Add the ability to reset the admin password if the user forgot it #512

liyaka · 2017-01-19T21:07:59Z

No description provided.

deviantony · 2017-01-20T20:16:11Z

@liyaka You can only change the admin password via the UI. What do you mean by option?

luckydonald · 2017-01-21T01:18:59Z

Delete the data folder / volume, probably.

liyaka · 2017-01-22T12:09:04Z

@deviantony if the user forgot the password, there is no option (in UI at least ) to reset the password

deviantony · 2017-01-22T20:22:43Z

@liyaka no, there is no way to reset the admin password if you forgot it at the moment. We'll track this evolution here.

hammady · 2017-11-08T11:11:44Z

Maybe the --admin-password flag could be overloaded. Currently, it skips admin user creation if it exists. What I suggest is to reset the admin password if a user was found. Security wise, a user with access to recreate the container should be given access to reset the password as well.
This is very convenient instead of going to all manager nodes, deleting volumes then recreating the container (or service)

deviantony · 2017-11-08T14:20:27Z

I don't think this is the way to go as the admin user can also change his password from within the UI. Meaning that these changes would be overwritten after a restart of the container. That would probably cause troubles.

hammady · 2017-11-09T02:17:41Z

You are right. What about creating another flag? It could be run as a one time command (using docker run with the same data volume or docker exec).

…

On Wed, Nov 8, 2017 at 5:20 PM Anthony Lapenna ***@***.***> wrote: I don't think this is the way to go as the admin user can also change his password from within the UI. Meaning that these changes would be overwritten after a restart of the container. That would probably cause troubles. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#512 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA0PJzcA-SQueDf_Cy8q05XGXyEx7b0Nks5s0biwgaJpZM4LomtY> .

luckydonald · 2017-11-10T18:21:34Z

How about --reset-password resets you to the choose password for admin gui?

colegatron · 2018-02-15T09:20:52Z

How about --force-create-user in order to be able to recreate the admin user to let reset the password if administrator exists?

In my case I try to automate as much as possible everything, meaning having to change a password through an UI is usually not an option.

Also the deletion of the data volume/folder is either an option because you'll end up loosing your config, don't you?

darkpixel · 2018-03-16T15:59:36Z

Yeah, deleting the volume causes every stack you have deployed to show up as 'external' and you can't do anything with them. I really don't want to destroy all the stacks in my cluster only to paste them back into portainer to spin them up again.

luckydonald · 2018-04-04T15:49:40Z

The web gui is able to set it. So the node package should just expose a command to run to do the same, with shell access instead of being logged on.

docker-compose exec portainer  npm run portainer-reset-password

I'm not into node that much, but I've seen this be done somehow like this.

Codelica · 2018-10-26T14:54:38Z

An older issue here, but we have the need for this as well. Basically wanting to always control the admin password via startup flag(s). Something like an extra --force-* flag seems safe enough, and certainly a better option the loosing config and stack control.

sisiliao · 2018-10-31T15:32:48Z

Is there a workaround on this ?? something like reseting password if someone forget, not through the gui tho??

pcgeek86 · 2018-11-26T18:40:49Z

I forgot my password and would like an option to reset it. I suppose I can start a new Portainer container, but that seems counter-intuitive to me. Thanks for the great work you guys are doing on this project! I can't believe I didn't start using this earlier.

ghost · 2019-01-12T12:01:29Z

My temporary solution with boltbrowser
Stop portainer, edit portainer.db with boltbrowser and start portainer.

Works great - but a flag could be better.

Duvel · 2019-01-14T19:31:16Z

@gisselmann that worked for me as well after the upgrade to 1.20.0 broke my LDAP logon.

For others: remove all users in the bolt db and portainer will ask again for a password.

kongh · 2019-08-19T05:51:23Z

Today some one (a attack application)is attacking my portainer , because he gueess my password and got the jwt token and not expired, after I change my simple password , but he changed it quickly.

How to improve Safety ？This is a problem.

Add human validation for the change password api is necessary.

joseluisq · 2019-08-19T07:50:43Z

@gisselmann @Duvel both options didn't work for me. I always got: "access denied to resource".
We are using LDAP.
Unfortunately the only solutions was to deploy a new docker stack without LDAP and re-entry our stack configurations.

Rogiel · 2019-08-19T17:26:55Z

Today some one (a attack application)is attacking my portainer , because he gueess my password and got the jwt token and not expired, after I change my simple password , but he changed it quickly.

How to improve Safety ？This is a problem.

Add human validation for the change password api is necessary.

I have also noticed an attack starting today. The attacker is probably not gaining access to your account. What seems to be happening is that Portainer is blocking authentication after 12 failed attempts. The bot is still trying to guess the password after that and authentication remains locked and since authentication is disabled you can't access Portainer.

I would recommend you to block port 9000 and use a frontend server with nginx (or apache if you prefer it). Better yet, block to everything and everyone but your IP address.

2019/08/19 17:15:58 Instance already has defined endpoints. Skipping the endpoint defined via CLI.
2019/08/19 17:15:58 Starting Portainer 1.21.0 on :9000
2019/08/19 17:15:58 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:58 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:58 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:58 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:16:00 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:16:00 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:16:00 http error: Access denied (err=Access denied to resource) (code=403)

kongh · 2019-08-19T17:59:15Z

yeah, i cannot agree more. I had changed the port of portainer and the password , because of my weak password. this is an attack event, disabled the whole authentication is not the best idea, human validation may be can resovle it.

this attack effected our applicatiins deploy in japan ,korea, china servers

liuzhaowei55 · 2019-11-29T04:10:34Z

Today some one (a attack application)is attacking my portainer , because he gueess my password and got the jwt token and not expired, after I change my simple password , but he changed it quickly.
How to improve Safety ？This is a problem.
Add human validation for the change password api is necessary.

I have also noticed an attack starting today. The attacker is probably not gaining access to your account. What seems to be happening is that Portainer is blocking authentication after 12 failed attempts. The bot is still trying to guess the password after that and authentication remains locked and since authentication is disabled you can't access Portainer.

I would recommend you to block port 9000 and use a frontend server with nginx (or apache if you prefer it). Better yet, block to everything and everyone but your IP address.
2019/08/19 17:15:58 Instance already has defined endpoints. Skipping the endpoint defined via CLI.
2019/08/19 17:15:58 Starting Portainer 1.21.0 on :9000
2019/08/19 17:15:58 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:58 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:58 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:58 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:15:59 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:16:00 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:16:00 http error: Invalid credentials (err=Unauthorized) (code=422)
2019/08/19 17:16:00 http error: Access denied (err=Access denied to resource) (code=403)

The same question.

soydepr · 2020-02-20T21:18:04Z

My temporary solution with boltbrowser
Stop portainer, edit portainer.db with boltbrowser and start portainer.

Works great - but a flag could be better.

where is file located

tasz · 2020-03-09T16:17:30Z

where is file located
/var/lib/docker/volumes/portainer_data/_data

tasz · 2020-03-09T16:18:32Z

if you add this hash using boltbrowser it will ask to reset password.
$2b$10$5Zv9.JQx3QJ0fVgt8TBnnuSxtNq9lKpTRtciEQknB2U7woYABBauS

mangei · 2020-03-20T17:49:21Z

@tasz what is this hash? I couldn't find anything. can you please link to the source/documentation?

mnasafi · 2020-04-30T00:59:07Z

For Open Media Vault (OMV 5+) users, the procedure to reset Portainer password is:

Remove "Portainer" in OMV-Extras --> Docker Tab --> Portainer --> Remove
SSH login as root / sudo user into your OMV server and execute the command:
docker volume rm portainer_data
Reinstall Portainer under the Docker Tab in OMV-Extras

You might need to clear your browser cache or open a new private window before accessing the portainer web interface.

Note: portainer interface runs on Port 9000. e.g. http://Server-IP-address:9000

rjgonza · 2020-04-30T15:11:43Z

For Open Media Vault (OMV 5+) users, the procedure to reset Portainer password is:
1. Remove "Portainer" in OMV-Extras --> Docker Tab --> Portainer

2. Login into SSH terminal as root user and execute the command: ' docker volume rm portainer_data '

3. Reinstall Portainer under the Docker Tab in OMV-Extras
You might need to clear your browser cache or open a new private window before accessing the portainer web interface.

Note: portainer interface runs on Port 9000. e.g. http://Server-IP-address:9000

Won't this also wipe out your data?

mnasafi · 2020-05-16T12:00:16Z

For Open Media Vault (OMV 5+) users, the procedure to reset Portainer password is:
1. Remove "Portainer" in OMV-Extras --> Docker Tab --> Portainer

2. Login into SSH terminal as root user and execute the command: ' docker volume rm portainer_data '

3. Reinstall Portainer under the Docker Tab in OMV-Extras
You might need to clear your browser cache or open a new private window before accessing the portainer web interface.
Note: portainer interface runs on Port 9000. e.g. http://Server-IP-address:9000
Won't this also wipe out your data?

No, the container data is left intact. Upon reinstalling the portainer, the previous data should be still there. I am about to redo the above procedure again since I forgot my portainer login password again.

If you have critical data, I would strongly recommend backing up your data before in-case it gets lost or corrupted before attempting my solution.

Update: It worked a second time for me without the container data loss. However, I still strongly recommend backing up critical data before attempting. What works for my environment might not work for you.

hertzg · 2020-05-24T04:37:36Z

Removing the portainer_data volume will wipe your portainer configs (certificates, users and configurations).

boltbrowser would be the better way to reset just the password.

soydepr · 2020-05-24T10:35:36Z

Why adding this feature seems to complicated as a solution seems common sense, would not expect this solution to be dragging so long

The boltbrowser worked perfectly for me

mnasafi · 2020-05-29T03:42:46Z

Removing the portainer_data volume will wipe your portainer configs (certificates, users and configurations).

boltbrowser would be the better way to reset just the password.

Can you please list a step-by-step tutorial for resetting Portainer credentials using BoltBrowser. I googled for instructions but wasn't able to find any. Provide as many details as possible.

rjgonza · 2020-05-29T10:37:59Z

Removing the portainer_data volume will wipe your portainer configs (certificates, users and configurations).
boltbrowser would be the better way to reset just the password.

Can you please list a step-by-step tutorial for resetting Portainer credentials using BoltBrowser. I googled for instructions but wasn't able to find any. Provide as many details as possible.

I actually did a blog post on this: https://rjgonza.netlify.app/posts/forgot_portainer_password/

ncresswell · 2020-05-29T10:45:50Z

Wow very cool. I might turn this into a youtube instructional video as its often asked..

eznix86 · 2020-05-30T18:15:43Z

The boltbrowser does the trick:
Useful commands

apt install unzip

curl -sSL https://git.bullercodeworks.com/brian/boltbrowser/releases/download/2.0/boltbrowser.linux64.zip -o bolt.zip

unzip bolt.zip

docker volume ls

docker volume ls portainer_data

docker  docker run --rm httpd:2.4-alpine htpasswd -nbB admin 'temporarypassworduntilyoureset'

./boltbrowser.linux64 /path/to/portainer.db
# Go to users and copy paste the password generated from httpd

Thanks @rjgonza

NightyLive · 2020-07-03T18:00:03Z

A lot of thanks to @rjgonza and @theArtechnology, his comment is very helpful but there is some little mistakes, also I searched a lot to find out where is the portainer.db before I figured out the container was running and that was the cause to not finding it.

So I rewrited some parts to made an easier procedure for noobs like me :

Password to use: changeme
Password hash to insert in portainer.db: $2y$05$B2tx1L.985tT6ciL1h8uieQq8hJoDHrsK6G2vK/tN3Eg6oTpa4poG
Or generate one of your choice: docker run --rm httpd:2.4-alpine htpasswd -nbB admin changeme

The main part to reset the password (tdnf is PhotonOS package manager, replace by yours (apt etc.):

tdnf install curl unzip
curl -sSL https://git.bullercodeworks.com/brian/boltbrowser/releases/download/2.0/boltbrowser.linux64.zip -o bolt.zip
unzip bolt.zip
docker container stop portainer
./boltbrowser.linux64 /var/lib/docker/volumes/portainer_data/_data/portainer.db 
# Go to users edit admin and replace the current password hash with the new one
docker container start portainer

deviantony · 2020-07-03T18:54:24Z

We also released this helper tool recently to help you reset your password: https://github.com/portainer/helper-reset-password

bitshiftnetau · 2021-03-28T15:06:59Z

The boltbrowser does the trick:
Useful commands

apt install unzip

curl -sSL https://git.bullercodeworks.com/brian/boltbrowser/releases/download/2.0/boltbrowser.linux64.zip -o bolt.zip

unzip bolt.zip

docker volume ls

docker volume ls portainer_data

docker  docker run --rm httpd:2.4-alpine htpasswd -nbB admin 'temporarypassworduntilyoureset'

./boltbrowser.linux64 /path/to/portainer.db
# Go to users and copy paste the password generated from httpd

Thanks @rjgonza

This doesn't work. Couldn't pull from http repo, citing some need to login?

Ended up using this to generate the hash, then used these instructions to insert using boltbrowser.

It doesn't work, I cannot login to portainer at this time.

Also it seems that this doesn't work on compiled versions of portainer AND compiled versions don't give an option to set the password.

When is this issue going to be resolved? It shouldn't be this difficult to reset or set a password.

rjgonza · 2021-03-28T15:38:16Z

I haven't actually checked to see what kind of lift it is, but I won't assume it's simple. There are many considerations when allowing passwords to be overwritten/reset. In any case my example was a specific version of bolt and portainer. Which are you using?

bitshiftnetau · 2021-03-28T15:51:49Z

I haven't actually checked to see what kind of lift it is, but I won't assume it's simple. There are many considerations when allowing passwords to be overwritten/reset. In any case my example was a specific version of bolt and portainer. Which are you using?

That is true, I guess I'm just frustrated after a day of trying all things to get it working.

Thanks for responding, turned out to be a system issue. I'm using the Arch Linux package found here I've blown away the /var/lib/portainer folder and re-installed the package. Password set dashboard appeared.

rjgonza · 2021-03-28T16:07:31Z

I hear ya, that can be pretty annoying. Glad you got it working though 👍

deviantony · 2021-04-16T00:34:16Z

Closing this issue as we're not gonna bring the ability to reset the admin password from within Portainer.

We recommend you to use external authentication or the helper tool we released to help you reset your password via: https://github.com/portainer/helper-reset-password

… and namespace EE-3 (#513) * metrics api resources calls to get nodes in cluster and pods in namespace * refactored cpu and memory reservation component to be explicit * resourceReservation support for memory/cpu usage stats * removed duplicated description * feat(kubernetes/resource-usage): k8s resource usage displayed on node view EE-1114 (#511) * feat(kubernetes/resource-usage): k8s resource usage displayed on node view EE-1114 * review updates * server metrics variable declaration moved above Co-authored-by: zees-dev <dev.786zshan@gmail.com> * feat(kubernetes/resource-usage): k8s resource usage displayed on cluster view EE-1113 (#508) * authentication helper method to check user role * resource usage displayed on cluster view * explicity error notification alert * removed redundant jsdoc param * loading resource usage as part of reservations * feat(kubernetes/resource-usage): k8s resource usage displayed on namespace view EE-1115 (#512) * refactor cpu/memory used to resourceReservation variables * resource usage displayed on k8s namespace view * loading resource usage as part of reservations * fixed viewready bug * refactor code to set initial state and remove redundant loading var * reverting to k8s authorizations for rbac * utilising view bound endpoint object instead of depracated EndpointProvider * feat(kubernetes/resource-usage): k8s ClusterRole updates to support metric server api queries EE-1123 (#520) * updated k8s clusterroles to support metrics api server queries * updated k8s clusterroles to remove redundant metrics server permissions * refactor flatmap * addressed merge conflict issues Co-authored-by: fhanportainer <79428273+fhanportainer@users.noreply.github.com>

macagua · 2021-08-21T05:38:47Z

@luckydonald I deleted the data volume and it's work for me.

deviantony added kind/enhancement Applied to Feature Requests status/need-info and removed kind/enhancement Applied to Feature Requests labels Jan 20, 2017

deviantony added area/authentication exp/intermediate kind/enhancement Applied to Feature Requests and removed status/need-info labels Jan 22, 2017

deviantony changed the title ~~Is there an option to reset admin password?~~ Add the ability to reset the admin password if the user forgot it Jan 22, 2017

deviantony mentioned this issue Oct 20, 2017

New container but it have account portainer/portainer-compose#13

Closed

deviantony mentioned this issue Apr 25, 2018

Can't recover a lost password #1840

Closed

deviantony removed the exp/intermediate label Apr 20, 2020

tokland mentioned this issue Jun 2, 2020

Basic Infrastructure EyeSeeTea/d2-portainer#3

Open

4 tasks

deviantony added this to the community-picks milestone Mar 28, 2021

deviantony removed this from the community-picks milestone Apr 16, 2021

deviantony closed this as completed Apr 16, 2021

xavier8854 mentioned this issue Dec 21, 2024

Unable to reset admin password #12446

Closed

2 tasks

portainer-bot bot pushed a commit that referenced this issue Mar 17, 2025

fix: cve-2025-22869 release 2.27.2 (#512)

b0de6d4

Add the ability to reset the admin password if the user forgot it #512

Add the ability to reset the admin password if the user forgot it #512

Comments

liyaka commented Jan 19, 2017

deviantony commented Jan 20, 2017 • edited Loading

luckydonald commented Jan 21, 2017 • edited Loading

liyaka commented Jan 22, 2017

deviantony commented Jan 22, 2017

hammady commented Nov 8, 2017

deviantony commented Nov 8, 2017

hammady commented Nov 9, 2017 via email

luckydonald commented Nov 10, 2017

colegatron commented Feb 15, 2018 • edited Loading

darkpixel commented Mar 16, 2018

luckydonald commented Apr 4, 2018 • edited Loading

Codelica commented Oct 26, 2018

sisiliao commented Oct 31, 2018 • edited Loading

pcgeek86 commented Nov 26, 2018

ghost commented Jan 12, 2019

Duvel commented Jan 14, 2019

kongh commented Aug 19, 2019

joseluisq commented Aug 19, 2019

Rogiel commented Aug 19, 2019

kongh commented Aug 19, 2019 • edited Loading

liuzhaowei55 commented Nov 29, 2019

soydepr commented Feb 20, 2020

tasz commented Mar 9, 2020

tasz commented Mar 9, 2020

mangei commented Mar 20, 2020

mnasafi commented Apr 30, 2020 • edited Loading

rjgonza commented Apr 30, 2020

mnasafi commented May 16, 2020 • edited Loading

hertzg commented May 24, 2020 • edited Loading

soydepr commented May 24, 2020

mnasafi commented May 29, 2020

rjgonza commented May 29, 2020

ncresswell commented May 29, 2020 via email

eznix86 commented May 30, 2020 • edited Loading

NightyLive commented Jul 3, 2020

deviantony commented Jul 3, 2020

bitshiftnetau commented Mar 28, 2021 • edited Loading

rjgonza commented Mar 28, 2021

bitshiftnetau commented Mar 28, 2021

rjgonza commented Mar 28, 2021

deviantony commented Apr 16, 2021

macagua commented Aug 21, 2021

deviantony commented Jan 20, 2017 •

edited

Loading

luckydonald commented Jan 21, 2017 •

edited

Loading

colegatron commented Feb 15, 2018 •

edited

Loading

luckydonald commented Apr 4, 2018 •

edited

Loading

sisiliao commented Oct 31, 2018 •

edited

Loading

kongh commented Aug 19, 2019 •

edited

Loading

mnasafi commented Apr 30, 2020 •

edited

Loading

mnasafi commented May 16, 2020 •

edited

Loading

hertzg commented May 24, 2020 •

edited

Loading

eznix86 commented May 30, 2020 •

edited

Loading

bitshiftnetau commented Mar 28, 2021 •

edited

Loading