Problem: The key of the TP internal account cannot be opened on this server, so no object can be checked or repaired....

[Saueee]

TeamPass version

3.2.2.8

Environment

LAMP / manual installation

Your question

Instance is working since years. New entries generated by a user can be seen by all others that have access rights.
However one user cannot open the passwords and his "Shared Keys" are shown as 0 in the admin dashboard.
If I try to use "Restore missing sharekeys" tool i will get the following error...
How can I fix this?

Before posting

• This is not a reproducible bug (otherwise → Issues)

[Saueee]

So it seems that the TP users pw in the database is a different string than in the SECRETFILE....
This is the case since the oldest backup of the instance 1 year ago. (Instance is running since ~3 years)
How is it even possible that this works?
Is there a procedure to get this fixed?
@nilslaumaille

[nilsteampassnet]

Hello @Saueee,

Thanks for the report and for digging into it. Comparing the TP user's pw column with the SECUREFILE does not tell anything, though: that column holds the TP password encrypted with the instance key, so it never looks like the key itself. Your instance key is very likely the right one, otherwise TeamPass could not even connect to the database: the database password in settings.php is encrypted with the same key.

What is going on

The internal TP account holds a reference key on every object, and its private key can no longer be opened on your server. Most of TeamPass does not need it, which is why everything looked fine for so long: a new item reaches every user through their public keys alone. But every key generation for a user goes through it: a new account, a password reset, a "Generate new keys". The user then gets a key pair that opens nothing created before, which is exactly the user showing 0 sharekeys.

Until this is repaired, please do not generate new keys for any user who can still read their items: they would end up in the same state.

Could you run this diagnostic and post its output?

From the TeamPass root folder, as the web server user:

php app/scripts/migrate_tp_user_to_v3.php --dry-run

It only reads (--dry-run is also the default), and it prints no secret. The step where it stops tells the cause:

• [2] ... Failed to decrypt TP_USER's password: the TP password was encrypted with another instance key, typically when the database was imported into a new installation;
• [3] ... no private key in user_private_keys: the account has no current private key;
• [3] ... Decryption failed: the stored private key does not open with its password.

Fix

The next release adds to Tools → Restore missing sharekeys a diagnosis of the internal account key with the cause, and a Rebuild the internal account keys action for this exact case. It gives the account a new key pair; the repair then recreates its reference keys from the keys of a user who can open the items (yours by default) and gives every user their missing keys. TeamPass will also refuse a key generation that would leave a user with nothing, and the dashboard will flag the problem.
I'll confirm here once it is released.