Databases, Systems & Networks

Source: faqforge.com

If you lost your ISPConfig 3 administrator password, you can reset it with the following SQL query.

UPDATE sys_user SET passwort = md5(‘admin’) WHERE username = ‘admin’;

The SQL query sets the password to “admin” for the user “admin”, it has to be executed in the ISPConfig mysql database, e.g. with phpmyadmin. If you dont have phpmyadmin installed, then the query can be executed with the mysql commandline utility as well:

Login to the mysql database.

mysql -u root -p

and enter the password of the mysql root user. To switch to the ISPConfig database, run this command:

use dbispconfig;

Now execute the SQL command:

UPDATE sys_user SET passwort = md5(‘admin’) WHERE username = ‘admin’;

and close the mysql shell:

quit;

Using the same password on different servers allows attackers to access your accounts if cracker manage to steal your password from a less secure server. This is true for online website accounts too. So solution is to create unique passwords for server accounts like your email, sftp and ssh accounts. General guideline to create a strong and unique password is as follows:

Creating a strong and unique password for Linux or Unix-like systems

1. Create a password with mix of numbers, special symbols, and alphabets.
2. Make sure your password is hard to guess. You can use tool such as makepasswd to create hard to guess password.
3. Do not use simple words like « password« , « 123456« , « 123abc » or « qwerty« .
4. Use a unique password for all your server accounts.
5. A minimum password length of 12 to 14 characters should be used. See how to configure CentOS / RHEL / Fedora Linux based server password quality requirements.
6. Generating passwords randomly where feasible. You can do this with a simple shell scriptfunction.
7. If possible use two-factor authentication.
8. Use pam_crack to ensure strong passwords and to check passwords against a dictionary attack.

But, how do you test the effectiveness of a password in resisting guessing and brute-force attacks under Linux? The answer is simple use cracklib-check command.

Install cracklib on a Linux based system

Type the following yum command to install on RHEL and friends:
# yum install cracklib

Type the following apt-get command to install on Debian/Ubuntu and friends:
# apt-get install libcrack2

Lire la suite…