|
| 1 | +--- |
| 2 | +title: Updating Usernames and Passwords in OpenObserve |
| 3 | +description: >- |
| 4 | + Learn how to update usernames and passwords in OpenObserve via the UI or CLI. Includes steps for root password reset, best practices for credential rotation, and secure account management. |
| 5 | +--- |
| 6 | + |
| 7 | +# Updating Usernames and Passwords in OpenObserve |
| 8 | + |
| 9 | +Managing credentials in OpenObserve is critical for securing your observability platform. Incorrect or outdated credentials can block access, cause downtime, or expose your system to security risks. This page explains how to update usernames and passwords through the UI or CLI, and provides best practices for secure credential management. |
| 10 | + |
| 11 | + |
| 12 | +## Overview |
| 13 | + |
| 14 | +OpenObserve provides multiple ways to manage user credentials: |
| 15 | + |
| 16 | +* [UI-based](#updating-passwords-via-the-openobserve-ui) updates for users and roles |
| 17 | +* [CLI-based](#resetting-the-root-password-via-cli) root password reset if locked out |
| 18 | + |
| 19 | +## Updating Passwords via the OpenObserve UI |
| 20 | + |
| 21 | +Use the OpenObserve UI to manage users easily. |
| 22 | + |
| 23 | +**Steps:** |
| 24 | + |
| 25 | +1. Log in as an administrator. |
| 26 | +2. Navigate to **IAM → Users**. Click the **Edit** icon under **Actions** for the user you want to update. |
| 27 | +  |
| 28 | +3. Enable **Change Password** and enter the new password. |
| 29 | + {:style="height:300px"} |
| 30 | +4. Click **Save Changes**. |
| 31 | +5. Log out and verify that the updated credentials work. |
| 32 | + |
| 33 | +> **Tip:** You can also update user roles at the same time to enforce correct permissions. |
| 34 | +
|
| 35 | + |
| 36 | +## Resetting the Root Password via CLI |
| 37 | + |
| 38 | +If you are locked out of the root account, you can reset the root password from the CLI. |
| 39 | + |
| 40 | +**Steps:** |
| 41 | + |
| 42 | +1. Set environment variables for the new root credentials: |
| 43 | + ```bash |
| 44 | + export ZO_ROOT_USER_EMAIL="root@example.com" |
| 45 | + export ZO_ROOT_USER_PASSWORD="NewStrongPassword123" |
| 46 | + ``` |
| 47 | + |
| 48 | +2. Run the reset command from your OpenObserve installation directory: |
| 49 | + ```bash |
| 50 | + ./openobserve reset -c root |
| 51 | + ``` |
| 52 | + |
| 53 | +3. After the reset completes, log in with the updated root credentials. |
| 54 | + |
| 55 | +> **Note:** For Docker or Kubernetes deployments, set the environment variables inside the container or pod before running the reset command. |
| 56 | + |
| 57 | + |
| 58 | +## Best Practices |
| 59 | + |
| 60 | +* Update usernames, passwords, or roles via the UI whenever possible. |
| 61 | +* Update root and user passwords periodically; rotate API keys or service accounts. |
| 62 | +* Use long, complex, and unique passwords. Avoid reusing passwords across environments. |
| 63 | +* Back up your metadata database, especially before manual or DB-level changes. |
| 64 | +* Use dedicated users with least privilege; reserve root for emergencies. |
| 65 | + |
| 66 | +## Next Steps |
| 67 | + |
| 68 | +* Set up [alerts](../alerts/alerts.md) for failed logins to detect potential security issues. |
| 69 | +* Review [RBAC and role assignments](../identity-and-access-management/enable-rbac-in-openobserve-enterprise.md) to ensure least-privilege access. |
0 commit comments