Cannot access admin area - login loops back to admin login page

[Peter Cefalu]

I am getting this error on version 151 as well. Everything was fine up until a few hours ago. [13-Dec-2014 16:56:16 America/Denver] ERROR: Failed sending email to: "Admin" <admin@localhost> with subject: "Admin login failure notice" (failed validation). I have not touched anything on this site for a year and I have no idea what happened. Please help!

[DrByte]

admin@localhost

I'm not surprised that you'd get an error trying to email that address, since it's essentially an invalid email address.

So, it begs the question: Do you have an Admin user in your store's admin area which has "admin@localhost" set as the email address? if so, why?

If you didn't know that you had one, then perhaps someone has gained access to your website's database and injected one maliciously? In that case you need to immediately do a thorough investigation of your site and find out how they got in and remove whatever damage they've done: http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks

[Peter Cefalu]

oh no! I did not have that email in there. like i said, i haven't touched anything except adding products and such. haven't found any changed or new files as of yet. any other thoughts while i keep looking?

[Peter Cefalu]

and it is exactly the same error as the k1ra posted.

[Peter Cefalu]

If i use an incorrect username, i get the error message, so it is hitting the db

[Peter Cefalu]

went into the admin table, the email was changed there to admin@localhost and the lockout_expires was set to 1418521640. i changed both and was able to login. i then changed the login and password for the admin. i am now looking at my files for something out of the ordinary. also, some ip from Denver logged in before I experienced the problem today. looks like they reached the admin but no other logs were listed.

[DrByte]

Here's what's happening on a technical level:

Whenever someone tries to log into your admin multiple times without the correct password, the system emails that admin user and the primary administrator about the failure.
If the email address is invalid, the kind of error you've quoted will be seen in the logs.

So, the presence of the error suggests 2 things are both happening to you:
a) someone's trying to login to your admin and doesn't have a valid username+password. You should do something about that.
b) you've got an admin user whose email address is "admin@localhost", which is a default user account, and should be deleted, as long as you've got a different admin account you can use

If you cannot log into your own admin account, then the above symptoms combined with your inability to log in is further reason to suggest your site has been compromised.
You should immediately do a thorough site inspection and do all necessary cleanup to be certain you've prevented them from doing any further damage or getting back in again: http://www.zen-cart.com/wiki/index.p...ing_From_Hacks

And to give yourself access to your admin account again, the following may be necessary: http://www.zen-cart.com/content.php?...admin-password (and whoever compromised your site might have been attempting to do this very thing, which could explain how the "admin@localhost" user got created and also why your old login stopped working ... but if they gained access to do that, then you need to find out HOW else they'll be back again)

[Peter Cefalu]

There is no user with the admin@localhost email. i only had one and that was mine. i show the rogue login only 4 times but never made it to the admin user page. I have no idea how that was changed as well as the very large lockout number. the many incorrect logins must have been me. anyway i went into the db and was able to change the email and lockout and get back in. I have changed the login and password(harder) and made another superuser just in case. I will now try and find any unusual files and keep an eye out. My question is, can you log into the admin with the admin@localhost still in there as long as the uname and password were always entered correctly? I only ask as we paid someone to upgrade this site to 1.5 over year ago and maybe we never even changed it? I just changed my password yesterday, and had the old and new saved in firefox. so every time I logged in, it was wrong the first time and then the second attempt was correct. i have since deleted the old saved password. I guess what I am saying is....am I the one who triggered the lockout? I find it ironic that the password was changed yesterday and today it was locked out!

[DrByte]

My question is, can you log into the admin with the admin@localhost still in there as long as the uname and password were always entered correctly? I only ask as we paid someone to upgrade this site to 1.5 over year ago and maybe we never even changed it?

Yes.

I just changed my password yesterday, and had the old and new saved in firefox. so every time I logged in, it was wrong the first time and then the second attempt was correct. i have since deleted the old saved password. I guess what I am saying is....am I the one who triggered the lockout? I find it ironic that the password was changed yesterday and today it was locked out!

Yes, it seems like it was your own Firefox that locked you out.