From 3203e2282efb3f289eef3898836d86d102b18ab3 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Tue, 10 Mar 2026 13:57:31 -0700 Subject: [PATCH 1/5] docs: fix harmful FAQ password reset and removed PHP/MySQL features Refs #213 Signed-off-by: Thomas Vincent --- Frequently-Asked-Questions.md | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/Frequently-Asked-Questions.md b/Frequently-Asked-Questions.md index 01f1f566..2de5db52 100644 --- a/Frequently-Asked-Questions.md +++ b/Frequently-Asked-Questions.md @@ -68,18 +68,17 @@ installation documents included that may also help. **Q:** I have forgotten my 'admin' password to Cacti, how do I reset it? -**A:** To reset the admin account password back to the default of 'admin', -connect to your Cacti database at the command line. +**A:** Use the built-in CLI password reset tool. Run the following from your +Cacti root directory as the web server user (e.g. `www-data` on Debian/Ubuntu, +`apache` on RHEL/Rocky): -```sql -shell> mysql -u root -p cacti +```console +php cli/change_password.php --user=admin --password=admin ``` -Now execute the following SQL: - -```sql -MySQL> update user_auth set password=md5('admin') where username='admin'; -``` +> **Warning:** Do not use direct SQL `md5()` updates. Cacti 1.x stores +> passwords with bcrypt/phpass. Setting an MD5 hash via SQL will lock the +> account — the login will fail even with the correct password. ## Monitoring @@ -244,9 +243,8 @@ change between the new small counter value and the large previous value. One way to combat this issue is to specify realistic maximum values for your data sources. RRDtool will ignore any value that is larger than the maximum value. -If you already have a spike on one or more of your graphs, there is a really -[useful Perl script](http://cricket.sourceforge.net/contrib/files/killspike2) -that will remove them for you. +If you already have a spike on one or more of your graphs, Cacti includes a +built-in Spikekill utility. See [Spikekill](Spikekill.md) for usage. --- From e91c4e6c58f87e251bf2196987de8df5949b54c6 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Wed, 22 Jul 2026 15:17:00 -0700 Subject: [PATCH 2/5] docs(faq): fix password-reset procedure The prior text pointed at cli/change_password.php, which does not exist in Cacti, and warned that an SQL MD5 update locks the account. Neither is true: compat_password_verify() has an MD5 fallback and re-hashes to bcrypt on the next login, so the SQL reset works. Restore the working SQL method. Signed-off-by: Thomas Vincent --- Frequently-Asked-Questions.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/Frequently-Asked-Questions.md b/Frequently-Asked-Questions.md index 2de5db52..23e90c72 100644 --- a/Frequently-Asked-Questions.md +++ b/Frequently-Asked-Questions.md @@ -68,17 +68,18 @@ installation documents included that may also help. **Q:** I have forgotten my 'admin' password to Cacti, how do I reset it? -**A:** Use the built-in CLI password reset tool. Run the following from your -Cacti root directory as the web server user (e.g. `www-data` on Debian/Ubuntu, -`apache` on RHEL/Rocky): +**A:** Reset the password directly in the database. Connect to the Cacti +database and set the `admin` account's password to the MD5 of the new value: ```console -php cli/change_password.php --user=admin --password=admin +shell> mysql -u root -p cacti +MySQL> UPDATE user_auth SET password = MD5('newpassword') WHERE username = 'admin'; ``` -> **Warning:** Do not use direct SQL `md5()` updates. Cacti 1.x stores -> passwords with bcrypt/phpass. Setting an MD5 hash via SQL will lock the -> account — the login will fail even with the correct password. +> **Note:** The stored value must be the MD5 hash of the password (use +> `MD5('newpassword')`, not the literal string). Cacti verifies passwords +> through a backward-compatible MD5 path and transparently re-hashes the +> account to bcrypt on the next successful login. ## Monitoring From ec06772c0c66827b069ce17a937f4c003ff647f7 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sat, 22 Aug 2026 23:07:17 -0700 Subject: [PATCH 3/5] docs: prefer SHA2 for emergency password resets Signed-off-by: Thomas Vincent --- Frequently-Asked-Questions.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/Frequently-Asked-Questions.md b/Frequently-Asked-Questions.md index 23e90c72..01201d1b 100644 --- a/Frequently-Asked-Questions.md +++ b/Frequently-Asked-Questions.md @@ -69,17 +69,18 @@ installation documents included that may also help. **Q:** I have forgotten my 'admin' password to Cacti, how do I reset it? **A:** Reset the password directly in the database. Connect to the Cacti -database and set the `admin` account's password to the MD5 of the new value: +database and set the `admin` account's password to the SHA-256 hash of the new +value: ```console shell> mysql -u root -p cacti -MySQL> UPDATE user_auth SET password = MD5('newpassword') WHERE username = 'admin'; +MySQL> UPDATE user_auth SET password = SHA2('newpassword', 256) WHERE username = 'admin'; ``` -> **Note:** The stored value must be the MD5 hash of the password (use -> `MD5('newpassword')`, not the literal string). Cacti verifies passwords -> through a backward-compatible MD5 path and transparently re-hashes the -> account to bcrypt on the next successful login. +> **Note:** On an older database server without `SHA2()`, use +> `MD5('newpassword')` instead. Cacti accepts either legacy bootstrap hash and +> transparently re-hashes the account with its current password algorithm on +> the next successful local login. ## Monitoring From 764fb1784fa9a2c6651e8b52d292fc502ec8c55f Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sun, 23 Aug 2026 17:23:32 -0700 Subject: [PATCH 4/5] docs: force password change after admin reset Signed-off-by: Thomas Vincent --- Frequently-Asked-Questions.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/Frequently-Asked-Questions.md b/Frequently-Asked-Questions.md index 01201d1b..1e76ffb3 100644 --- a/Frequently-Asked-Questions.md +++ b/Frequently-Asked-Questions.md @@ -74,9 +74,18 @@ value: ```console shell> mysql -u root -p cacti -MySQL> UPDATE user_auth SET password = SHA2('newpassword', 256) WHERE username = 'admin'; +MySQL> UPDATE user_auth + -> SET password = SHA2('newpassword', 256), + -> password_change = 'on', + -> must_change_password = 'on', + -> lastchange = UNIX_TIMESTAMP() + -> WHERE username = 'admin' AND realm = 0; ``` +Use a unique temporary value in place of `newpassword`. The local administrator +will be required to replace it at the next login, and the reset timestamp keeps +the account subject to any configured password-expiration policy. + > **Note:** On an older database server without `SHA2()`, use > `MD5('newpassword')` instead. Cacti accepts either legacy bootstrap hash and > transparently re-hashes the account with its current password algorithm on From 1efa2151eced00598ff57df0b0bffbcb89e9f9a9 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Thu, 3 Sep 2026 13:24:32 -0700 Subject: [PATCH 5/5] docs: use the mariadb client in the password reset example - Note that the mysql client takes the same arguments. Signed-off-by: Thomas Vincent --- Frequently-Asked-Questions.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Frequently-Asked-Questions.md b/Frequently-Asked-Questions.md index 1e76ffb3..fe433b8f 100644 --- a/Frequently-Asked-Questions.md +++ b/Frequently-Asked-Questions.md @@ -73,8 +73,8 @@ database and set the `admin` account's password to the SHA-256 hash of the new value: ```console -shell> mysql -u root -p cacti -MySQL> UPDATE user_auth +shell> mariadb -u root -p cacti +MariaDB> UPDATE user_auth -> SET password = SHA2('newpassword', 256), -> password_change = 'on', -> must_change_password = 'on', @@ -82,6 +82,8 @@ MySQL> UPDATE user_auth -> WHERE username = 'admin' AND realm = 0; ``` +On MySQL, the `mysql` client takes the same arguments. + Use a unique temporary value in place of `newpassword`. The local administrator will be required to replace it at the next login, and the reset timestamp keeps the account subject to any configured password-expiration policy.