viewing setting. I’m pretty sure that it is omitting the file extension, thus, you won’t see any of the “.txt”. If the OS is set to omit the extension and you are adding “.txt”, you’ll be creating a file named “password.txt.txt”, with only “password.txt” being shown. Check and change the omitting file extension functionality of your OS.

BlackEnder · May 11, 2023, 12:57pm

I tried the password.txt for 30 minutes. it was not working. And then i switch to the password-file with a different passwordtext.
When i tried it with the password-file with also a different word as text it worked.

I just checked the filename. You are correct. it was password.txt.txt

Zackster · May 11, 2023, 2:00pm

password.txt-final.final-3.final.txt.txt

so many dumb defaults in windows! what i hate the most is testing the windows installer using windows sandbox with all the silly defaults in 11 like the context menu without even cut n paste

andreas · May 11, 2023, 2:48pm

it gets even weirder if you look at the real file names, I mean the old funky DOS name stuff .

carehart · May 11, 2023, 3:18pm

Zack, you may know this but I’ll point out for those who don’t: when in Windows 11 it seems the copy/paste options are NOT there in the context menu (like in the Windows File Explorer), look for them now as icons at the bottom or top of the list of options. This is someone’s idea of improvement.

I mostly just use keyboard shortcuts so don’t even notice it, but in my consulting doing screenshares all day with folks, I often help them deal with such changed behavior.

And there are ways to alter it (such as via registry tweaks), but in my cf/lucee troubleshooting consulting such problems like these are not my client’s focus, so I offer the quick solution and we move on. A Google search will find both such “solutions” to this and plenty of discussion about how annoyed many people are with it, as the Windows UI evolves (in competition with MacOS, etc.)

Hamza_Younas · May 18, 2023, 11:56am

Thanks a lot it saved my time.