Major, Major Problem...

If you have questions about using mojoPortal, you can post them here.

You may want to first review our site administration documentation to see if your question is answered there.

This thread is closed to new posts. You must sign in to post in the forums.
6/29/2011 5:01:51 PM
Gravatar
Total Posts 114

Major, Major Problem...

Ok, I had a 2.3.6.6. website configured to used hashed, encrypted passwords. I noted that for some reason, the security advisor was telling me I hadn't changed the machineKey, but I had. I followed the directions on the page to switch back to plain text passwords, so that I could do the machine key again, and switch back to hashed and encrypted passwords. After switching back to plain text, and before replacing the machine key, I logged out, and am now unable to log in.

I have a backup of the DB as of last night; I use Arvixe, so thought I'd just restore the database and be back up and running, but the restore fails using the Management Studio. Can someone help me out with some pointers, here?

Many thanks in advance!

Duane

 

6/29/2011 5:07:54 PM
Gravatar
Total Posts 114

Re: Major, Major Problem...

nevermind; getting arvixe to restore it.

 

6/29/2011 8:35:14 PM
Gravatar
Total Posts 355

Re: Major, Major Problem...

Duane - I haven't had this issue when changing the machine key, but let me know if the restore doesn't fix it, and I'll see what I can do to help troubleshoot it. 

6/29/2011 9:43:37 PM
Gravatar
Total Posts 114

Re: Major, Major Problem...

IndigoTea,

Restoring the backup did the trick; thanks!

Duane

 

6/30/2011 10:54:10 AM
Gravatar
Total Posts 114

Re: Major, Major Problem...

Should I not log out when performing this machineKey change, and in what state are the passwords when you switch back to plain text? Are the encrypted passwords decrypted, and then re-encrypted when switching back to encrypted and hashed after changing the machineKey?

Thanks!

Duane

 

6/30/2011 11:11:14 AM
Gravatar
Total Posts 18439

Re: Major, Major Problem...

Hi Duane,

If you are currently using hashed passwords or clear text passwords then changing the machine key will not cause any problems other than it will force you logged out so you would have to login again.

If you are using encrypted passwords then when you change the machine key it will no longer be able to decrypt and that would cause errors and prevent you from logging in.

So if you are currently using encrypted and you want to change the machine key you must do the following:

1. backup the db in case anything goes wrong, clear the mojoportal log so that you can tell new errors from old ones.

2. stay logged in and change the password format to clear text (this process may take a few minute if you have lots of users).

3. Open a different browser ie if you are using IE on the first browser use Firefox or Chrome and make sure you can still login using a different browser after changing to clear text. Stay logged in on the original browser just in case.

4. If you can still login after changing password format, then backup your machine key and replace it with a new one. This may actually force you to be logged out when you do this, but you should be able to login again.

5. Now once you have changed the machine key and have logged in again, you can change back to encrypted password format.

If something goes wrong download your log from /Data/currenntlog.config as it may have clues what went wrong, then you could send me the log if needed. Hopefully nothing will go wrong.

Hope that helps,

Joe

 

6/30/2011 11:18:29 AM
Gravatar
Total Posts 114

Re: Major, Major Problem...

Exactly what I needed to know; thank you, Joe!

Duane

 

7/3/2011 12:27:16 PM
Gravatar
Total Posts 114

Re: Major, Major Problem...

Joe,

Just thought I'd update this with something I'd discovered in doing this. There's a step that needs to happen between #2 and #3, as I found when trying to login using a different browser failed after changing the format to plain text. The step that needs to happen (at least in my case) is that in the first browser, I had to go to the member list and reset my password after switching to plain text. I was using hashed and encrypted, and even before changing the machineKey and after you've switched to plain text, existing hashed and encrypted passwords are no longer usable.

Once you've reset the password and re-logged in with another browser, you're good to go with switching the machineKey and switching back to hashed and encrypted.

Best always!

Duane

 

7/4/2011 9:18:23 AM
Gravatar
Total Posts 18439

Re: Major, Major Problem...

Hi Duane,

You are right that if you started with hashed and changed it back to clear text you would need to change your password in the other browser or use password recovery/reset to retrieve the new one. This is because hashed passwords cannot be decrypted so they can only be replaced with a random generated password. Hashed and encrypted are not the same thing, encrypted can be decrypted back to clear text but hashed cannot. 

Best,

Joe

You must sign in to post in the forums. This thread is closed to new posts.