The default administrator password #

This page is for whoever installs Exponential, and for administrators taking over an installation. Every installation has one administrator account to begin with: login admin (user object 14, in the group Administrator users, with the Administrator role). What its password is depends on how the site was installed. This page lists it for each way, as the code of Exponential 6.0.15 does it.

In short #

No installer of Exponential 6 leaves publish in place. It survives only where the database was created from the seed without an installer, or where the wizard was told to keep an existing database that still had it.

The setup wizard #

The web setup wizard (setup/init, chapter 5) has a step for the administrator: first name, last name, e-mail address, and the password typed twice. The login is always admin.

• There is no default password. The step refuses an empty password, two passwords that differ, one shorter than [UserSettings] MinPasswordLength (10 as shipped), and, since 6.0.15, a well-known or common password of any length: "This password is well-known or too common, so anyone could guess it. Choose another one." That covers the words of the shared list and their simple variants, such as a common word with digits or ! at the end. Choose a long, random password; a password manager can generate one.
• If you chose to keep the existing data of a database, the step is skipped and the administrator account stays as that database has it. A database created from the shipped seed then still has publish: change it at once.

The kickstarter (kickstart.ini) #

The kickstarter runs the same steps without a browser, from kickstart.ini (chapter 6):

[site_admin]
Continue=true
FirstName=Admin
LastName=User
Email=[email protected]
Password=

• Empty or missing Password= (as in the shipped kickstart.ini-dist and kickstart.ini--example): the installer generates a random 20-character password (letters and digits without the look-alikes), prints it on the console and writes it to var/log/initial-admin-password with mode 0600, owner-only.
• A well-known or common password (the shared list, with its variants) is replaced the same way.
• A password shorter than [UserSettings] MinPasswordLength (10 as shipped) is replaced the same way, since 6.0.15; before, the kickstarter installed it as it was. These are the rules exp:install applies.
• Any other value is installed as it is. Leave Password= empty and use the generated one, or put a long random value there.
• kickstart.ini holds passwords in clear text: create it with mode 0600, never commit it, and remove it after the installation. The run's log, var/log/kickstart.log, masks passwords.

The console install (exp:install) #

./console exp:install --apply (or php bin/php/install.php --apply) writes a kickstart.ini from its options and runs the kickstarter (chapter 7):

• Without --password, or with --random-password: a random 24-character password.
• With --password=<value>: used when it is at least MinPasswordLength (10) characters long and not on the shared list; otherwise it is replaced by a random one, and the summary says why. An empty --password= is refused.
• A generated password is printed once in the summary at the end and written to var/log/initial-admin-password (mode 0600). The summary tells you to change it and delete that file. A password you gave is shown once and stored nowhere in clear text.
• var/log/exp-install-<date>.ini, the configuration that was used, masks every password.

In a pipeline, take the password from your secret store (--password="${ADMIN_PASSWORD}"), or let it be generated and collect it from the summary; never write it into a script or an image.

The list of well-known passwords #

Since 6.0.15 one list, expWeakPasswordList (kernel/classes/expweakpasswordlist.php), is used everywhere a password is set: the setup wizard, the kickstarter, exp:install, the Change password page, registration, the user edit form, exp:resetuserpassword and the web services. It holds:

• the software's own names and old defaults (publish, exponential, ezpublish, demo), account names (admin, administrator, root, test), the classics (password, changeme, secret, welcome, letmein, qwerty, 123456 ...);
• their simple variants: any case, digits or symbols at the end or the start, spaces, - or _ inside, letter swaps such as p@ssw0rd, the endings -s, -es, -ed, -er, -ers, -ing, -ings, and a word typed twice;
• repeated characters and runs of the keyboard, the alphabet or the digits (aaaaaaaaaa, qwertyuiop, 1234567890).

A password is compared as a whole, so a long passphrase that only contains such a word is accepted. Add your own words (the company's name, the site's name) in an override:

[UserSettings]
WeakPasswordList[]=ourcompany
WeakPasswordFile=settings/weak-passwords.txt   # one word per line, # for comments

WeakPasswordCheck=disabled switches the check off for the forms; the installers always check. An existing password is never refused at sign-in: the list applies when a password is set. Details: the upgrade note.

The shipped database seed: publish #

The kernel's clean database, the data every installation starts from, has the administrator account with the password publish, stored as a bcrypt hash (type 7):

• share/db_data.dba
• kernel/sql/common/cleandata.sql
• kernel/sql/sqlite/cleandata.sql

That is the historical default of the software, and it is in every old guide, so it is the first password anyone tries. The installers above always overwrite it when they create the site. It is still the password when:

• a database was created by loading those files by hand (with exp:ezsqlinsertschema, a database client, or a test setup), without running an installer afterwards;
• the setup wizard was told to keep an existing database created that way;
• an old installation (3.x, 4.x, 5.x legacy) was migrated whose administrator never changed it.

Check and change it at once:

./console exp:resetuserpassword --allow-root-user -u admin -g -l 24

No installer of Exponential 6 sets any other fixed password. A common word that merely passes the 10-character rule is just as easy to guess: do not use one on a site that can be reached from outside, not even for a test.

Site packages and demo content #

The site packages that the installers download (for example the 7x and CJW packages, and the community packages) and the packages in var/storage/packages/ carry no user accounts: the administrator comes from the database seed and gets its password from the installer's administrator step. A package that does carry a user account installs it with the password hash the package contains, so review any package from a third party before installing it.

For developers: the package installer API (eZSiteInstaller::updateContentObjectAttributes()) gives a user object it creates through an install script a random login and the password publish. No shipped package uses it for users; a package of your own that does should set a real password afterwards.

A public demonstration site may publish a sign-in for its visitors. Such a site runs with the environment variable EXP_DEMO_MODE=1 (Demo mode): the installers then accept the published password even though it is well-known or shorter than MinPasswordLength (an empty one never), and nobody can change or reset an administrator password while the variable is set. Such a password must never be reused on a real site, and the variable must never be set for one.

After the first sign-in #

1. Sign in at the administration (/admin/user/login with the default URL access) as admin with the password above.
2. Change the password: Change the administrator password.
3. Give the account a real, monitored e-mail address, so that Forgot your password? and the "Your password was changed" mail reach you.
4. Delete the password file: rm var/log/initial-admin-password.
5. Remove kickstart.ini if you used one.
6. Follow Account hygiene.

Chapter 10.1 has the same steps in the installation guide.

Account hygiene #

1. Create a personal administrator account with a login other than admin (in Users > Administrator users, which carries the Administrator role), one per person.
2. Turn on two-step sign-in for every administrator.
3. Retire admin as a sign-in: disable it (Configure user account settings > clear Enable user account, after pointing [UserSettings] UserCreatorID at an enabled administrator), or keep it enabled with a long random password nobody keeps.
4. Keep a written, tested break-glass procedure: root on the server plus ./console exp:resetuserpassword --allow-root-user.

The steps, and why UserCreatorID matters, are in Change the administrator password: Account hygiene.

Related pages #

• Change the administrator password
• Security hardening
• Chapter 4: Choosing an install method, chapter 5: the setup wizard, chapter 6: the kickstarter, chapter 7: the console install
• Chapter 13: Security hardening for production