ISPConfig 'forgets' user password

[pjdevries]

I'm running ISPConfig 2.2.27. One of my clients has a website/domain with two user accounts. For one of those accounts, ISPConfig seems to 'forget' the password every so often. The user can access her e-mail for weeks on end, until suddenly the password is no longer accepted. After I manually reset the password, the problem disappears and the user is able to access her e-mail once again for an indefinit period.

Is this a known problem? Can it be solved?

[till]

There is no such problem known. You can take a look at the ispconfig.log to see when this account gets changed. The behaviour you describe can e.g. happen when someone uses autofille features which are builtin in most browsers which can result in an autofill of a wrong password when the account is edited.

[pjdevries]

Thanks for your reply.

I don't know exactly how to interpret ispconfig.log, but at first glance I don't see anything unexpected. These are the last couple of lines:

01.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
02.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
03.01.2009 - 23:59:03 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
04.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
05.01.2009 - 23:59:05 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
06.01.2009 - 23:59:05 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
07.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
08.01.2009 - 23:59:05 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
09.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
11.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
12.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
13.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
14.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
15.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
16.01.2009 - 23:59:04 => INFO - /root/ispconfig/scripts/shell/mail_logs.php, Line 132: rm -f /home/admispconfig/mailstats/webXX_foo
webXX_foo:x:10047:10034:Foo Bar:/var/www/webXX/user/webXX_foo:/bin/false
19.01.2009 - 09:34:00 => INFO - /root/ispconfig/scripts/lib/config.lib.php, Line 909: setquota -u webXX_foo 0 0 0 0 -a &> /dev/null
19.01.2009 - 09:34:00 => INFO - /root/ispconfig/scripts/lib/config.lib.php, Line 910: setquota -T -u webXX_foo 604800 604800 -a &> /dev/null
19.01.2009 - 09:34:00 => INFO - /root/ispconfig/scripts/lib/classes/ispconfig_procmail.lib.php, Line 60: cp -f /root/ispconfig/isp/conf/forward.master /var/www/webXX/user/web
34_foo/.forward

I assume the last three lines, dated 19.01.2009, ar a result from me resetting the password this morning. Other than that, I don't see any lines that indicate some kind of account change.

I don't think the problem is caused by the browser problem you describe, because this particular client is not very computer educated and doesn't use ISPConfig herself.

Any other suggestions?

[falko]

Do /etc/passwd and /etc/shadow look ok when this happens, or do they somehow look "mixed up"?

[pjdevries]

I'm not sure what you mean by "mixed up", but as far as I can tell, they both look ok.

[till]

Please check the password and group files with the commands:


pwck

and

grpck

[pjdevries]

This is what pwck -r reports:

user lp: directory /var/spool/lpd does not exist
user news: directory /var/spool/news does not exist
user uucp: directory /var/spool/uucp does not exist
user list: directory /var/list does not exist
user irc: directory /var/run/ircd does not exist
user gnats: directory /var/lib/gnats does not exist
user nobody: directory /nonexistent does not exist
user ntp: directory /home/ntp does not exist
invalid password file entry
delete line 'web25_guus:x:::::/dev/null'? No
user ispconfigend: directory /home/ispconfigend does not exist
user ispconfigend: program /sbin/nologin does not exist
pwck: no changes

Apparantly there is no web25 (anymore) so I guess I can safely delete the line 'web25_guus:x:::::/dev/null'.

What is the function of the 'ispconfigend' line?

grpck -r reports nothing.

[till]

Apparantly there is no web25 (anymore) so I guess I can safely delete the line 'web25_guus:x:::::/dev/null'.

Yes.

What is the function of the 'ispconfigend' line?

It defines the end of userid range which is reserved for ispconfig. This prevents that new users created with other linux tools e.g. when a new softeare is installed collide with ispconfig users.

[pjdevries]

Thanx. So other than the strange web26_guus entry, nothing serious is going on, is there?

[till]

nothing serious is going on, is there?

I dont think so, the output looks fine.