Installation Issue - Admin Password not recognized

Hi All,

I am really stuck. I have installed zen cart 7 times since yesterday, every time I get the "Installation successfull" message.

Backend is ubuntu 10.11 server on a virtualbox vm.

I clearly record my admin uid and pwd.
I also do these after install tasks:
.remove installation folder
.change name of admin folder
.change permissions for both config.php files

After all of this I go to the store and everything ok.

then I go to the admin page and I get the "Enter uid and pwd" login. I clearly write the ones I previously recorded and try to go in but nothing happens!(Even checked the admin table in phpmyadmin and my details are there correctly)
trying to send them to my email is useless as well as I never receive anything!
What can I be doing wrong?

Can somebody pls help me? :blush:

Thanks,
Leo

1. If in phpMyAdmin you're seeing your password in the admin table showing in clear text, then it definitely won't work. Those passwords are stored encrypted, so mangling that data yourself absolutely won't work.

2. If the admin login page is refreshing without any error message at all, then it's NOT rejecting your password. Instead it's symptomatic of a session problem. Either your server isn't handling sessions properly, or your browser isn't accepting session cookies properly, or a combination of the two.
   If you're running the store from a URL consisting of an IP address instead of a properly named FQDN then I'm not surprised that you're having session problems. Change to a proper FQDN and it'll work much better. Since you said you're using a virtual machine, I suspect using "localhost" will probably work a lot better than using 127.0.0.1

Dear DrByte,

Before anything I must say THANK U! You pointed me in the right direction and gave me ideas I couldn't see in my frustration... :)

I was using Chrome and it didn't (and still doesn't) allow me to go into the admin area. After reading your message i sayd... "what if...?" so i tried IE and it worked immediately! WTH?

Still don't know what issue there must be. I've been using Chrome to work with Joomla site and Admin as well as for Zen cart Site and didn't think about problems with the browser.

I'm quite new with this as you can see and don't even know much about how to set up a domain name, as you advice, I'll look into it with time.

Anyway THANKS a lot for your time and acerted comment.

Best regards,
Leo

Normally, Chrome works fine for logging in to the Zen Cart admin. Have you tried clearing browsing data, closing and then re-opening the browser?

DrByte:

2. If the admin login page is refreshing without any error message at all, then it's NOT rejecting your password. Instead it's symptomatic of a session problem. Either your server isn't handling sessions properly, or your browser isn't accepting session cookies properly, or a combination of the two.
   If you're running the store from a URL consisting of an IP address instead of a properly named FQDN then I'm not surprised that you're having session problems. Change to a proper FQDN and it'll work much better. Since you said you're using a virtual machine, I suspect using "localhost" will probably work a lot better than using 127.0.0.1
   new 1.5 install last week, on a server that 1.3.9h is working fine on.
   Admin was working great for 3 days, than all of a sudden I can no longer log into my admin. I have tried IE 9, Chrome, and FF and the login page just flashes and refreshes. I get the email "Admin login failure notice" and password resets are not working either.

Any help with this?

url is https:\www.domainname.com/adminfolder/login.php?camefrom=index.php

OK, did the tutorial and created an new admin account and got loged in. don't know what happened with the old username, but the new one works.

[QUOTE=DrByte;1109232]1. If in phpMyAdmin you're seeing your password in the admin table showing in clear text, then it definitely won't work. Those passwords are stored encrypted, so mangling that data yourself absolutely won't work.

My phpMyAdmin password is encrypted but in my admin/includes/configure.php is not. I have v1.5 installed.
I also have a v1.39 copy of my configure.php and it is encrypted. So if someone can hack my admin folder they can easily get my password. How can I encrypt it in v1.5? I have renamed my admin by the way.

dewragdave:

My phpMyAdmin password is encrypted but in my admin/includes/configure.php is not.

These are different passwords (and user accounts), that serve different purposes.

dewragdave:

So if someone can hack my admin folder they can easily get my password.

I'm unsure what your definition of 'hack' is, but if someone has a means to read your configure.php files then it's 'game over' anyway.

Cheers
Rod

RodG:

These are different passwords (and user accounts), that serve different purposes.

I'm unsure what your definition of 'hack' is, but if someone has a means to read your configure.php files then it's 'game over' anyway.

Cheers
Rod

Well, the Wikipedia definition of a hacker is:
Hacker (computer security) or cracker, who accesses a computer system by circumventing its security system.

So why would a Zen-cart tutorial tell us to rename the ADMIN folder?
Is it that easy to open someone's folder and open the configure.php file and low and behold there is an un-encrypted password that gets them full admin rights.
It was encrypted in v1.39... why is in not encrypted in v1.5?????
I'm looking for a way to fix it not the resulting problems from someone finding it.

dewragdave:

It was encrypted in v1.39.
I'm not sure where you got that idea from.
No, the database-password in the configure.php files have never been "encrypted". Because it doesn't work that way.
There was no change to that between v1.3.9 and v1.5.0. You must be thinking of something completely different.

dewragdave:

Well, the Wikipedia definition of a hacker is:
Hacker (computer security) or cracker, who accesses a computer system by circumventing its security system.

I wasn't intererested in Wikipedia's definintion. I was interested in what you consider to be a 'hack'. This means many different thing to different people.

dewragdave:

So why would a Zen-cart tutorial tell us to rename the ADMIN folder?

Two reasons spring to mind.

1. Security by obscurity
2. There are ready made scripts that the 'script kiddies' (often mis-labled as 'hackers') can execute to gain access to vulnerable versions of zencart that rely/depend on certain files located in the /admin/ folder. The simple act of renaming this folder prevents these 'hacks' from working.

dewragdave:

Is it that easy to open someone's folder

I don't know... exactly how easy is 'that easy'? This question makes no sense.

dewragdave:

and open the configure.php file

By design, this file is unreadable via HTTP access to anyone other than a logged in administrator.

dewragdave:

and low and behold there is an un-encrypted password that gets them full admin rights.

Err, no it doesn't. The username/password stored in that file gives them the login details to the database only.
Needless to say, this isn't something you want to give other people, which is why the file itself is protected from being accessable to anyone.

dewragdave:

It was encrypted in v1.39... why is in not encrypted in v1.5?????

You are mistaken. This username/password in configure.php has never been encrypted, and it never will be, for reasons that will take you several lessons to understand. No offense intended. You'd need to familiarise yourself with the workings of an SQL server for this, and that is something that most zenners will never need to concern themselves with.

dewragdave:

I'm looking for a way to fix it not the resulting problems from someone finding it.

Unless I'm completely misunderstanding you, there is nothing to be fixed.

Cheers
Rod

DrByte:

I'm not sure where you got that idea from.
No, the database-password in the configure.php files have never been "encrypted". Because it doesn't work that way.
There was no change to that between v1.3.9 and v1.5.0. You must be thinking of something completely different.

Well, I've been using the same password in v1.38, v1.39 and now in v1.50.
I have a copy of my v1.39 configure.php and the password is a lot longer and composed of a bunch of scrambled letters and numbers. In my v1.50 configure.php it is the actual password that I use. I don't have a copy of the v1.38 version to see what it looks like. I just assumed that it was encrypted because of that. So now I'm wondering how I was able to sign on to the v1.39 version??? I think I understand how it all works now, it just seems kind of vulnerable to have the actual password showing anywhere not encrypted. I used OSC before this and the password is encrypted in the configure.php and my admin was hacked and I ended up with a completely trashed website. They went as far as to create 5 extra admin signons. My website only displayed a picture of the Algerian flag and text that said: "Hacked by BrOx-Dz your security is 0". Thanks for the feedback.

RodG:

I wasn't intererested in Wikipedia's definintion. I was interested in what you consider to be a 'hack'. This means many different thing to different people.

Two reasons spring to mind.

1. Security by obscurity
2. There are ready made scripts that the 'script kiddies' (often mis-labled as 'hackers') can execute to gain access to vulnerable versions of zencart that rely/depend on certain files located in the /admin/ folder. The simple act of renaming this folder prevents these 'hacks' from working.

I don't know... exactly how easy is 'that easy'? This question makes no sense.

By design, this file is unreadable via HTTP access to anyone other than a logged in administrator.

Err, no it doesn't. The username/password stored in that file gives them the login details to the database only.
Needless to say, this isn't something you want to give other people, which is why the file itself is protected from being accessable to anyone.

You are mistaken. This username/password in configure.php has never been encrypted, and it never will be, for reasons that will take you several lessons to understand. No offense intended. You'd need to familiarise yourself with the workings of an SQL server for this, and that is something that most zenners will never need to concern themselves with.

Unless I'm completely misunderstanding you, there is nothing to be fixed.

Cheers
Rod

I guess if banks and the govt can be hacked then so can zen-cart. Identity theft is running rampant and literally everyone tells you to protect you passwords, don't write them down, change them every 60 days etc...etc...etc... It just seems odd to me that a password would be displayed anywhere un-encrypted, whether or not it was in a secured server, or folder, or whatever... The whole thing makes be nervous because of my prior bad experience with OSC. (see my comment to DrByte). Thank you for all the helpful comments, you obviously have an extensive knowledge of zen-cart.

I still think you're mistaken about the passwords in prior versions.

Just to be clear: the DB_PASSWORD in the configure.php file IS NOT the same password as what you use to login to your store's admin. The admin password is definitely encrypted when stored. There is no need to decrypt it, because the validation of that password is done in real time when the "user" supplies the password, which is re-encrypted and compared with the stored encrypted value. That's completely different than the database password stored in configure.php which Zen Cart must tell PHP to read and pass over to MySQL to enable access to the database. This access, on a properly secured server, is kept internal to the server and not allowed to outside users, unlike your store admin access which is always from outside.

dewragdave:

It just seems odd to me that a password would be displayed anywhere un-encrypted
Um. It is NOT "displayed" anywhere.

That said if you have some expertise on how to store the password in the configure.php file in encrypted format, and use that encrypted password to pass over to MySQL without decrypting it so MySQL can actually use it for login, please share. In all my open source app work I've never seen a site's mysql db password stored encrypted in a PHP file. Heck, even in other languages it's stored unencrypted too ... because it has to be.

dewragdave:

The whole thing makes be nervous because of my prior bad experience with OSC. (see my comment to DrByte). Thank you for all the helpful comments, you obviously have an extensive knowledge of zen-cart.

My knowlege of MySQL is far greater than my knowlege of Zencart, hense my response "This username/password in configure.php has never been encrypted, and it never will be, for reasons that will take you several lessons to understand. No offense intended. You'd need to familiarise yourself with the workings of an SQL server"

And for the record, I've just taken a look at my configure.php files for OSC V2.2 and V2.3.1 (mainly to see if there was a another password that you were thinking of, and the only ones I see are for the DB, which out of necessity is not encrypted.

I've also taken a look at my osCommerce V3.0 & V3.2 installallations (where the settings are stored in a different file, called "settings.ini" and once again, all plain text.

Same with Opencart V1.49, V1.5,0, V1.5.1 & the current V1.5.2 .. and
PrestaShop V1.44 - to the current V1.50 ... plain text...
Not to mention InterSpire (a commecial system).... plain text
VirtueMart (a Joomla module).. Same again...

I could go on, but I know that I'll not find anything different.

What I think you could have seen is a "complex" password that looks as though it was encrypted, for example "728d43851f0105418cfab".
This is quite feasible, because it's not as though you need to type these passwords in anywhere, other than initial setups (for Store operations), so the more complex the better.

I've just provided you with a way to 'save face', so if you are smart you will accept this explanation and cease this discussion

Cheers
Rod

ps. If you think it strange that I just happen to have all of these different carts at my disposal, you'll find the reasons by visiting http://ozpost.net/
pss. ZenCart beats all others hands down (IMO). Some may be 'prettier' but I prefer functionality, support and versatility over 'pretty' any day :)

RodG:

What I think you could have seen is a "complex" password that looks as though it was encrypted, for example "728d43851f0105418cfab".
This is quite feasible, because it's not as though you need to type these passwords in anywhere, other than initial setups (for Store operations), so the more complex the better.
)

Rod
I guess the squeaky wheel really does get the grease.
Yes, this is the kind of password that was in the configure.php of all my OSC's and prior versions of zen. I assumed (you know what that means) that it was encrypted because it didn't match my password. So what you are saying is that I could delete the password in configure.php or change it to anything I wanted and it would not effect my signon anyway, right? At least if someone did gain access to the file it at least would not have my current password. So if I change my password in admin it does not change in the configure.php just in the Mysql data base file. Case Closed.
Dave

"So what you are saying is that I could delete the password in configure.php or change it to anything I wanted and it would not effect my signon anyway, right"

Hhhm mostly right, but if you delete/change the password in configure.php your site will just 'die' unless you add the same password into your MySQL database admin user. This 'user' not found in any of the zencart tables. It is located in the 'master' Mysql database called 'mysql'.

Unless you are running your own server you will NOT have direct access to this data, and the password can only be changed via a system permitted interface (such as the MySQL database wizzard that is found in most cPanels).

"At least if someone did gain access to the file it at least would not have my current password"

The password in the configure files would give access to all of the databases under your control. This is NOT to be confused the Zencart admin user (which only allows access to ZenCart itself).

"So if I change my password in admin it does not change in the configure.php"

Correct. This is a different password. The two must not be confused.

The user/password stored in the configure files allows access to ALL databases under that account (typically this would be for the zencart database only, but many people will have several different databases under the same account. These are the ones that can only be set up via cPanel or similar.

The 'admin' user for Zencart allows access to ZenCart store only (not the zencart database itself). The database users/passwords are a 'one time only' setting, and once set would rarely ever need changing. The zencart 'admin' user is what you use to administer the store. This user/password is stored in the database itself (encrypted). ...

Cheers
Rod

I know this is an old thread, but I'm having a similar if not the same issue. I just ran a new install on the latest release. System had no problem finding the renamed admin folder; however I am unable to access the admin. I did a pass reset, and was sent a new pass and it still refused to accept it.

I checked and as far as I can see the sessions are being saved in the cache folder - so just not sure. Now we've gone to great lengths to lock down our server (we have total control), so I'm thinking maybe it's some of our security creating the problem. Do you have suggestions as to what I need to look at? FYI - I have two other legacy carts, one recently upgraded to the latest release working just fine, so I'm not exactly sure what to look for.

Thanks

Ruth

rwoody:

I'm thinking maybe it's some of our security creating the problem. Do you have suggestions as to what I need to look at?

The problem here is that we don't know what security you have in place, and if we assume your diagnosis is correct there really isn't much we can suggest.

One way to identify the cause would be to disable all security measures to prove that it is indeed a security issue, and then re-enable them one by one until you identify which measure is causing the issue.

I assume that you've already done the 'obvious', such as clearing any cache files and trying a different browser?

Cheers
RodG